RAVEN: Retrieval-Augmented Vulnerability Exploration Network for Memory Corruption Analysis in User Code and Binary Programs
On the map: Retrieval-augmented generation → Privacy and security of RAG
Abstract (arXiv)
Large Language Models (LLMs) have demonstrated remarkable capabilities across various cybersecurity tasks, including vulnerability classification, detection, and patching. However, their potential in automated vulnerability report documentation and analysis remains underexplored. We present RAVEN (Retrieval Augmented Vulnerability Exploration Network), a framework leveraging LLM agents and Retrieval Augmented Generation (RAG) to synthesize comprehensive vulnerability analysis reports. Given vulnerable source code, RAVEN generates reports following the Google Project Zero Root Cause Analysis template. The framework uses four modules: an Explorer agent for vulnerability identification, a RAG engine retrieving relevant knowledge from curated databases including Google Project Zero reports and CWE entries, an Analyst agent for impact and exploitation assessment, and a Reporter agent for structured report generation. To ensure quality, RAVEN includes a task specific LLM Judge evaluating reports across structural integrity, ground truth alignment, code reasoning quality, and remediation quality. We evaluate RAVEN on 105 vulnerable code samples covering 15 CWE types from the NIST-SARD dataset. Results show an average quality score of 54.21%, supporting the effectiveness of our approach for automated vulnerability documentation.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 22 of its 36 references that are in the map. First posted on arXiv 20 Apr 2026.
Builds on
22 of 36 references.
References · 22
- 2023Code Llama: Open Foundation Models for Codecited by 2,139
- 2020CodeBERT: A Pre-Trained Model for Programming and Natural Languagescited by 1,310
- 2020GraphCodeBERT: Pre-training Code Representations with Data Flowcited by 609
- 2024From Generation to Judgment: Opportunities and Challenges of LLM-as-a-judgecited by 494
- 2024Is LLM-as-a-Judge Robust? Investigating Universal Adversarial Attacks on Zero-shot LLM Assessmentcited by 126
- 2025Red-Teaming LLM Multi-Agent Systems via Communication Attackscited by 122
- 2021Examining Zero-Shot Vulnerability Repair with Large Language Modelscited by 105
- 2024IRIS: LLM-Assisted Static Analysis for Detecting Security Vulnerabilitiescited by 103
- 2024PentestAgent: Incorporating LLM Agents to Automated Penetration Testingcited by 47
- 2023Prompting Is All You Need: Automated Android Bug Replay with Large Language Modelscited by 40
- 2024An Empirical Evaluation of LLMs for Solving Offensive Security Challengescited by 35
- 2024Survey of different Large Language Model Architectures: Trends, Benchmarks, and Challengescited by 32
10 more
- 2025Benchmarking LLMs and LLM-based Agents in Practical Vulnerability Detection for Code Repositoriescited by 31
- 2024A Case Study of LLM for Automated Vulnerability Repair: Assessing Impact of Reasoning and Patch Validation Feedbackcited by 22
- 2025D-CIPHER: Dynamic Collaborative Intelligent Multi-Agent System with Planner and Heterogeneous Executors for Offensive Securitycited by 20
- 2025CRAKEN: Cybersecurity LLM Agent with Knowledge-Based Executioncited by 14
- 2026Falcon-H1R: Pushing the Reasoning Frontiers with a Hybrid Model for Efficient Test-Time Scalingcited by 13
- 2025Towards Effective Offensive Security LLM Agents: Hyperparameter Tuning, LLM as a Judge, and a Lightweight CTF Benchmarkcited by 12
- 2025SV-TrustEval-C: Evaluating Structure and Semantic Reasoning in Large Language Models for Source Code Vulnerability Analysiscited by 8
- 2025TrojanLoC: LLM-based Framework for RTL Trojan Localizationcited by 6
- 2025From Trace to Line: LLM Agent for Real-World OSS Vulnerability Localizationcited by 4
- 2025SecureBERT 2.0: Advanced Language Model for Cybersecurity Intelligencecited by 2
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2026RAVEN: Agentic RAG for Automated Vulnerability Repair
- 2025Automated Vulnerability Validation and Verification: A Large Language Model Approach
- 2026VulnGym: Benchmarking Coding Agents for Repository-Level Vulnerability Detection
- 2026An Empirical Evaluation of LLM-Based Approaches for Code Vulnerability Detection: RAG, SFT, and Dual-Agent Systems
- 2026Revisiting Vul-RAG: Reproducibility and Replicability of RAG-based Vulnerability Detection with Open-Weight Models
- 2026MulVul: Retrieval-augmented Multi-Agent Code Vulnerability Detection via Cross-Model Prompt Evolution
- 2026AXE: Grey-Box Exploitability Confirmation for Localized Vulnerability Reports
- 2026FuzzingBrain V2: A Multi-Agent LLM System for Automated Vulnerability Discovery and Reproduction