mlsanityData to 7 Oct 2026

An Empirical Evaluation of LLM-Based Approaches for Code Vulnerability Detection: RAG, SFT, and Dual-Agent Systems

arXiv 2601.00254 ↗First posted 1 Jan 2026cs.SE cs.AIcited by 0

On the map: Retrieval-augmented generation → Privacy and security of RAG

also in 1 more
Abstract (arXiv)

The rapid advancement of Large Language Models (LLMs) presents new opportunities for automated software vulnerability detection, a crucial task in securing modern codebases. This paper presents a comparative study on the effectiveness of LLM-based techniques for detecting software vulnerabilities. The study evaluates three approaches, Retrieval-Augmented Generation (RAG), Supervised Fine-Tuning (SFT), and a Dual-Agent LLM framework, against a baseline LLM model. A curated dataset was compiled from Big-Vul and real-world code repositories from GitHub, focusing on five critical Common Weakness Enumeration (CWE) categories: CWE-119, CWE-399, CWE-264, CWE-20, and CWE-200. Our RAG approach, which integrated external domain knowledge from the internet and the MITRE CWE database, achieved the highest overall accuracy (0.86) and F1 score (0.85), highlighting the value of contextual augmentation. Our SFT approach, implemented using parameter-efficient QLoRA adapters, also demonstrated strong performance. Our Dual-Agent system, an architecture in which a secondary agent audits and refines the output of the first, showed promise in improving reasoning transparency and error mitigation, with reduced resource overhead. These results emphasize that incorporating a domain expertise mechanism significantly strengthens the practical applicability of LLMs in real-world vulnerability detection tasks.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 5 of its 13 references that are in the map. First posted on arXiv 1 Jan 2026.

Builds on

5 of 13 references.

References · 5

  1. 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,084
  2. 2024Vul-RAG: Enhancing LLM-based Vulnerability Detection via Knowledge-level RAGcited by 67
  3. 2024Finetuning Large Language Models for Vulnerability Detectioncited by 39
  4. 2024Security Vulnerability Detection with Multitask Self-Instructed Fine-Tuning of Large Language Modelscited by 14
  5. 2024VulScribeR: Exploring RAG-based Vulnerability Augmentation with LLMscited by 7

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Revisiting Vul-RAG: Reproducibility and Replicability of RAG-based Vulnerability Detection with Open-Weight Models
  2. 2025Benchmarking LLMs and LLM-based Agents in Practical Vulnerability Detection for Code Repositories
  3. 2025From LLMs to Agents: A Comparative Evaluation of LLMs and LLM-based Agents in Security Patch Detection
  4. 2026VulTriage: Triple-Path Context Augmentation for LLM-Based Vulnerability Detection
  5. 2024Towards Explainable Vulnerability Detection with Large Language Models
  6. 2024Software Vulnerability and Functionality Assessment using LLMs
  7. 2025A Systematic Study of Code Obfuscation Against LLM-based Vulnerability Detection
  8. 2026Do Fine-Tuned LLMs Understand Vulnerabilities? An Investigation into the Semantic Trap