Real-time detection of software vulnerabilities using large language models
Reva: Real-Time Vulnerability Detection through Contextual Probing of Large Language Models
Cryptography and SecurityArtificial Intelligence
Summary
Software bugs that cause security problems cost more to fix if found late. The authors show that large language models (LLMs), when given the right context about a program, can quickly and accurately spot vulnerabilities in new code. Their system, called REVA, examines code along with extra security details to detect problems almost instantly, much faster than previous methods. This means developers can get quick warnings about risky code as it is written, helping prevent bugs from slipping through.
What this means in practice
- •For software developers: Integrate fast and accurate real-time vulnerability screening into development workflows to catch security issues as code is written.
- •For cybersecurity teams: Use REVA to triage and prioritize security reviews based on automatic vulnerability detection that leverages internal model reasoning.
Authors
Amine Lbath, Massih-Reza Amini
Abstract
A vulnerability costs more to fix the later it is discovered. As coding agents generate code faster than developers can review it, software needs a first line of defense screening each new function in real time. LLM agents have recently become capable of finding real-world vulnerabilities by working as a security expert would: they run analysis tools, explore the surrounding code, test hypotheses and weigh the evidence before forming their own judgement. This reasoning, however, spans many model calls, so that each verdict takes minutes of compute, far too long for real-time screening. Faster detectors, which fine-tune deep learning models or prompt an LLM for a direct verdict, are less accurate: they judge a function without the context an agent gathers, and an LLM's generated verdict is unreliable even when given some of it. We present REVA (REal-time Vulnerability Analysis), an AI vulnerability detector that brings the security context and code understanding components behind agentic detectors into a single forward pass of an LLM. For each new function, REVA gives the LLM a pre-computed threat model of its module, lightweight static analysis findings and call-graph information. REVA leverages a trained probe to read the LLM's internal representations of the new function in this context. On PrimeVul's held-out test set, REVA on GLM-5.3-Flash reaches 60.0% accuracy in about one second per function. This matches VulTriage (59.2%), the state-of-the-art agentic detector, run on the same LLM, while being over 250 times faster and less than a tenth as costly. On the same prompt, the probe is 14% to 17% more accurate than the LLM's own direct verdict. Across three open LLMs, REVA is at least as accurate as VulTriage, and about 10% more accurate on two of them. An LLM's internal representations thus encode much of what agentic detectors obtain through reasoning.