---
source: arxiv
url: http://arxiv.org/abs/2604.10767v1
published_at: '2026-04-12T18:31:46'
authors:
- Yiheng Cao
- Yihao Chen
- Xin Hu
- Bihuan Chen
- Jiayi Deng
- Zhuotong Zhou
- Susheng Wu
- Yiheng Huang
- Xueying Du
- Xingman Chen
- Miaohua Li
- Xin Peng
topics:
- vulnerability-detection
- code-intelligence
- llm-reasoning
- static-analysis
- program-graphs
relevance_score: 0.88
run_id: materialize-outputs
language_code: en
---

# VulWeaver: Weaving Broken Semantics for Grounded Vulnerability Detection

## Summary
VulWeaver is an LLM-based vulnerability detector that tries to fix broken static-analysis semantics before asking the model to reason about code. It combines an enhanced dependency graph, broader context extraction, and guideline-driven prompting to improve accuracy and reduce brittle pattern matching.

## Problem
- Source-code vulnerability detection misses real semantics when static analysis builds incomplete or noisy call, control-flow, and data-dependency graphs, especially around reflection, polymorphism, and global definitions.
- Many learning and LLM systems analyze only local or one-directional slices, so they miss inter-procedural and implicit context such as sanitizer definitions or global configuration.
- Plain chain-of-thought prompting can key on variable names and other lexical hints instead of program behavior, which hurts reliability on patched code and adversarial renaming.

## Approach
- VulWeaver builds a unified dependency graph from Joern outputs by merging call, control-flow, and data-dependency relations at statement level.
- It then enhances that graph with a neuro-symbolic method: deterministic rules plus LLM inference to repair missing or spurious semantics, with explicit handling for Java polymorphic and reflective calls and added global nodes parsed with Tree-sitter.
- From the enhanced graph, it extracts a holistic vulnerability context for each sensitive API call by combining explicit slices with implicit context such as usage, definition, and declaration information that normal slicing misses.
- It maps sensitive APIs to vulnerability types and uses meta-prompting with expert-written, CWE-specific reasoning guidelines so the LLM follows a fixed analysis procedure over the extracted context.
- It runs multiple LLM queries and uses majority voting to stabilize predictions; the knowledge base covers 102 CWE types.

## Results
- On PrimeVul4J, VulWeaver reports precision **0.81**, recall **0.70**, and F1 **0.75**.
- On the same dataset, it beats the best learning-based, LLM-based, and agent-based baselines by **23%**, **15%**, and **60%** in F1, respectively.
- Its VP-S score is **0.58**, which is **164%** higher than the best baseline, indicating stronger separation between vulnerable code and patched counterparts.
- On C/C++ PrimeVul with minimal adaptation, it reaches **F1 0.78** and still outperforms all baselines.
- In a robustness study with adversarial identifier renaming, standard CoT prompting lost **11% to 39%** F1 and **44% to 1,050%** VP-S across five LLMs, while meta-prompting kept F1 drops to **0% to 6%** and VP-S reductions within **16%**.
- In real-world use, VulWeaver found **26** true vulnerabilities across **9** Java projects, with **15** confirmed by developers and **5** assigned CVEs; an industrial deployment found **40** confirmed vulnerabilities.

## Link
- [http://arxiv.org/abs/2604.10767v1](http://arxiv.org/abs/2604.10767v1)