mlsanityData to 14 Oct 2026

A Systematic Literature Review on Detecting Software Vulnerabilities with Large Language Models

arXiv 2507.22659 ↗First posted 30 Jul 2025cs.SE cs.AIcited by 8

Not on the map. Why?

Abstract (arXiv)

The increasing adoption of Large Language Models (LLMs) in software engineering has sparked interest in their use for software vulnerability detection. However, the rapid development of this field has resulted in a fragmented research landscape, with diverse studies that are difficult to compare due to differences in, e.g., system designs and dataset usage. This fragmentation makes it difficult to obtain a clear overview of the state-of-the-art or compare and categorize studies meaningfully. In this work, we present a comprehensive systematic literature review (SLR) of LLM-based software vulnerability detection. We analyze 263 studies published between January 2020 and November 2025, categorizing them by task formulation, input representation, system architecture, and techniques. Further, we analyze the datasets used, including their characteristics, vulnerability coverage, and diversity. We present a fine-grained taxonomy of vulnerability detection approaches, identify key limitations, and outline actionable future research opportunities. By providing a structured overview of the field, this review improves transparency and serves as a practical guide for researchers and practitioners aiming to conduct more comparable and reproducible research. We publicly release all artifacts and maintain a living repository of LLM-based software vulnerability detection studies at https://github.com/hs-esslingen-it-security/Awesome-LLM4SVD.

Key facts. Cited by 8 papers in the map (data through 14 Oct 2026). Builds on 52 of its 106 references that are in the map. First posted on arXiv 30 Jul 2025.

Builds on

52 of 106 references.

References · 52

  1. 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,599
  2. 2020CodeBERT: A Pre-Trained Model for Programming and Natural Languagescited by 1,310
  3. 2021Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributionscited by 431
  4. 2023Large Language Models for Software Engineering: A Systematic Literature Reviewcited by 399
  5. 2021Unified Pre-training for Program Understanding and Generationcited by 366
  6. 2022UniXcoder: Unified Cross-Modal Pre-training for Code Representationcited by 361
  7. 2017A Survey of Machine Learning for Big Code and Naturalnesscited by 221
  8. 2023Large Language Models for Code: Security Hardening and Adversarial Testingcited by 155
  9. 2023DiverseVul: A New Vulnerable Source Code Dataset for Deep Learning Based Vulnerability Detectioncited by 102
  10. 2021CVEfixes: Automated Collection of Vulnerabilities and Their Fixes from Open-Source Softwarecited by 91
  11. 2024Large Language Models for Cyber Security: A Systematic Literature Reviewcited by 68
  12. 2025LLMs in Software Security: A Survey of Vulnerability Detection Techniques and Insightscited by 47
38 more
  1. 2024Large Language Model for Vulnerability Detection: Emerging Results and Future Directionscited by 45
  2. 2024Large Language Model for Vulnerability Detection and Repair: Literature Review and the Road Aheadcited by 42
  3. 2022Transformer-Based Language Models for Software Vulnerability Detectioncited by 39
  4. 2023Security Weaknesses of Copilot-Generated Code in GitHub Projects: An Empirical Studycited by 38
  5. 2024ReposVul: A Repository-Level High-Quality Vulnerability Datasetcited by 36
  6. 2022LineVD: Statement-level Vulnerability Detection using Graph Neural Networkscited by 35
  7. 2023The FormAI Dataset: Generative AI in Software Security Through the Lens of Formal Verificationcited by 34
  8. 2025Benchmarking LLMs and LLM-based Agents in Practical Vulnerability Detection for Code Repositoriescited by 31
  9. 2024Generalization-Enhanced Code Vulnerability Detection via Multi-Task Instruction Fine-Tuningcited by 30
  10. 2024Top Score on the Wrong Exam: On Benchmarking in Machine Learning for Vulnerability Detectioncited by 28
  11. 2023TRACED: Execution-aware Pre-training for Source Codecited by 27
  12. 2024MegaVul: A C/C++ Vulnerability Dataset with Comprehensive Code Representationcited by 27
  13. 2023Greening Large Language Models of Codecited by 19
  14. 2022VUDENC: Vulnerability Detection with Deep Learning on a Natural Codebase for Pythoncited by 17
  15. 2023AIBugHunter: A Practical Tool for Predicting, Classifying and Repairing Software Vulnerabilitiescited by 17
  16. 2024Pre-training by Predicting Program Dependencies for Vulnerability Analysis Taskscited by 17
  17. 2024SCALE: Constructing Structured Natural Language Comment Trees for Software Vulnerability Detectioncited by 17
  18. 2024DLAP: A Deep Learning Augmented Large Language Model Prompting Framework for Software Vulnerability Detectioncited by 13
  19. 2023Distinguishing Look-Alike Innocent and Vulnerable Code by Subtle Semantic Representation Learning and Explanationcited by 11
  20. 2024Software Vulnerability and Functionality Assessment using LLMscited by 11
  21. 2024Vul-LMGNNs: Fusing language models and online-distilled graph neural networks for code vulnerability detectioncited by 11
  22. 2023Towards Causal Deep Learning for Vulnerability Detectioncited by 9
  23. 2024Software Vulnerability Prediction in Low-Resource Languages: An Empirical Study of CodeBERT and ChatGPTcited by 9
  24. 2024How Well Do Large Language Models Serve as End-to-End Secure Code Agents for Python?cited by 7
  25. 2024Beyond Static Pattern Matching? Rethinking Automatic Cryptographic API Misuse Detection in the Era of LLMscited by 6
  26. 2024Helping LLMs Improve Code Generation Using Feedback from Testing and Static Analysiscited by 6
  27. 2025Context-Enhanced Vulnerability Detection Based on Large Language Modelcited by 6
  28. 2023The EarlyBIRD Catches the Bug: On Exploiting Early Layers of Encoder Models for More Efficient Code Classificationcited by 5
  29. 2025Large Language Models for In-File Vulnerability Localization Can Be "Lost in the End"cited by 5
  30. 2023XGV-BERT: Leveraging Contextualized Language Model and Graph Neural Network for Efficient Software Vulnerability Detectioncited by 4
  31. 2024AI for DevSecOps: A Landscape and Future Opportunitiescited by 4
  32. 2024Line-level Semantic Structure Learning for Code Vulnerability Detectioncited by 4
  33. 2024Coding-PTMs: How to Find Optimal Code Pre-trained Models for Code Embedding in Vulnerability Detection?cited by 4
  34. 2024DFEPT: Data Flow Embedding for Enhancing Pre-Trained Model Based Vulnerability Detectioncited by 4
  35. 2025One-for-All Does Not Work! Enhancing Vulnerability Detection by Mixture-of-Experts (MoE)cited by 4
  36. 2025LPASS: Linear Probes as Stepping Stones for vulnerability detection using compressed LLMscited by 4
  37. 2024RealVul: Can We Detect Vulnerabilities in Web Applications with LLM?cited by 3
  38. 2024Bridge and Hint: Extending Pre-trained Language Models for Long-Range Codecited by 2

50 most cited of 52 All 52 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 3; 2026: 5.

8 papers.

  1. 2025Large Language Models for Security Operations Centers: A Comprehensive Surveycited by 9
  2. 2025VulInstruct: Teaching LLMs Root-Cause Reasoning for Vulnerability Detection via Security Specificationscited by 4
  3. 2025Data and Context Matter: Towards Generalizing AI-based Software Vulnerability Detectioncited by 3
  4. 2026DREA: Decoupled Reasoning and Exploration Agents for Repository-Level Vulnerability Detectioncited by 3
  5. 2026Revisiting Vul-RAG: Reproducibility and Replicability of RAG-based Vulnerability Detection with Open-Weight Modelscited by 2
  6. 2026When Passing Tests Hides Vulnerabilities: An Empirical Study of Silent Failures in Agentic Systemscited by 1
  7. 2026LLMs + Security = Troublecited by 0
  8. 2026Retrieve, Reproduce, Reveal: Dissecting Retrieval-Augmented Software Vulnerability Detectioncited by 0