一句话：提出模拟法庭式多智能体框架VulTrial，用角色分工与指令微调显著提升LLM漏洞检测与解释能力，并发现多个零日漏洞。
源码漏洞检测十分关键，但良性函数与漏洞函数往往高度相似，导致检测困难。本文提出VulTrial，一种受法庭审判启发的多智能体框架，用于识别漏洞代码并生成解释。该框架包含四个角色专用智能体：安全研究员、代码作者、主持人和评审委员会，并以GPT-4o作为基础LLM。实验表明，VulTrial的检测效果几乎达到此前最佳基线的两倍；使用少量数据进行角色专用指令微调可进一步显著提升效果。作者在多种LLM上验证了框架有效性，包括可本地部署的开源模型LLaMA-3.1-8B，并显示其生成的解释质量高，且能够在真实环境中发现多个已确认的零日漏洞。
Detecting vulnerabilities in source code remains a critical yet challenging task, especially when benign and vulnerable functions share significant similarities. In this work, we introduce VulTrial, a courtroom-inspired multi-agent framework designed to identify vulnerable code and to provide explanations. It employs four role-specific agents, which are security researcher, code author, moderator, and review board. Using GPT-4o as the base LLM, VulTrial almost doubles the efficacy of prior best-performing baselines. Additionally, we show that role-specific instruction tuning with small quantities of data significantly further boosts VulTrial's efficacy. Our extensive experiments demonstrate the efficacy of VulTrial across different LLMs, including an open-source, in-house-deployable model (LLaMA-3.1-8B), as well as the high quality of its generated explanations and its ability to uncover multiple confirmed zero-day vulnerabilities in the wild.
@inproceedings{paperbot11921,
title = {Let the Trial Begin: A Mock-Court Approach to Vulnerability Detection using LLM-Based Agents},
author = {Ratnadira Widyasari and Martin Weyssow and Ivana Clairine Irsan and Han Wei Ang and Frank Liauw and Eng Lieh Ouh and Lwin Khin Shar and Hong Jin Kang and David Lo},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3773256}
}