Revisiting Vul-RAG: Reproducibility and Replicability of RAG-based Vulnerability Detection with Open-Weight Models
cs.SE, cs.AI
Submitted: 2026-06-03
Updated: 2026-06-03
Comments: Accepted at AI&CCPS 2026 workshop, co-located with the 21st International Conference on Availability, Reliability and Security (ARES 2026). This is the authors' preprint version
DOI: 10.1007/978-3-032-35576-8_5
Code: https://github.com/hs-esslingen-it-security/revisiting-Vul-RAG
License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
Terminology
Sources
- Reflections on the Reproducibility of Commercial LLM Performance in Empirical Software Engineering Studies
- DeepSeek-Coder-V2: Breaking the Barrier of Closed-Source Models in Code Intelligence
- Qwen2.5-Coder Technical Report
- QuiLL: An LLM-Based Vulnerability Assessment Framework for the Wild
- LLM4Vuln: A Unified Evaluation Framework for Decoupling and Enhancing LLMs' Vulnerability Reasoning
- VulEval: Towards Repository-Level Evaluation of Software Vulnerability Detection
- MulVul: Retrieval-augmented Multi-Agent Code Vulnerability Detection via Cross-Model Prompt Evolution
- Qwen3 Technical Report
- VulInstruct: Teaching LLMs Root-Cause Reasoning for Vulnerability Detection via Security Specifications
Related papers
- Falsification-Based Verification of LLM-Generated Optimization Models: Sound Test Batteries and Their Detection Limits
- GitSkills: A Dataset of Agent Skills on GitHub
- SABER: Benchmarking Operational Safety of LLM Coding Agents in Stateful Project Workspaces
- PackMonitor: Enabling Zero Package Hallucinations Through Decoding-Time Monitoring
- IntentCoding: Amplifying User Intent in Code Generation
- Incentives and Outcomes in Bug Bounties