Search papers, labs, and topics across Lattice.
This paper introduces Causal Context-based Agentic Reasoning (CLEAR), a multi-agent framework designed for detecting vulnerabilities in source code by leveraging a Vulnerability Causal Knowledge Graph (VCKG). By modeling the complex causal dependencies between execution flows, control conditions, and program states, CLEAR enables agents to collaboratively verify vulnerability hypotheses more effectively than existing methods. The results show a significant improvement in Pair-Correct (P-C) performance, with enhancements of 130.7% and 71.56% over state-of-the-art approaches for C/C++ and Java benchmarks, respectively.
CLEAR achieves a staggering 130.7% improvement in vulnerability detection by harnessing causal knowledge graphs to navigate complex dependencies in code.
Detecting source code vulnerabilities is increasingly difficult as modern security flaws are rooted in complex causal dependencies between execution flows, control conditions, and program states. Despite recent advances in Large Language Models (LLMs) and multi-agent frameworks, existing approaches primarily address superficial similarities between benign and vulnerable functions while failing to capture the complex causal dependencies inherent in security flaws. To address these limitations, we propose Causal Context-based Agentic Reasoning (CLEAR), a novel multi-agent vulnerability detection framework integrated with a causal knowledge graph. CLEAR systematically constructs a Vulnerability Causal Knowledge Graph (VCKG) that models the causal chains between entrypoints, preconditions, root causes, and fix intents across vulnerability instances. Leveraging this structured knowledge, four specialized agents, including the Collector, Claim, Critic, and Judge, collaboratively verify vulnerability hypotheses through retrieved causal contexts. Experimental results on C/C++ and Java vulnerability benchmarks demonstrate that CLEAR improves Pair-Correct (P-C) performance by 130.7% and 71.56% over state-of-the-art approaches, demonstrating the effectiveness of causal knowledge graph-guided reasoning for automated vulnerability detection.
