Large Language Models (LLMs) are essential for analyzing and addressing vulnerabilities in cybersecurity. However, among over 200,000 vulnerabilities were discovered in the past decade, more than 30,000 have been changed or updated. This necessitates frequent updates to the training datasets and internal knowledge bases of LLMs to maintain knowledge consistency. In this paper, we focus on the problem of knowledge discrepancy and conflict within CVE (Common Vulnerabilities and Exposures) detection and analysis. This problem hinders LLMs' ability to retrieve the latest knowledge from original training datasets, leading to knowledge conflicts, fabrications of factually incorrect results, and generation hallucinations. To address this problem, we propose an innovative two-stage framework called CRVA-TGRAG (Conflict Resolution in Vulnerability Analysis via Teacher-Guided Retrieval-Augmented Generation). First, to improve document retrieval accuracy during the retrieval stage, we utilize Parent Document Segmentation and an ensemble retrieval scheme based on semantic similarity and inverted indexing. Second, to enhance LLMs' capabilities based on the retrieval of CVE dataset in generation stage, we employ a teacher-guided preference optimization technique to fine-tune LLMs. Our framework not only enhances the quality of content retrieval through RAG but also leverages the advantages of preference fine-tuning in LLMs to answer questions more effectively and precisely. Experiments demonstrate our method achieves higher accuracy in retrieving the latest CVEs compared to external knowledge bases. In conclusion, our framework significantly mitigates potential knowledge conflicts and inconsistencies that may arise from relying solely on LLMs for knowledge retrieval.
Figures & tables
Figure 1: Knowledge conflict in LLM retrieving CVE related information
Figure 2: The pipeline of our framework. The user queries GPT-4o-mini, but due to internal knowledge conflicts, the returned results are incorrect. In our method, we obtain the latest CVE knowledge from official sources during pre-processing. In Stage I , we segment the formatted files using a semantic similarity-based segmentation approach and perform retrieval using ensemble retrieval. Then in Stage II , we fine-tune the LLM through teacher-guided preference optimization. Meanwhile, we evaluate the output’s accuracy, faithfulness, and other metrics through our evaluation framework.
D={(x(i),yw(i),yl(i))}i=1N
Algorithm 1 Stage II DPO
Figure 3: CVE vulnerabilities that have changed from 2014 to 2024. The gray parts represent the total number of changes that occurred in the corresponding year, The red parts indicate the number of high-risk CVE vulnerabilities that changed.
Figure 4: Three different values of the split point percentiles. The different colors denote the split results and the redline indicates the threshold of the split point percentiles
Method
LLM
Metrics
Faith
CR
CP
AR
AC
AS
BLUE
ROUGE-L
F
P
R
No Prompt
GPT-4o-mini
-
-
-
0.57
0.32
0.80
0.03
0.18
0.12
0.13
Claude-3.5-Haiku-20241022
-
-
-
0.47
0.36
0.80
0.03
0.15
0.11
0.11
Gemini-2.0-Flash-Exp
-
-
-
0.91
0.29
0.80
0.04
0.19
0.12
0.13
Llama-3-70B
-
-
-
0.25
0.35
0.78
0.03
0.16
0.10
0.11
Table 1: The Evaluation Metrics Result in CVE Knowledge Conflict Resolving. We evaluate 6 methods and 7 LLMs with different parameters and size. The bold entities denote the best results in each column and the underlined ones denote the second best results. As for ROUGE-L, F denotes F-measure, P denotes Precision and R denotes Recall. The other metrics are introduced in Setion 4.3 Evaluation Metrics.
Large Language Models (LLMs) have demonstrated remarkable capabilities across various cybersecurity tasks, including vulnerability classification, detection, and patching. However, their potential in automated vulnerability report documentation and analysis remains underexplored. We present RAVEN (Retrieval Augmented Vulnerability Exploration Network), a framework leveraging LLM agents and Retrieval Augmented Generation (RAG) to synthesize comprehensive vulnerability analysis reports. Given vulnerable source code, RAVEN generates reports following the Google Project Zero Root Cause Analysis template. The framework uses four modules: an Explorer agent for vulnerability identification, a RAG engine retrieving relevant knowledge from curated databases including Google Project Zero reports and CWE entries, an Analyst agent for impact and exploitation assessment, and a Reporter agent for structured report generation. To ensure quality, RAVEN includes a task specific LLM Judge evaluating reports across structural integrity, ground truth alignment, code reasoning quality, and remediation quality. We evaluate RAVEN on 105 vulnerable code samples covering 15 CWE types from the NIST-SARD dataset. Results show an average quality score of 54.21%, supporting the effectiveness of our approach for automated vulnerability documentation.
Parteek Jamwal, Minghao Shao, Boyuan Chen +15
2New York University Abu Dhabi, UAE · 3Technology Innovation Institute, UAE
Recent work applies Large Language Models (LLMs) to source-code vulnerability detection, but most evaluations still rely on random train-test splits that ignore time and overestimate real-world performance. In practice, detectors are deployed on evolving code bases and must recognise future vulnerabilities under temporal distribution shift. This paper investigates continual fine-tuning of a decoder-style language model (microsoft/phi-2 with LoRA) on a CVE-linked dataset spanning 2018-2024, organised into bi-monthly windows. We evaluate eight continual learning strategies, including window-only and cumulative training, replay-based baselines and regularisation-based variants. We propose Hybrid Class-Aware Selective Replay (Hybrid-CASR), a confidence-aware replay method for binary vulnerability classification that prioritises uncertain samples while maintaining a balanced ratio of VULNERABLE and FIXED functions in the replay buffer. On bi-monthly forward evaluation Hybrid-CASR achieves a Macro-F1 of 0.667, improving on the window-only baseline (0.651) by 0.016 with statistically significant gains (p=0.026) and stronger backward retention (IBR@1 of 0.741). Hybrid-CASR also reduces training time per window by about 17 percent compared to the baseline, whereas cumulative training delivers only a minor F1 increase (0.661) at a 15.9-fold computational cost. Overall, the results show that selective replay with class balancing offers a practical accuracy-efficiency trade-off for LLM-based temporal vulnerability detection under continuous temporal drift.
School of Computer Science, University of Nottingham, Nottingham, United Kingdom · School of Informatics and Computing, Northern Arizona University, Flagstaff, United States of America · School of Computer Science, University of Nottingham, Ningbo, China
Automated vulnerability detection is a fundamental task in software security, yet existing learning-based methods still struggle to capture the structural dependencies, domain-specific vulnerability knowledge, and complex program semantics required for accurate detection. Recent Large Language Models (LLMs) have shown strong code understanding ability, but directly prompting them with raw source code often leads to missed vulnerabilities or false alarms, especially when vulnerable and benign functions differ only in subtle semantic details. To address this, we propose VulTriage, a triple-path context augmentation framework for LLM-based vulnerability detection. VulTriage enhances the LLM input through three complementary paths: a Control Path that extracts and verbalizes AST, CFG, and DFG information to expose control and data dependencies; a Knowledge Path that retrieves relevant CWE-derived vulnerability patterns and examples through hybrid dense--sparse retrieval; and a Semantic Path that summarizes the functional behavior of the code before the final judgment. These contexts are integrated into a unified instruction to guide the LLM toward more reliable vulnerability reasoning. Experiments on the PrimeVul pair test set show that VulTriage achieves state-of-the-art performance, outperforming existing deep learning and LLM-based baselines on key pair-wise and classification metrics. Further ablation studies verify the effectiveness of each path, and additional experiments on the Kotlin dataset demonstrate the generalization ability of VulTriage under low-resource and class-imbalanced settings. Our code is available at https://github.com/vinsontang1/VulTriage
Wenxin Tang, Xiang Zhang, Junliang Liu +11
Tsinghua University · Henan University · Dalian Maritime University +8