用博弈论设计多智能体系统,低成本高精度检测代码漏洞。
Strategic Heterogeneous Multi-Agent Architecture for Cost-Effective Code Vulnerability Detection
- 三名云端专家并行分析代码结构、安全模式和调试逻辑,本地轻量验证器零成本纠错。
- 每样本仅需0.002美元,达77.2% F1分数,召回率100%,精度提升10.3个百分点。
- 适合需要高精度与低算力成本的软件安全团队,尤其在真实漏洞数据上表现突出。
自动化代码漏洞检测对软件安全至关重要,但现有方法在检测准确率与计算成本间存在根本权衡。我们提出一种受博弈论启发的异构多智能体架构,结合云上大模型专家与本地轻量验证器。采用“3+1”架构:三个云上专家(DeepSeek-V3)并行从代码结构、安全模式、调试逻辑三方面分析,本地验证器(Qwen3-8B)以零边际成本执行对抗性验证。通过两层博弈框架形式化设计:(1) 专家间合作博弈,体现多元视角带来的超加性价值;(2) 对抗验证博弈,建模质量保障激励机制。在来自NIST Juliet Test Suite的262个真实样本(涵盖14类CWE,正负样本均衡)上的实验表明,该方法实现77.2% F1分数,62.9%精确率,100%召回率,单样本成本仅0.002美元,优于单一专家大模型基线(F1 71.4%)与Cppcheck静态分析(MCC 0)。对抗验证器显著提升精确率(+10.3个百分点,p < 1e-6,McNemar检验),并实现3.0倍加速。研究证明博弈论可指导成本敏感型软件工程任务中的异构多智能体系统设计。
原文摘要 · Abstract (English)
Automated code vulnerability detection is critical for software security, yet existing approaches face a fundamental trade-off between detection accuracy and computational cost. We propose a heterogeneous multi-agent architecture inspired by game-theoretic principles, combining cloud-based LLM experts with a local lightweight verifier. Our "3+1" architecture deploys three cloud-based expert agents (DeepSeek-V3) that analyze code from complementary perspectives - code structure, security patterns, and debugging logic - in parallel, while a local verifier (Qwen3-8B) performs adversarial validation at zero marginal cost. We formalize this design through a two-layer game framework: (1) a cooperative game among experts capturing super-additive value from diverse perspectives, and (2) an adversarial verification game modeling quality assurance incentives. Experiments on 262 real samples from the NIST Juliet Test Suite across 14 CWE types, with balanced vulnerable and benign classes, demonstrate that our approach achieves a 77.2% F1 score with 62.9% precision and 100% recall at $0.002 per sample - outperforming both a single-expert LLM baseline (F1 71.4%) and Cppcheck static analysis (MCC 0). The adversarial verifier significantly improves precision (+10.3 percentage points, p < 1e-6, McNemar's test) by filtering false positives, while parallel execution achieves a 3.0x speedup. Our work demonstrates that game-theoretic design principles can guide effective heterogeneous multi-agent architectures for cost-sensitive software engineering tasks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。