arXiv Machine Learning July 17, 2026 By Laura Baird, Armin Moin

Towards Predicting Multi-Vulnerability Attack Chains in Software Supply Chains from Software Bill of Materials Graphs

Read the original on arXiv Machine Learning →

arXiv:2604. 04977v2 Announce Type: replace-cross Abstract: Software supply chain security compromises often stem from cascaded interactions of vulnerabilities, for example, between multiple vulnerable components.

Summary generated by The Flow from the publisher's feed. The full article lives at arXiv Machine Learning.

arXiv Machine Learning

Jul 3

From Lab to Reality: A Practical Evaluation of Deep Learning Models and LLMs for Vulnerability Detection

arXiv:2512. 10485v2 Announce Type: replace-cross Abstract: Vulnerability detection methods based on deep learning (DL) have shown strong performance on benchmark datasets, yet their real-world effectiveness remains underexplored.

By Chaomeng Lu, Bert Lagaisse

llms benchmarks

arXiv Machine Learning

Aug 11

Learning to Triage Vulnerability Reports from Program Analysis: An Empirical Study in Node.js

arXiv:2510. 20739v2 Announce Type: replace-cross Abstract: Program analysis tools often produce large volumes of candidate vulnerability reports that require costly manual review, creating a practical challenge: how can security analysts prioritize the reports most likely to be true vulnerabilities?

By Ronghao Ni, Aidan Z. H. Yang, Min-Chien Hsu, Nuno Sabino, Limin Jia, Ruben Martins, Darion Cassel, Kevin Cheang

llms benchmarks

arXiv AI

Jul 1

CVE-TTP KG: Knowledge Graph Linking Software Vulnerabilities to Attack Behaviors

arXiv:2606. 31557v1 Announce Type: cross Abstract: In the evolving threat landscape, adversaries exploit software vulnerabilities to launch sophisticated attacks, challenging traditional defenses.

By Basant Agarwal, Dincy R. Arikkat, Swati Yadav, Serena Nicolazzo, Antonino Nocera, Vinod P

llms

arXiv AI

Jun 17

ARVO: Atlas of Reproducible Vulnerabilities for Open-Source Software

arXiv:2606. 17283v1 Announce Type: cross Abstract: Achieving reproducibility, quantity, and diversity in vulnerability datasets has long been viewed as an inherent three-way trade-off, where improving one dimension often comes at the cost of the others.

By Xiang Mei, Jordi Del Castillo, Pulkit Singh Singaria, Haoran Xi, Abdelouahab Benchikh, Tiffany Bao, Ruoyu Wang, Yan Shoshitaishvili, Adam Doup\'e, Hammond Pearce, Brendan Dolan-Gavitt

arXiv AI

Jul 31

Graph Is the Verifier: Agentic Reinforcement Learning for Interprocedural Vulnerability Detection

arXiv:2607. 26656v1 Announce Type: cross Abstract: Real-world vulnerabilities often span multiple functions, yet most learning-based detectors classify each function in isolation: on a sample of real CVEs, we find that 71.

By Yikun Li, Ting Zhang, Jiakun Liu, Jinfeng Jiang, Yuheng Yieh, Yixin Yang, Wen Bin Leow, Yide Yin, Yintong Huo, Eng Lieh Ouh, Lwin Khin Shar, David Lo

agents reinforcement-learning benchmarks

arXiv AI

Jul 7

LLM-Enhanced Hierarchical Heterogeneous Graph Representation Learning for Malicious Python Package Detection

arXiv:2607. 03350v1 Announce Type: cross Abstract: Malicious Python packages have become a major threat to software supply chain ecosystems due to the widespread adoption of open-source repositories such as PyPI.

By Hang Gao, Xiaoyu Chen, Baoquan Cui, Zhen Tang, Peng Qiao, Fengge Wu, Jian Zhang

llms benchmarks

Related stories

From Lab to Reality: A Practical Evaluation of Deep Learning Models and LLMs for Vulnerability Detection

Learning to Triage Vulnerability Reports from Program Analysis: An Empirical Study in Node.js

CVE-TTP KG: Knowledge Graph Linking Software Vulnerabilities to Attack Behaviors

ARVO: Atlas of Reproducible Vulnerabilities for Open-Source Software

Graph Is the Verifier: Agentic Reinforcement Learning for Interprocedural Vulnerability Detection

LLM-Enhanced Hierarchical Heterogeneous Graph Representation Learning for Malicious Python Package Detection