Search papers, labs, and topics across Lattice.
This paper explores the use of Behavior Trees (BTs) as a compact intermediate representation for vulnerability detection in Java code, comparing their effectiveness against traditional Abstract Syntax Trees (ASTs) and raw source code. The study reveals that BTs enhance recall on shorter code samples and improve overall performance on longer samples while fitting within the context limits of a quantized local LLM. Ultimately, the findings indicate that BTs offer a promising alternative for structured representation in LLM-based vulnerability detection, particularly when token count is a constraint.
Behavior Trees can significantly boost vulnerability detection recall in compact formats, outperforming traditional ASTs in both efficiency and effectiveness.
Large Language Models (LLMs) are increasingly used for software vulnerability detection, but their performance depends on how source code is represented in the input. Most prompting approaches use source code in its original form, while some works propose the use of structured representations. Abstract Syntax Trees (ASTs) are one of the most popular approaches, but AST verbosity increases input size relative to source code, making them hard to fit within some LLMs context windows. This paper investigates Behavior Trees (BTs) as an alternative intermediate representation for LLM-based vulnerability detection. BTs encode control flow, conditions, and executable actions more compactly than ASTs, making them a natural candidate when token count is a constraint. First, we propose a preprocessing stage that parses Java source code into ASTs and then converts them into BT representations. We then compare vulnerability detection performance across 460 Java samples from the Juliet Java test suite, using three input representations: raw source code, AST, and BT. All experiments use a single quantized local LLM, Mistral Small 3.2 24B (Q4_K_M). Our results show that using BT representations improves recall on short code samples, while raw source code achieves higher precision. On longer samples, BTs improve overall performance over the original representation and fit within the context window, whereas many ASTs exceed the context limit. These findings suggest that BTs can provide a compact and useful structured representation for vulnerability detection with quantized, locally deployable LLMs.
