VulWeaver: Weaving Broken Semantics for Grounded Vulnerability Detection
Yiheng Cao, Yihao Chen, Xin Hu, Bihuan Chen, Jiayi Deng, Zhuotong Zhou, Susheng Wu, Yiheng Huang, Xueying Du, Xingman Chen, Miaohua Li, and Xin Peng

TL;DR
VulWeaver is an innovative LLM-based method that enhances program semantics understanding for more accurate vulnerability detection, outperforming existing approaches on multiple datasets and real-world projects.
Contribution
It introduces a novel approach combining enhanced dependency graphs, holistic context extraction, and meta-prompting to improve grounded vulnerability detection accuracy.
Findings
Achieved 0.75 F1-score on PrimeVul4J, outperforming baselines by up to 23%.
Detected 26 vulnerabilities in Java projects, with 15 confirmed by developers.
Identified 40 vulnerabilities in an industrial setting, demonstrating practical effectiveness.
Abstract
Detecting vulnerabilities in source code remains critical yet challenging, as conventional static analysis tools construct inaccurate program representations, while existing LLM-based approaches often miss essential vulnerability context and lack grounded reasoning. To mitigate these challenges, we introduce VulWeaver, a novel LLM-based approach that weaves broken program semantics into accurate representations and extracts holistic vulnerability context for grounded vulnerability detection. Specifically, VulWeaver first constructs an enhanced unified dependency graph (UDG) by integrating deterministic rules with LLM-based semantic inference to address static analysis inaccuracies. It then extracts holistic vulnerability context by combining explicit contexts from program slicing with implicit contexts, including usage, definition, and declaration information. Finally, VulWeaver employs…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
