Search papers, labs, and topics across Lattice.
This study investigates whether the hidden activations of large language models (LLMs) contain signals indicative of code vulnerabilities when processing C/C++ code. By extracting last prefill token activations from four different LLMs and training multi-layer perceptron (MLP) probes, the authors find that these probes can achieve a competitive average F1 score of 41.7% on various function-level benchmarks. Notably, the best-performing probe matches the state-of-the-art for fine-tuned classifiers on one benchmark, suggesting that LLMs may inherently encode vulnerability information that can be leveraged for improved security screening.
LLMs may inherently encode vulnerability signals in their activations, enabling lightweight, model-native vulnerability detection that rivals traditional methods.
LLM-based code generation is now embedded in mission-critical pipelines, but defenses against vulnerable output remain post-hoc -- static analyzers, fine-tuned classifiers, or an LLM judge that screen completed code, ignoring the generating model's own internal state. We test a narrower, directly measurable question: when an LLM reads a piece of C/C++ code as context, do its hidden activations already carry a signal about that code's vulnerability status? We extract last prefill token activations from four LLMs (Granite-4.1-8B, Qwen3.5-9B, Qwen3.6-27B, Gemma-4-12B) across three model families and train MLP probes on these activations. We evaluate them on four function-level C/C++ benchmarks (Devign, Big-Vul, Draper VDISC, PrimeVul). Our probes achieve 41.7\% average F1 using 13.4--16.0M-parameter probes -- under 0.2\% of base-model size. On Devign, the best probe (Qwen3.5-9B, 68.8\% F1) matches the published fine-tuned-classifier SOTA (67.9\%) despite reading only a frozen, general-purpose LLM's activations; on the harder, more imbalanced benchmarks (Big-Vul, Draper VDISC, PrimeVul) probes trail SOTA substantially. This is early evidence that a coding LLM's own representation of arbitrary code is informative about that code's vulnerability status, motivating further work toward lightweight, model-native vulnerability screening.
