用多智能体和自动优化提示,提升代码漏洞检测的准确性和覆盖面。
MulVul: Retrieval-augmented Multi-Agent Code Vulnerability Detection via Cross-Model Prompt Evolution
- 分步检测:先分类后精筛,用检索增强减少幻觉。
- 在130类漏洞上达34.79%宏平均F1,比最佳基线高41.5%。
- 自动优化提示机制,避免单一模型自我修正偏差,适合大规模漏洞检测。
大语言模型在自动化真实世界漏洞检测中面临两大挑战:漏洞模式异构性导致单一模型效果不佳,且针对海量漏洞类别进行手动提示工程难以扩展。为此,我们提出MulVul——一种检索增强的多智能体框架,实现精准且广覆盖的漏洞检测。MulVul采用粗到细策略:路由代理(Router)先预测前k个粗粒度类别,并将输入转发给专用检测代理(Detector),后者识别具体漏洞类型。两者均配备检索工具,从漏洞知识库主动获取证据以缓解幻觉。关键在于,我们设计了跨模型提示进化机制,由生成器模型迭代优化候选提示,由独立执行器模型验证其有效性,从而避免单模型优化中的自我修正偏差。在130个CWE类型上的评估显示,MulVul取得34.79%宏平均F1,优于最佳基线41.5%。消融实验表明,该机制相较人工提示提升51.6%,有效应对多样化的漏洞模式。
原文摘要 · Abstract (English)
Large Language Models (LLMs) struggle to automate real-world vulnerability detection due to two key limitations: the heterogeneity of vulnerability patterns undermines the effectiveness of a single unified model, and manual prompt engineering for massive weakness categories is unscalable. To address these challenges, we propose \textbf{MulVul}, a retrieval-augmented multi-agent framework designed for precise and broad-coverage vulnerability detection. MulVul adopts a coarse-to-fine strategy: a \emph{Router} agent first predicts the top-$k$ coarse categories and then forwards the input to specialized \emph{Detector} agents, which identify the exact vulnerability types. Both agents are equipped with retrieval tools to actively source evidence from vulnerability knowledge bases to mitigate hallucinations. Crucially, to automate the generation of specialized prompts, we design \emph{Cross-Model Prompt Evolution}, a prompt optimization mechanism where a generator LLM iteratively refines candidate prompts while a distinct executor LLM validates their effectiveness. This decoupling mitigates the self-correction bias inherent in single-model optimization. Evaluated on 130 CWE types, MulVul achieves 34.79\% Macro-F1, outperforming the best baseline by 41.5\%. Ablation studies validate cross-model prompt evolution, which boosts performance by 51.6\% over manual prompts by effectively handling diverse vulnerability patterns.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。