Intel / article

Graph Is the Verifier: Agentic Reinforcement Learning for Interprocedural Vulnerability Detection

Source: arxiv.org
Author: Yikun Li, Ting Zhang, Jiakun Liu, Jinfeng Jiang, Yuheng Yieh, Yixin Yang, Wen Bin Leow, Yide Yin, Yintong Huo, Eng Lieh Ouh, Lwin Khin Shar, David Lo
Date: Published Jul 30, 2026

Context

A vulnerability detector may need to follow evidence beyond the function it is judging. VulAgentRL supports that investigation with a graph representing code relationships, including function calls and data flow. The queries the graph, then cites particular graph nodes as evidence for its verdict. During training, persistent node identifiers let the system check those citations directly and reward supported verdicts, addressing the risk of rewarding a correct guess with no investigation. The graph checks the cited structural evidence; that alone is not a complete proof of vulnerability. The contribution is a concrete way to connect investigation with training feedback. Research abstract.

Key takeaways · AI-distilled

On a sample of real CVEs, 71.7% of vulnerable functions cannot be judged correctly from the function alone. The evidence sits in callers, callees, or dataflow elsewhere, so function-level detectors are guessing on most real bugs.
Rewarding only the final verdict teaches the agent to skip the investigation, since it can guess 'vulnerable' and collect the reward. VulAgentRL instead checks the evidence the agent cites against a code property graph and pays only for supported verdicts.
Verification is exact rather than fuzzy because every graph node carries a persistent integer id, so checking a cited piece of evidence is an id comparison, not a text match.
Reinforcement learning cannot acquire tool-use behavior it never samples. The policy had to be warm-started by distilling teacher investigations before RL could improve anything.

Terms in this piece · Glossary

AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.

Key quotes

“Real-world vulnerabilities often span multiple functions, yet most learning-based detectors classify each function in isolation: on a sample of real CVEs, we find that 71.7% of vulnerable functions require evidence from outside the function to be classified correctly.”

“Agentic reinforcement learning (RL) could close this gap by enabling a model to gather that evidence itself, but it lacks a reliable reward, since a reward defined on the final verdict alone can be obtained without performing any investigation.”

“We further initialize the policy by distilling teacher investigations, and show that this warm start is necessary, since RL cannot acquire tool-use behavior it never samples.”

Read the source arxiv.org