Graph Is the Verifier: Agentic Reinforcement Learning for Interprocedural Vulnerability Detection
Source
Yikun Li, Ting Zhang, Jiakun Liu, Jinfeng Jiang, Yuheng Yieh, Yixin Yang, Wen Bin Leow, Yide Yin, Yintong Huo, Eng Lieh Ouh, Lwin Khin Shar, David Lo
Author
Yikun Li, Ting Zhang, Jiakun Liu, Jinfeng Jiang, Yuheng Yieh, Yixin Yang, Wen Bin Leow, Yide Yin, Yintong Huo, Eng Lieh Ouh, Lwin Khin Shar, David Lo
Date
Key takeaways · AI-distilled
On a sample of real CVEs, 71.7% of vulnerable functions cannot be judged correctly from the function alone. The evidence sits in callers, callees, or dataflow elsewhere, so function-level detectors are guessing on most real bugs.
Rewarding only the final verdict teaches the AI agentAn AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.Full definition → to skip the investigation, since it can guess 'vulnerable' and collect the reward. VulAgentRL instead checks the evidence the agent cites against a code property graph and pays only for supported verdicts.
Verification is exact rather than fuzzy because every graph node carries a persistent integer id, so checking a cited piece of evidence is an id comparison, not a text match.
Reinforcement learning cannot acquire tool-use behavior it never samples. The policy had to be warm-started by distilling teacher investigations before RL could improve anything.
Terms in this piece · Glossary
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
Why it matters
Function-level vulnerability detectors are structurally blind to most real CVEs; agentic traversal is a credible fix.
Key quotes
“Real-world vulnerabilities often span multiple functions, yet most learning-based detectors classify each function in isolation: on a sample of real CVEs, we find that 71.7% of vulnerable functions require evidence from outside the function to be classified correctly.”
“Agentic reinforcement learning (RL) could close this gap by enabling a model to gather that evidence itself, but it lacks a reliable reward, since a reward defined on the final verdict alone can be obtained without performing any investigation.”
“We further initialize the policy by distilling teacher investigations, and show that this warm start is necessary, since RL cannot acquire tool-use behavior it never samples.”
videoRL Without Verifiable Rewards (Will Brown, Prime Intellect)AI Engineer
articleCodeGrep: An RL-Trained Retrieval Agent for LLM Coding AgentsWuya Chen, Yihao yang, Yang Cao, Yue Lin
articleUniversal Pathologies, Conditional Consequences: A Triple-Robustness Analysis of RAG for Multi-Hop TraceabilityMeftun Akarsu, Burak Ozdemir