RAG-Enhanced Multi-Model Ensemble for Automated Vulnerability Detection Using SLMs

Automated vulnerability detection in source code is essential for modern software security, yet existing approaches suffer from high false positive rates, weak contextual understanding, and limited recall. This work presents the most comprehensive empirical evaluation to date of Small Language Model (SLM) based vulnerability detection, spanning more than twenty system configurations ranging from simple prompting baselines to advanced retrieval-augmented ensembles. Our methodology systematically examines how small LLMs (1–3B parameters) behave under different prompting strategies, static analysis integrations, ensembling techniques, and retrieval mechanisms. Through extensive ablation studies on the DiverseVul dataset, we find that many commonly assumed improvements such as complex Chain-of-Thought prompting, multi-model aggregation, or post-processing verification frequently degrade performance, largely due to overfitting and the inherent reasoning limitations of small models. In contrast, retrieval-augmented generation (RAG) consistently enhances both recall and stability, providing an average F1 gain of 4–5% by grounding model predictions in relevant vulnerability examples. Our best-performing system, a RAG-enhanced stacking ensemble with structured reasoning, achieves a 71.2% F1-score, surpassing the state-of-the-art LLaMA 3.2 model by 5.2 percentage points. our findings demonstrate that effective vulnerability detection does not arise from increased architectural complexity but from combining lightweight models with robust retrieval and context-aware reasoning. This study establishes RAG-driven small LLMs as a practical, cost-efficient, and empirically validated direction for secure software analysis. our source code at https://github.com/rafi79/RAG-Enhanced-Multi-Model-Ensemble-for-Automated-Vulnerability-Detection-Using-SLMs.