一句话：提出 GraphLedger，用图压缩保留依赖结构并借假设账本验证 LLM 漏洞假设，提升仓库级检测可靠性。
仓库级漏洞检测需要跨文件、跨过程并沿长依赖链推理，这对主流方法均构成挑战：静态分析容易过近似并产生大量误报，LLM 方法则受限于大仓库上下文，可能给出看似合理但无证据支撑的结论。本文提出 GraphLedger，将自适应假设佐证压缩（AACC）与假设账本相结合。AACC 在压缩仓库上下文的同时保留与漏洞相关的依赖结构；LLM 在压缩上下文上提出显式漏洞假设，账本则用仓库证据验证假设前提，输出 Verified、Rejected 或 Inconclusive，使推理更可审计。方法面向污点式 source–sink 漏洞假设及有界过程间证据。评估在 CWE-Bench-Java 上进行跨方法受控实验，并在 CVEfixes 上做系统内组件分析，取得 0.77 精确率、0.76 召回率与 0.76 F1，并将误发现率从 0.41 降至 0.23。
Repository-level vulnerability detection requires reasoning across files, procedures, and long-range dependency chains. This is difficult for both dominant families of methods: static analysis often over-approximates and produces many false positives, while LLM-based approaches struggle with large repository context and may generate plausible but unsupported claims. We present GraphLedger, a framework that combines Adaptive Assumption-Corroborating Compression (AACC) with an Assumption Ledger for structured hypothesis verification. AACC reduces repository context while preserving vulnerability-relevant dependency structure. The LLM then proposes explicit vulnerability hypotheses over the compressed context, and the ledger validates their assumptions against repository evidence, producing Verified, Rejected, or Inconclusive outcomes. This makes repository-scale reasoning more auditable and less prone to unsupported conclusions. GraphLedger targets taint-style, source–sink vulnerability hypotheses with bounded inter-procedural evidence, rather than arbitrary vulnerability classes. We conduct a controlled cross-method evaluation on CWE-Bench-Java and a complementary within-system component analysis on CVEfixes. On CWE-Bench-Java, AACC achieves 0.71 token reduction while retaining 0.90 of dependency edges and 0.88 of taint paths. On a documented, repository-disjoint 100-repository CWE-Bench-Java evaluation partition, GraphLedger achieves 0.77 precision, 0.76 recall, and 0.76 F1, and reduces false discovery rate from 0.41 to 0.23 relative to VulAgent under a controlled shared-backend evaluation. These results show that combining structure-aware compression with assumption validation improves the reliability and transparency of repository-level vulnerability detection.
@inproceedings{paperbot12224,
title = {GraphLedger: Repository-Level Vulnerability Detection via Graph-Based Compression and Assumption Validation},
author = {Thi-Hong-Cuc Le and Hoang-Quoc-Bao Hua and Xuan-Bach Le},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3834420}
}