Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces a framework for cross-language software vulnerability analysis that integrates LLM-driven reasoning with execution-based validation to ensure trustworthy agentic AI. The framework uses a Universal Abstract Syntax Tree (uAST) to normalize Java, Python, and C++ code, combined with a hybrid GraphSAGE and Qwen2.5-Coder-1.5B embedding fusion. Results demonstrate high intra-language detection accuracy (89.84-92.02%) and zero-shot cross-language F1 (74.43-80.12%), with ablations highlighting the importance of both the uAST and execution-based validation.
LLMs can autonomously fix code vulnerabilities across languages with impressive accuracy, but only if they "verify before they fix" by grounding their reasoning in execution.
Learned classifiers deployed in agentic pipelines face a fundamental reliability problem: predictions are probabilistic inferences, not verified conclusions, and acting on them without grounding in observable evidence leads to compounding failures across downstream stages. Software vulnerability analysis makes this cost concrete and measurable. We address this through a unified cross-language vulnerability lifecycle framework built around three LLM-driven reasoning stages-hybrid structural-semantic detection, execution-grounded agentic validation, and validation-aware iterative repair-governed by a strict invariant: no repair action is taken without execution-based confirmation of exploitability. Cross-language generalization is achieved via a Universal Abstract Syntax Tree (uAST) normalizing Java, Python, and C++ into a shared structural schema, combined with a hybrid fusion of GraphSAGE and Qwen2.5-Coder-1.5B embeddings through learned two-way gating, whose per-sample weights provide intrinsic explainability at no additional cost. The framework achieves 89.84-92.02% intra-language detection accuracy and 74.43-80.12% zero-shot cross-language F1, resolving 69.74% of vulnerabilities end-to-end at a 12.27% total failure rate. Ablations establish necessity: removing uAST degrades cross-language F1 by 23.42%, while disabling validation increases unnecessary repairs by 131.7%. These results demonstrate that execution-grounded closed-loop reasoning is a principled and practically deployable mechanism for trustworthy LLM-driven agentic AI.