Reva: Real-Time Vulnerability Detection through Contextual Probing of Large Language Models

📄 arXiv: 2610.35829v1 📥 PDF

作者: Amine Lbath, Massih-Reza Amini

分类: cs.CR, cs.AI

发布日期: 2026-10-26

💡 一句话要点

提出REVA以解决实时漏洞检测问题

🎯 匹配领域: 支柱九：具身大模型 (Embodied Foundation Models)

关键词: 实时漏洞检测 大型语言模型 安全上下文 代码理解 静态分析 机器学习 软件安全

📋 核心要点

  1. 现有方法在实时漏洞检测中面临速度慢和准确性不足的挑战，尤其是在多次模型调用的情况下。
  2. REVA通过将安全上下文和代码理解整合到LLM的单次前向传递中，显著提高了检测速度和准确性。
  3. 在实验中，REVA在PrimeVul测试集上达到了60.0%的准确率，比VulTriage快250倍，且在多个开源LLM上表现优于现有方法。

📝 摘要（中文）

漏洞的修复成本随着发现时间的推迟而增加。随着编码代理生成代码的速度超过开发者的审查能力，软件需要实时筛查每个新功能。近期，大型语言模型（LLM）能够像安全专家一样发现现实世界中的漏洞，但其推理过程需要多个模型调用，导致每次判断耗时过长。为此，本文提出REVA（实时漏洞分析），将安全上下文和代码理解组件整合到LLM的单次前向传递中。REVA在PrimeVul的测试集上，使用GLM-5.3-Flash达到了60.0%的准确率，速度比现有最优代理检测器VulTriage快250倍，且成本低于十分之一。

🔬 方法详解

问题定义：本文旨在解决实时漏洞检测中的速度和准确性问题。现有方法通常需要多次模型调用，导致判断耗时过长，且缺乏上下文信息，影响准确性。

核心思路：REVA的核心思路是将安全上下文和代码理解组件整合到LLM的单次前向传递中，通过提供预计算的威胁模型和轻量级静态分析结果来提升检测效率和准确性。

技术框架：REVA的整体架构包括输入新功能的威胁模型、静态分析结果和调用图信息，利用训练好的探测器读取LLM内部表示，进行快速判断。

关键创新：REVA的最大创新在于将多次调用的推理过程简化为一次前向传递，显著提高了检测速度，同时保持了与现有最优代理检测器相当的准确性。

关键设计：REVA的设计中，使用了预计算的威胁模型和静态分析结果，确保LLM在判断时具备必要的上下文信息。此外，探测器的训练使得其能够有效解读LLM的内部表示，提升了准确性。

📊 实验亮点

REVA在PrimeVul的测试集上达到了60.0%的准确率，运行速度约为每个功能一秒，超过现有最优代理检测器VulTriage的59.2%准确率，同时速度快250倍，成本低于十分之一。此外，REVA在多个开源LLM上表现出更高的准确性，提升幅度在10%左右。

🎯 应用场景

REVA的研究成果在软件开发和安全领域具有广泛的应用潜力。它可以作为实时漏洞检测的第一道防线，帮助开发者在代码生成的同时及时发现潜在的安全问题，从而降低修复成本，提高软件安全性。未来，REVA可能会与更多开发工具集成，进一步提升软件开发的安全性和效率。

📄 摘要（原文）

A vulnerability costs more to fix the later it is discovered. As coding agents generate code faster than developers can review it, software needs a first line of defense screening each new function in real time. LLM agents have recently become capable of finding real-world vulnerabilities by working as a security expert would: they run analysis tools, explore the surrounding code, test hypotheses and weigh the evidence before forming their own judgement. This reasoning, however, spans many model calls, so that each verdict takes minutes of compute, far too long for real-time screening. Faster detectors, which fine-tune deep learning models or prompt an LLM for a direct verdict, are less accurate: they judge a function without the context an agent gathers, and an LLM's generated verdict is unreliable even when given some of it. We present REVA (REal-time Vulnerability Analysis), an AI vulnerability detector that brings the security context and code understanding components behind agentic detectors into a single forward pass of an LLM. For each new function, REVA gives the LLM a pre-computed threat model of its module, lightweight static analysis findings and call-graph information. REVA leverages a trained probe to read the LLM's internal representations of the new function in this context. On PrimeVul's held-out test set, REVA on GLM-5.3-Flash reaches 60.0% accuracy in about one second per function. This matches VulTriage (59.2%), the state-of-the-art agentic detector, run on the same LLM, while being over 250 times faster and less than a tenth as costly. On the same prompt, the probe is 14% to 17% more accurate than the LLM's own direct verdict. Across three open LLMs, REVA is at least as accurate as VulTriage, and about 10% more accurate on two of them. An LLM's internal representations thus encode much of what agentic detectors obtain through reasoning.