vul-rag : Enhancing LLM-based Vulnerability Detection via Knowledge-level RAG
Abstract
Although LLMs have shown promising potential in vulnerability detection, this study reveals their limitations in distinguishing between vulnerable and similar-but-benign patched code (only 0.06–0.14 accuracy). It shows that LLMs struggle to capture the root causes of vulnerabilities during vulnerability detection. To address this challenge, we propose enhancing LLMs with multi-dimensional vulnerability knowledge distilled from historical vulnerabilities and fixes. We design a novel knowledge-level Retrieval-Augmented Generation framework Vul-RAG , which improves LLMs with an accuracy increase of 16–24% in identifying vulnerable and patched code. Additionally, vulnerability knowledge generated by Vul-RAG can further (1) serve as high-quality explanations to improve manual detection accuracy (from 60% to 77%), and (2) detect 10 previously-unknown bugs in the recent Linux kernel release with six assigned CVEs.
Fields of Study & Subjects
Advanced Malware Detection Techniques
Security and Verification in Computing
Software Engineering Research
Publication details
- Journal / source
- ACM Transactions on Software Engineering and Methodology
- Publisher
- Association for Computing Machinery (ACM)
- Volume
- 35
- Issue
- 10
- Pages
- 1–25
- Publication date
- 20 February 2026
- Language
- EN