CLEAR: Causal Context-Based Agentic Reasoning for Vulnerability Detection

2026-08-04

AI Summary

Existing vulnerability detection methods struggle to model the deep causal dependencies among execution flows, control conditions, and program states inherent in modern vulnerabilities, often relying on superficial similarity and thus suffering from limited precision. This work proposes the Vulnerability Causal Knowledge Graph (VCKG), which for the first time integrates causal graphs with multi-agent reasoning by designing four collaborative agents—Collector, Claim, Critic, and Judge—to systematically capture the causal chain linking vulnerability entry points, preconditions, root causes, and repair intents. By combining causal context retrieval with large language models, VCKG enables interpretable validation of vulnerability hypotheses. Evaluated on C/C++ and Java benchmarks, the approach surpasses state-of-the-art methods by 130.7% and 71.56%, respectively, in Pair-Correct metrics, significantly advancing detection accuracy.

Abstract

Detecting source code vulnerabilities is increasingly difficult as modern security flaws are rooted in complex causal dependencies between execution flows, control conditions, and program states. Despite recent advances in Large Language Models (LLMs) and multi-agent frameworks, existing approaches primarily address superficial similarities between benign and vulnerable functions while failing to capture the complex causal dependencies inherent in security flaws. To address these limitations, we propose Causal Context-based Agentic Reasoning (CLEAR), a novel multi-agent vulnerability detection framework integrated with a causal knowledge graph. CLEAR systematically constructs a Vulnerability Causal Knowledge Graph (VCKG) that models the causal chains between entrypoints, preconditions, root causes, and fix intents across vulnerability instances. Leveraging this structured knowledge, four specialized agents, including the Collector, Claim, Critic, and Judge, collaboratively verify vulnerability hypotheses through retrieved causal contexts. Experimental results on C/C++ and Java vulnerability benchmarks demonstrate that CLEAR improves Pair-Correct (P-C) performance by 130.7% and 71.56% over state-of-the-art approaches, demonstrating the effectiveness of causal knowledge graph-guided reasoning for automated vulnerability detection.

Problem

• vulnerability detection
• causal dependencies
• program states
• execution flows
• security flaws

Innovation

• causal knowledge graph
• multi-agent reasoning
• vulnerability detection
• causal dependency
• automated program analysis