# VulWeaver: Weaving Broken Semantics for Grounded Vulnerability Detection

arXiv: https://arxiv.org/abs/2604.10767 · HTML: https://mlsanity.com/paper/2604.10767/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 12 Apr 2026.

## Built on by (most cited first, 1 of 1)

- [ALIBI: Adaptive Agentic Attacks on LLM-Based Vulnerability Detectors via Adversarial Code Comments](https://mlsanity.com/paper/2607.24964/) (2026)

## Abstract (arXiv)

Detecting vulnerabilities in source code remains critical yet challenging, as conventional static analysis tools construct inaccurate program representations, while existing LLM-based approaches often miss essential vulnerability context and lack grounded reasoning. In this paper, we introduce VulWeaver, a novel LLM-based approach that weaves broken program semantics into accurate representations and extracts holistic vulnerability context for grounded vulnerability detection. VulWeaver first constructs an enhanced unified dependency graph (UDG) by integrating deterministic rules with LLM-based semantic inference to address static analysis inaccuracies. It then extracts holistic vulnerability context by combining explicit contexts from program slicing with implicit contexts, including usage, definition, and declaration information. Finally, VulWeaver employs meta-prompting with vulnerability type specific expert guidelines to steer LLMs through systematic reasoning, aggregated via majority voting for robustness. Extensive experiments on PrimeVul4J dataset show that VulWeaver achieves a precision of 0.82, recall of 0.71, and F1-score of 0.76, outperforming state-of-the-art learning-based, LLM-based, and agent-based baselines by 25%, 17%, and 21% in F1-score, respectively. Notably, VulWeaver attains a VP-S score of 0.58, 164% higher than the best baseline, confirming its strong discriminative power