零样本多智能体系统实现漏洞检测新纪录，无需训练即超越微调模型。
MultiVer: Zero-Shot Multi-Agent Vulnerability Detection
- 四智能体协同分析代码漏洞，通过投票机制提升检测能力。
- 在PyVul上达到82.7%召回率，高于微调GPT-3.5的81.3%。
- 适合对漏报容忍度高的安全场景，尤其关注高召回需求。
我们提出MultiVer，一种零样本多智能体漏洞检测系统，在无需微调的情况下实现了最先进的召回率。该系统由安全、正确性、性能和风格四个智能体组成的集成框架，采用并集投票策略，在PyVul数据集上达到82.7%的召回率，较微调版GPT-3.5的81.3%高出1.4个百分点——这是首个在该基准上超越微调模型的零样本系统。在SecurityEval上，相同架构实现91.7%的检测率，与专用系统相当。召回率提升以精度下降为代价：精度为48.8%，低于微调基线的63.9%，最终F1得分为61.4%。消融实验表明，多智能体集成相比单一安全分析可提升17个百分点的召回率。结果表明，在误报代价低于漏报的安全应用中，零样本多智能体集成可在关键指标上匹配甚至超越微调模型。
原文摘要 · Abstract (English)
We present MultiVer, a zero-shot multi-agent system for vulnerability detection that achieves state-of-the-art recall without fine-tuning. A four-agent ensemble (security, correctness, performance, style) with union voting achieves 82.7% recall on PyVul, exceeding fine-tuned GPT-3.5 (81.3%) by 1.4 percentage points -- the first zeroshot system to surpass fine-tuned performance on this benchmark. On SecurityEval, the same architecture achieves 91.7% detection rate, matching specialized systems. The recall improvement comes at a precision cost: 48.8% precision versus 63.9% for fine-tuned baselines, yielding 61.4% F1. Ablation experiments isolate component contributions: the multi-agent ensemble adds 17 percentage points recall over single-agent security analysis. These results demonstrate that for security applications where false negatives are costlier than false positives, zero-shot multi-agent ensembles can match and exceed fine-tuned models on the metric that matters most.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。