VulTriage: Triple-Path Context Augmentation for LLM-Based Vulnerability Detection
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , , , , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2026
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866918495614140416 |
|---|---|
| author | Tang, Wenxin Zhang, Xiang Liu, Junliang Xiao, Jingyu Xiao, Xi Yang, Jinlong Ma, Yuehe Liu, Zhenyu Li, Zhengheng Wang, Zicheng Luo, Wang Li, Qing Wang, Lei Xiangli, Peng |
| author_facet | Tang, Wenxin Zhang, Xiang Liu, Junliang Xiao, Jingyu Xiao, Xi Yang, Jinlong Ma, Yuehe Liu, Zhenyu Li, Zhengheng Wang, Zicheng Luo, Wang Li, Qing Wang, Lei Xiangli, Peng |
| contents | Automated vulnerability detection is a fundamental task in software security, yet existing learning-based methods still struggle to capture the structural dependencies, domain-specific vulnerability knowledge, and complex program semantics required for accurate detection. Recent Large Language Models (LLMs) have shown strong code understanding ability, but directly prompting them with raw source code often leads to missed vulnerabilities or false alarms, especially when vulnerable and benign functions differ only in subtle semantic details. To address this, we propose VulTriage, a triple-path context augmentation framework for LLM-based vulnerability detection. VulTriage enhances the LLM input through three complementary paths: a Control Path that extracts and verbalizes AST, CFG, and DFG information to expose control and data dependencies; a Knowledge Path that retrieves relevant CWE-derived vulnerability patterns and examples through hybrid dense--sparse retrieval; and a Semantic Path that summarizes the functional behavior of the code before the final judgment. These contexts are integrated into a unified instruction to guide the LLM toward more reliable vulnerability reasoning. Experiments on the PrimeVul pair test set show that VulTriage achieves state-of-the-art performance, outperforming existing deep learning and LLM-based baselines on key pair-wise and classification metrics. Further ablation studies verify the effectiveness of each path, and additional experiments on the Kotlin dataset demonstrate the generalization ability of VulTriage under low-resource and class-imbalanced settings. Our code is available at https://github.com/vinsontang1/VulTriage |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2605_09461 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | VulTriage: Triple-Path Context Augmentation for LLM-Based Vulnerability Detection Tang, Wenxin Zhang, Xiang Liu, Junliang Xiao, Jingyu Xiao, Xi Yang, Jinlong Ma, Yuehe Liu, Zhenyu Li, Zhengheng Wang, Zicheng Luo, Wang Li, Qing Wang, Lei Xiangli, Peng Artificial Intelligence Automated vulnerability detection is a fundamental task in software security, yet existing learning-based methods still struggle to capture the structural dependencies, domain-specific vulnerability knowledge, and complex program semantics required for accurate detection. Recent Large Language Models (LLMs) have shown strong code understanding ability, but directly prompting them with raw source code often leads to missed vulnerabilities or false alarms, especially when vulnerable and benign functions differ only in subtle semantic details. To address this, we propose VulTriage, a triple-path context augmentation framework for LLM-based vulnerability detection. VulTriage enhances the LLM input through three complementary paths: a Control Path that extracts and verbalizes AST, CFG, and DFG information to expose control and data dependencies; a Knowledge Path that retrieves relevant CWE-derived vulnerability patterns and examples through hybrid dense--sparse retrieval; and a Semantic Path that summarizes the functional behavior of the code before the final judgment. These contexts are integrated into a unified instruction to guide the LLM toward more reliable vulnerability reasoning. Experiments on the PrimeVul pair test set show that VulTriage achieves state-of-the-art performance, outperforming existing deep learning and LLM-based baselines on key pair-wise and classification metrics. Further ablation studies verify the effectiveness of each path, and additional experiments on the Kotlin dataset demonstrate the generalization ability of VulTriage under low-resource and class-imbalanced settings. Our code is available at https://github.com/vinsontang1/VulTriage |
| title | VulTriage: Triple-Path Context Augmentation for LLM-Based Vulnerability Detection |
| topic | Artificial Intelligence |
| url | https://arxiv.org/abs/2605.09461 |