[论文] [论文] Reva: Real-Time Vulnerability Detection through Contextual Probin...

论文概要

研究领域: ML 作者: Amine Lbath, Massih-Reza Amini 发布时间: 2026-10-26 arXiv: 2610.35829

中文摘要

漏洞发现越晚修复成本越高。当编码智能体生成代码快过开发者评审，软件需要一道实时筛查每个新函数的第一道防线。LLM 智能体最近已能像安全专家一样发现真实漏洞：运行分析工具、探索周边代码、检验假设、权衡证据后下结论；但这种推理跨越多次模型调用，每个判定耗时数分钟，对实时筛查太慢。更快的检测器——微调深度模型或直接让 LLM 判定——准确度更低：缺少智能体收集的上下文，且即便给 LLM 部分上下文，其直接结论也不可靠。我们提出 REVA（实时漏洞分析）：把智能体式检测器背后的安全上下文与代码理解组件压进 LLM 单次前向传播。对每个新函数，REVA 提供所在模块预计算的威胁模型、轻量静态分析结果与调用图信息，并用训练好的探针读取 LLM 在该上下文中对新函数的内部表征。PrimeVul 留出测试集上，基于 GLM-5.3-Flash 的 REVA 每个函数约 1 秒达 60.0% 准确率，与同 LLM 的 SOTA 智能体检测器 VulTriage（59.2%）相当，但快 250 倍以上、成本不到十分之一；同一提示下探针比 LLM 直接判定准确率高 14%–17%；三个开源 LLM 上至少与 VulTriage 持平，其中两个高约 10%。LLM 的内部表征已编码智能体检测器经推理才能获得的大部分信息。

原文摘要

A vulnerability costs more to fix the later it is discovered. As coding agents generate code faster than developers can review it, software needs a first line of defense screening each new function in real time. LLM agents have recently become capable of finding real-world vulnerabilities by working as a security expert would: they run analysis tools, explore the surrounding code, test hypotheses and weigh the evidence before forming their own judgement. This reasoning, however, spans many model calls, so that each verdict takes minutes of compute, far too long for real-time screening. Faster detectors, which fine-tune deep learning models or prompt an LLM for a direct verdict, are less accurate: they judge a function without the context an agent gathers, and an LLM's generated verdict is unreliable even when given some of it. We present REVA (REal-time Vulnerability Analysis), an AI vulnerability detector that brings the security context and code understanding components behind agentic detectors into a single forward pass of an LLM. For each new function, REVA gives the LLM a pre-computed threat model of its module, lightweight static analysis findings and call-graph information. REVA leverages a trained probe to read the LLM's internal representations of the new function in this context. On PrimeVul's held-out test set, REVA on GLM-5.3-Flash reaches 60.0% accuracy in about one second per function. This matches VulTriage (59.2%), the state-of-the-art agentic detector, run on the same LLM, while being over 250 times faster and less than a tenth as costly. On the same prompt, the probe is 14% to 17% more accurate than the LLM's own direct verdict. Across three open LLMs, REVA is at least as accurate as VulTriage, and about 10% more accurate on two of them. An LLM's internal representations thus encode much of what agentic detectors obtain through reasoning.

---

*自动采集于 2026-10-28*

#论文 #arXiv #ML #小凯