一句话：提出 ReAct-Vul，将 ReAct 范式与多智能体 LLM 结合，通过仓库级知识切片与推理-行动协同循环提升漏洞检测准确率。
针对仓库级漏洞检测中上下文感知不足与 LLM 推理过程依赖人工设计动作的问题，本文提出 ReAct-Vul 框架，将检测任务建模为推理与行动（ReAct）范式，并融入多智能体 LLM 的人类工作流。框架包含两个关键模块：一是仓库规模知识切片，涵盖过程内切片、过程间切片以及基于 ReAct 的感知组件，用于在仓库级提取与漏洞相关的上下文和知识；二是推理-行动协同驱动的检测模块，交替进行双视角漏洞分析（行动阶段）与检测-反思循环（推理阶段），显式考虑漏洞存在与不存在两种情况，生成推理解释并细化后续针对性动作。在真实 C/C++ 数据集 PrimeVul 和 SVEN 上的评估表明，ReAct-Vul 在准确率上分别超越最佳基线 8.7% 和 18.4%，且所提 ReAct 范式能将 SVEN 上不同模型的准确率提升 15.9%。
The exponential growth in software vulnerabilities has created an urgent demand for automated vulnerability detection solutions. Recent research has emphasized the importance of repository-level context for vulnerability detection and has leveraged large language models (LLMs) to address this challenge. Although these methods show state-of-the-art performance, they face the following challenges: (1) Insufficient perception of repository-level contextual information. Current approaches primarily rely on the given input itself or predefined knowledge bases. They cannot adequately account for inter-file dependencies, such as import relationships and class hierarchies, that may be critical to understanding specific vulnerabilities. (2) Relying on manually designed actions in the LLM reasoning process. Specifically, existing methods do not effectively integrate reasoning (i.e., predicting vulnerability existence by LLMs) with action (i.e., dynamically retrieving additional or reduced context by tool). This limitation can lead to factual hallucinations throughout the detection process, leading to limited performance. To address these challenges, we propose to model the repository-level vulnerability detection task from a Reasoning and Action (i.e., ReAct) paradigm and incorporate human workflows into multi agent-based LLMs, termed ReAct-Vul, which consists of two key modules: (1) a repository-scale knowledge slicing, which comprises an intra-procedural slicing process, an inter-procedural slicing process, and a ReAct-based perception component for extracting the vulnerability-related context and knowledge at the repository level. (2) a synergistic reasoning-action-driven detection module, which interleaves a dual-perspective vulnerability analysis (Action phase) and detection-reflection loop (Reasoning phase). This synergistic approach enables the framework to explicitly consider both vulnerability presence and absence, generate reasoning explanations and refine subsequent targeted actions for vulnerability detection. We evaluate ReAct-Vul on the real-world C/C++ dataset PrimeVul and SVEN to demonstrate its effectiveness in vulnerability detection. Specifically, ReAct-Vul outperforms the best baseline by 18.4% on SVEN and 8.7% on PrimeVul in terms of accuracy. Furthermore, we demonstrate that the proposed ReAct paradigm enhances the reasoning capabilities of different models, achieving a 15.9% improvement in the accuracy of SVEN.
@inproceedings{paperbot12382,
title = {Perception, Reasoning, and Action: A ReAct-Based Vulnerability Detection Framework with Repository-Level Reasoning},
author = {Xin-Cheng Wen and Hanyue Luo and Cuiyun Gao and Hao Zhu and Yang Xiao and Ge Li},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3837547}
}