REVA
A real-time vulnerability detection method that injects precomputed context (threat model, static analysis findings, call graph information) and uses probes to read the LLM's internal representations, completing vulnerability judgment in a single forward pass and substantially reducing latency and cost.
Timeline (last 90 days)
REVA (REal-time Vulnerability Analysis) compresses the security context and code understanding capabilities required by an agent-style vulnerability detector into a single forward pass of an LLM, enabling real-time vulnerability detection.
At runtime, REVA injects three types of precomputed information into the LLM: a precomputed threat model for the module in question, lightweight static analysis findings, and call graph information.
REVA uses a trained probe to read the LLM's internal representation of a function under the given context to make security judgments, rather than relying on the LLM to generate a textual verdict.
On the PrimeVul held-out test set, REVA with GLM-5.3-Flash achieves 60.0% accuracy at about one second per function.
With precision on par with VulTriage, REVA is more than 250 times faster and costs less than one tenth as much.
Under the same prompt conditions, a probe reading internal representations achieves 14% to 17% higher accuracy than having the LLM directly output a verdict.
In cross-model validation, REVA's accuracy is at least on par with VulTriage on three open-source LLMs, and about 10% higher on two of them.
REVA's throughput of one function per second is sufficient to be embedded in CI/CD pipelines, completing a first-pass filter before code is merged.
REVA's results are concentrated on only one benchmark, PrimeVul; the accuracy of around 60% is still far from perfect, and probe quality depends on the coverage of the training data, while threat models and static analysis quality also propagate to the final judgment.
For codebases with high security requirements, REVA is better suited as a preliminary screening layer than as the final arbiter.
All Facts (10)
REVA (REal-time Vulnerability Analysis) compresses the security context and code understanding capabilities required by an agent-style vulnerability detector into a single forward pass of an LLM, enabling real-time vulnerability detection.
50%UnverifiedAt runtime, REVA injects three types of precomputed information into the LLM: a precomputed threat model for the module in question, lightweight static analysis findings, and call graph information.
50%UnverifiedREVA uses a trained probe to read the LLM's internal representation of a function under the given context to make security judgments, rather than relying on the LLM to generate a textual verdict.
50%UnverifiedOn the PrimeVul held-out test set, REVA with GLM-5.3-Flash achieves 60.0% accuracy at about one second per function.
50%UnverifiedWith precision on par with VulTriage, REVA is more than 250 times faster and costs less than one tenth as much.
50%UnverifiedUnder the same prompt conditions, a probe reading internal representations achieves 14% to 17% higher accuracy than having the LLM directly output a verdict.
50%UnverifiedIn cross-model validation, REVA's accuracy is at least on par with VulTriage on three open-source LLMs, and about 10% higher on two of them.
50%UnverifiedREVA's throughput of one function per second is sufficient to be embedded in CI/CD pipelines, completing a first-pass filter before code is merged.
50%UnverifiedREVA's results are concentrated on only one benchmark, PrimeVul; the accuracy of around 60% is still far from perfect, and probe quality depends on the coverage of the training data, while threat models and static analysis quality also propagate to the final judgment.
50%UnverifiedFor codebases with high security requirements, REVA is better suited as a preliminary screening layer than as the final arbiter.
50%