VulnSAGE checks the code evidence behind security warnings

A security warning can be wrong, but dismissing a real defect can leave a program vulnerable. The needed evidence may lie outside the reported line, in a caller’s values or a helper’s effects.

How can reviewers assess a warning using that wider project context while checking what the model’s interpretation relies on?

VulnSAGE retrieves report-specific code context and checks the code relationships cited by an LLM before those interpretations can support a verdict.

Across four labeled sets, VulnSAGE rejected 89 of 97 false alarms and retained 85 of 90 real defects. It decided at least 96% of reports in each set, showing that its retrieved context and checked code relationships often supported a verdict on these reports.

To examine the system’s components, the authors removed report-centered pre-slicing or bypassed structural admission on two sets. Both changes lowered accuracy, linking the context retrieval and relationship checks to fewer adjudication errors in those comparisons.

The ablations cover only two labeled sets and omit runtime reproduction. Structural checks can confirm cited code relationships, but they cannot ensure that the model’s semantic interpretation is correct.