arXiv AI
Retrieve, Reproduce, Reveal: Dissecting Retrieval-Augmented Software Vulnerability Detection
Read the original on arXiv AI →The Flow has not summarised this story yet — read it at arXiv AI.
Related stories
arXiv AI
Jun 4
Revisiting Vul-RAG: Reproducibility and Replicability of RAG-based Vulnerability Detection with Open-Weight Models
arXiv:2606. 04739v1 Announce Type: cross Abstract: Large language models (LLMs) have shown strong potential for automated software vulnerability detection, particularly in retrieval-augmented generation (RAG) settings.
arXiv AI
Jun 8
RAVEN: Retrieval-Augmented Vulnerability Exploration Network for Memory Corruption Analysis in User Code and Binary Programs
arXiv:2604. 17948v2 Announce Type: replace-cross Abstract: Large Language Models (LLMs) have demonstrated remarkable capabilities across various cybersecurity tasks, including vulnerability classification, detection, and patching.
arXiv AI
Aug 19
Benchmarking Automated Security Patch Backporting: How Far Are We?
The paper introduces Porting Benchmark, a curated dataset of 1,234 security patch backporting cases that span cross-version, cross-branch, and cross-repository scenarios, along with a common evaluation framework. Five tools—spanning program analysis, LLM prompting, and LLM agents—are evaluated under aligned settings, revealing that performance varies significantly across tools and that complex patches (Type-IV) see a sharp drop in success rate. The study identifies four root-cause categories for failures and demonstrates that reference-based benchmark scores may not fully capture real-world remediation, as executable validation uncovers additional integration issues.
arXiv AI
Jun 17
ARVO: Atlas of Reproducible Vulnerabilities for Open-Source Software
arXiv:2606. 17283v1 Announce Type: cross Abstract: Achieving reproducibility, quantity, and diversity in vulnerability datasets has long been viewed as an inherent three-way trade-off, where improving one dimension often comes at the cost of the others.
arXiv Machine Learning
Jun 16
Data-Centric Benchmarking of Exploit Generation in LLMs: Understanding the Impact of Fine-Tuning
arXiv:2606. 15123v1 Announce Type: cross Abstract: We study the task of CVE-conditioned exploit generation, where a model drafts proof-of-concept (PoC) exploits given software vulnerability context.
arXiv AI
Sep 2
Athena: Vulnerability-Affected Library Identification via Knowledge Graph Completion
Athena is a graph-based system that identifies affected libraries for software vulnerabilities by modeling vulnerability databases as a knowledge graph and applying knowledge graph completion. It integrates CVEs, libraries, CWE types, CPE products, and software ecosystems, then predicts missing affected libraries using link prediction and refines results with a fine‑tuned LLM that incorporates graph embeddings. Experiments on the VulLib dataset show Athena outperforms four state‑of‑the‑art baselines, achieving a 32% higher average F1 score and demonstrating that a smaller KGC backbone can surpass larger LLM‑only approaches.