PaperlayerView exact revision on arXiv

Source-linked AI summary

LLMs in Software Security: A Survey of Vulnerability Detection Techniques and Insights

Ze Sheng, Zhicheng Chen, Shuning Gu, Heqing Huang, Guofei Gu, Jeff Huang

arXiv:2502.07049v2cs.CRcs.AI

TL;DR

Software vulnerability detection faces limitations in traditional analysis, while LLM research lacks a systematic synthesis and realistic evaluation resources. This paper surveys LLM architectures, techniques, datasets, benchmarks, metrics, and challenges across the field. The survey finds significant potential and progress, but persistent dataset, complex-code, repository-level, robustness, and explainability challenges constrain practical application.

  • Problem

    Traditional analysis has high false-positive and efficiency limitations, while systematic evidence on LLM-based vulnerability detection and realistic repository-level datasets remains limited.

  • Method

    The paper systematically reviews LLM vulnerability-detection research across architectures, benchmarks, datasets, metrics, techniques, and future challenges.

  • Results

    LLMs show significant potential in code comprehension and vulnerability detection, with fine-tuning, prompt engineering, GPT-4, and Claude-3.5 associated with notable progress across benchmark datasets.

  • Takeaways & Limitations

    Future progress depends on better code-evolution adaptation, vulnerability reproduction and repair, high-quality datasets, robustness, and explainability.

  • Takeaways & Limitations

    The survey may miss relevant work because about 60% of research is published as arXiv preprints and terminology varies across searches.

Abstract

from arXiv · show

Large Language Models (LLMs) are emerging as transformative tools for software vulnerability detection, addressing critical challenges in the security domain. Traditional methods, such as static and dynamic analysis, often falter due to inefficiencies, high false positive rates, and the growing complexity of modern software systems. By leveraging their ability to analyze code structures, identify patterns, and generate repair suggestions, LLMs, exemplified by models like GPT, BERT, and CodeBERT, present a novel and scalable approach to mitigating vulnerabilities. This paper provides a detailed survey of LLMs in vulnerability detection. It examines key aspects, including model architectures, application methods, target languages, fine-tuning strategies, datasets, and evaluation metrics. We also analyze the scope of current research problems, highlighting the strengths and weaknesses of existing approaches. Further, we address challenges such as cross-language vulnerability detection, multimodal data integration, and repository-level analysis. Based on these findings, we propose solutions for issues like dataset scalability, model interpretability, and applications in low-resource scenarios. Our contributions are threefold: (1) a systematic review of how LLMs are applied in vulnerability detection; (2) an analysis of shared patterns and differences across studies, with a unified framework for understanding the field; and (3) a summary of key challenges and future research directions. This work provides valuable insights for advancing LLM-based vulnerability detection. We also maintain and regularly update latest selected paper on https://github.com/OwenSanzas/LLM-For-Vulnerability-Detection

1 INTRODUCTION

The survey motivates LLM-based vulnerability detection as a response to growing software-security risks and limitations in traditional analysis. It organizes recent research around architectures, evaluation resources, techniques, and unresolved challenges.

  • Approximately 70% of security vulnerabilities originate from defects in software development processes, while about 120,000 CVEs were reported over the past five years.The introduction also cites substantial cybersecurity complaints and losses from 2018–2023 and the 2024 CrowdStrike incident.
  • Traditional static and dynamic analysis suffer from high false-positive rates, low efficiency, and difficulty handling the growing variety of vulnerabilities.Static analysis examines code or bytecode, whereas dynamic analysis observes behavior during execution, including through fuzz testing.
  • LLM-based vulnerability detection has attracted attention because LLMs can support code analysis and has expanded through initiatives such as AIxCC.The paper positions this research trend as a potential transformation of vulnerability detection.
  • The survey examines effective LLM architectures, evaluation benchmarks and datasets, detection techniques, and challenges guiding future research.These four aspects form the paper’s structured analysis of strengths, weaknesses, and advancement opportunities.
  • Across more than 80 selected papers, including 58 highly related studies from 2019–2024, C, Java, and Solidity predominate, with implementation, prompt engineering, and semantic processing recurring.Multi-agent approaches are also widely used to decompose complex vulnerability-detection problems into manageable subproblems.
  • Major gaps include narrow function-level binary-classification datasets, limited repository-level coverage, insufficient context awareness, vulnerability-type imbalance, and dataset leakage.Repository-level analysis must address cross-file dependencies and longer call stacks, while logical vulnerabilities remain less explored than memory-related vulnerabilities.

2 BACKGROUND

The survey uses a keyword-driven, iterative review process focused specifically on LLM applications in vulnerability detection. It finds that existing datasets are concentrated at function and file level, especially for C/C++, while repository-level resources remain scarce.

  • 2.1 Paper Selection And Scope: The review searched major security conferences, journals, and extracted keywords including vulnerability detection, LLM, large language model, and AI.The selection process was refined through iterative searches conducted every three weeks.
  • 2.1 Paper Selection And Scope: Approximately 500–600 papers were screened over two months, yielding 58 highly relevant studies focused on LLM-based vulnerability detection.Work on traditional CNNs and RNNs, malware analysis, and network intrusion detection was excluded.
  • 2.1 Paper Selection And Scope: The survey primarily evaluates function-level and file-level datasets, with C/C++ dominating coverage and repository-level datasets significantly lacking.This dataset distribution limits representation of real-world development scenarios.
  • 2.1 Paper Selection And Scope: Existing repository-level scarcity challenges LLM generalization to vulnerabilities spanning multiple files and dependencies.The survey identifies this as a practical limitation of current evaluation resources.

2.3 Large Language Models (LLMs)

LLMs are large-scale language models enabled by the Transformer architecture and trained on vast corpora. Their scaling supports broad capabilities in general human tasks.

  • LLMs typically contain hundreds of billions of parameters trained on vast corpora.Their scale represents a major progression in the evolution of language models.
  • The Transformer architecture enables the unprecedented scaling capabilities associated with modern LLMs.
  • Large-scale training contributes to remarkable capabilities across general human tasks.

2.4 Vulnerability Detection Problem

Vulnerability detection is modeled primarily as binary classification, with related tasks extending to vulnerability-type classification and severity prediction. Standard vulnerability databases provide terminology and risk-assessment context for these tasks.

  • CWE, CVE, CVSS, and NVD record vulnerability definitions, identifiers, severity assessments, and related technical information.CWE emphasizes root causes, CVE catalogs individual vulnerabilities, CVSS scores risk, and NVD records vulnerability details and mitigations.
  • Vulnerability Detection: Binary vulnerability detection maps source code C_i to Y_i ∈ {0, 1}, where 1 denotes vulnerable code and 0 denotes non-vulnerable code.
  • Vulnerability Detection: The workflow extends detection with vulnerability classification and severity prediction as two related subproblems.
  • Vulnerability Classification: Multi-class classification identifies specific vulnerability types using names such as Buffer Overflow or standards such as CWE identifiers.
  • Vulnerability Severity Prediction: Severity prediction can use categorical classes such as low, medium, and high or numerical CVSS scores from 0 to 10.The additional severity information supports prioritizing remediation and allocating security resources.

3.1 Overview

LLM vulnerability-detection research spans several programming languages and increasingly favors large decoder-only models. However, datasets remain concentrated at function and file levels, motivating repository-level and complex-context research.

  • Target languages: Research mainly targets C/C++, Java, and Solidity, with language-specific priorities spanning memory safety, framework interactions, and smart-contract security.C/C++ studies emphasize memory-related vulnerabilities; Java studies address framework-specific vulnerabilities and component interactions; Solidity studies target smart-contract vulnerabilities.
  • Model trends: Large decoder-only models such as GPT and CodeLlama are the main choice in recent fine-tuning experiments.They appear in 65% of fine-tuning experiments, while GPT-4 reached 99% accuracy in one Solidity vulnerability-detection study.
  • Model trends: Prompt engineering, including Chain-of-Thought prompting, is used to improve reasoning for complex code vulnerability detection.The survey reports that Chain-of-Thought prompting is common for large models and enhances their reasoning abilities for complex code.
  • Datasets: Most datasets cover function-level and file-level vulnerabilities, leaving repository-level datasets underdeveloped for real-world scenarios.The survey identifies this repository-level gap as limiting the practical use of LLMs in vulnerability detection.
  • Future directions: Future work should improve cross-file and complex-context detection, code-semantic representation, and realistic repository-level datasets.The survey links these directions to improving the applicability and reliability of LLM-based vulnerability detection.

3.2 RQ1. What LLMs have been applied to vulnerability detection?

The survey organizes applied LLMs into encoder-only, encoder-decoder, and decoder-only architectures, then compares their usage across vulnerability-detection studies. Decoder-only models dominate reported usage, while encoder-based models remain important as baselines and for understanding-oriented tasks.

  • Architectural categories: The survey classifies LLMs into encoder-only, encoder-decoder, and decoder-only architectural groups.This taxonomy is used to structure the analysis of representative models and their capabilities and limitations.
  • Encoder-only models: Encoder-only models represent inputs as structured syntactic and semantic code representations without generating output sequences.Examples include CodeBERT and GraphCodeBERT.
  • Encoder-decoder models: Encoder-decoder models combine sequence understanding and generation for tasks such as translating, summarizing, or transforming code.Representative models include PLBART, T5, CodeT5, UniXcoder, and NatGen.
  • Usage across studies: Across 58 studies, 33 distinct LLMs were identified, with GPT-4 appearing most frequently in 29 instances and GPT-3.5 in 25.The survey also reports encoder-only models at 24.2% of total usage.
  • Usage across studies: Decoder-only architectures are widely adopted for detection, likely because they efficiently process and generate relevant code-analysis sequences.The survey notes that encoder-only and encoder-decoder architectures increasingly serve as comparison baselines.
  • Model selection: GPT models perform consistently well, while specialized models such as CodeBERT and CodeT5 support fine-tuned code-understanding and processing tasks.Combining general-purpose and specialized models is reported to leverage generalization and task-specific precision.

3.3 RQ2. What benchmarks, dataset and metrics have been designed to evaluate vulnerability detection?

The survey finds that vulnerability-detection research predominantly uses C/C++ and function- or file-level datasets, while evaluation combines classification, generation, and efficiency metrics. It also identifies language imbalance and scarce repository-level data as major limitations for realistic, generalizable assessment.

  • Vulnerability distribution: CVE distributions are concentrated in operating systems, followed by web browsers and development platforms, with memory-related vulnerabilities most prevalent.The survey links the prevalence of memory-corruption vulnerabilities to widely used memory-unsafe C/C++ languages.
  • Target languages: C/C++ accounts for 50% of studies, followed by Java at 21.1% and Solidity at 11.8%.The remaining 16.6% covers Python, PHP, Go, and other languages.
  • Dataset scope: Frequently used datasets span function-, file-, commit-, repository-, application-, and contract-level vulnerability detection tasks.Examples include BigVul and Devign, Juliet test suites, CVEfixes and Pan2023, CWE-Bench-Java, Ghera, and FELLMVP.
  • Dataset scope: Function-level datasets are common for fine-tuning and evaluation, but real-world vulnerabilities often involve multiple functions across files.File-level Juliet cases can include cross-file calls or global-variable access, challenging LLM detection across files.
  • Limitations and directions: Current datasets are dominated by C/C++ and lack repository-level coverage, limiting cross-language generalization and detection of complex multi-file vulnerabilities.The survey calls for diverse, large-scale datasets that simulate real-world scenarios.
  • Evaluation metrics: Evaluation uses classification metrics, generation metrics, and efficiency metrics, including accuracy, precision, recall, F1-Score, MCC, BLEU, ROUGE, and execution time.MCC is useful for imbalanced datasets, while BLEU and ROUGE assess generated vulnerability descriptions.

3.4 RQ3. What techniques are used in LLMs for vulnerability detection?

LLM-based vulnerability detection combines code preprocessing, prompt engineering, and fine-tuning to improve context use, reasoning, and detection performance. These techniques remain constrained by complex cross-file code, computational limits, and dataset quality.

  • Technique categories: LLM vulnerability detection techniques comprise code preprocessing, prompt engineering, and fine-tuning, with preprocessing targeting context utilization and semantic comprehension.The survey identifies AST, flow graphs, RAG, slicing, structured prompts, and full or parameter-efficient fine-tuning as recurring approaches.
  • Code Data Preprocessing: DFGs and CFGs supplement ASTs by representing interprocedural data and control flow, either in prompts or knowledge bases.Combining source code with these graphs is reported to improve vulnerability identification performance.
  • Code Data Preprocessing: 41.3% of studies employed graph representations, RAG, or code slicing to better use limited context windows.These methods show modest gains over direct prompting, but their effectiveness decreases significantly for complex, cross-file vulnerabilities.
  • Prompt Engineering Techniques: Hierarchical context representation organizes code from modules to statements, enabling analysis at multiple abstraction levels within context-length constraints.The approach prioritizes higher-level structures before detailed code segments.
  • Prompt Engineering Techniques: 100% of recent studies used chain-of-thought prompting for models above 10B parameters, whereas smaller models favored zero-shot or minimal few-shot prompts.The survey reports that extra reasoning steps and examples can produce irrelevant output for smaller models.
  • Fine-tuning: Generative fine-tuning produced a ROUGE score of 0.722 for CodeT5+, compared with 0.425 for DeepSeek-Coder 6.7B.This comparison concerns structured generation tasks such as vulnerability descriptions or vulnerable-line identification.
  • Fine-tuning: Parameter-efficient fine-tuning and larger models achieve strong detection results, while discriminative strategies require datasets with at least 10K samples.The survey reports base GPT-4 and CodeLlama F1 scores near 0.9 and identifies computational limits and dataset quality as continuing challenges.

3.5 RQ4. What are the challenges that LLMs are facing in detecting vulnerabilities and potential directions to solve them?

The survey identifies limited research scope, dataset quality, vulnerability complexity, and model robustness as major barriers to practical LLM-based vulnerability detection. Proposed directions expand analysis toward repositories, improve datasets and semantic representations, and strengthen reproduction, robustness, and explainability.

  • Research scope: Approximately 40 studies, or 83%, analyze isolated code snippets, while real-world repository and broader-context detection remains difficult.The survey links this scope to controlled evaluation that overlooks practical complexities.
  • Code evolution: Full-scale detection spans multiple files, whereas incremental detection targets new commits; current LLMs struggle with broader contexts and often assist static analysis or fuzzing.Existing commit-level methods combine commits with static-analysis results.
  • Vulnerability workflow: Vulnerability reproduction can reduce false positives by generating triggering inputs that provide evidence of a vulnerability’s existence.The survey frames reproduction as a way to validate detections and make reports more actionable.
  • Specialized detection: Detection performance varies by vulnerability type, with high accuracy for CWE-787 and poor performance for CWE-862.The survey identifies specialized detection mechanisms as a response to this variation.
  • Vulnerability complexity: More than 95% of studies report that external dependencies, multiple calls, global variables, and complex states hinder vulnerability detection.The survey proposes reading more repository code or using abstract representations to simplify code semantics.
  • Vulnerability complexity: LLMs perform well on isolated synthetic functions but may reach incorrect conclusions when callers provide protection or larger projects require additional context.Extra documents and specifications may be needed when online corpora are sparse.
  • Model robustness: LLMs remain vulnerable to data perturbations and adversarial attacks, and their vulnerability explanations can vary randomly across runs.The survey calls for improved robustness, consistency, reliability, and explainability.
  • Dataset quality: Incorrect labels, data leakage, inadequate version control, and missing deduplication can inflate metrics and undermine real-world dataset validity.Recommended datasets include verified samples, detailed repository annotations, targeted scopes, synthetic data, and scalable augmentation.

4 LIMITATIONS

The survey’s comprehensiveness may be constrained by the field’s emerging publication landscape and terminology variation. Its systematic search procedure was intended to mitigate these risks.

  • Scope limitations: Approximately 60% of LLM vulnerability-detection research appears as arXiv preprints, reflecting the field’s emerging nature.Terminology variation around “LLM” and “vulnerability detection” may also cause omissions in initial searches.
  • Mitigation: The authors searched established conferences and journals and extracted core information to mitigate risks from preprints and terminology variation.This describes the survey’s stated mitigation procedure rather than eliminating the underlying limitations.

5 CONCLUSION

The paper systematically reviews LLM applications, evaluation resources, technical approaches, and challenges in vulnerability detection. It finds promising progress alongside persistent dataset, code-complexity, repository-level, randomness, and explainability limitations, and proposes targeted research directions.

  • Contributions: The survey analyzes LLM applications, benchmarks and datasets, technical approaches, and challenges through an extensive literature review.Its framework addresses four research questions covering the current landscape and future directions.
  • Findings: Recent large-scale models such as GPT-4 and Claude-3.5 have made notable progress in vulnerability-detection tasks.The survey nevertheless reports practical limitations in complex code and repository-level detection.
  • Future directions: The proposed directions target code-evolution adaptation, vulnerability reproduction and repair, high-quality datasets, robustness, and explainability.These directions are presented as priorities for advancing LLM-based vulnerability detection.
  • Future directions: Future review work will add vulnerability localization, assessment, and patching tasks.These tasks are identified as planned extensions of the review.
Loading 2502.07049v2…