SBVul：基于语句级的 C/C++ 漏洞检测智能体方法
SBVUL: Statement-Based Vulnerability Detection
论文让 LLM 智能体直接标出 C/C++ 代码里哪一行有漏洞，函数级判断从 33.8% 提到 42.0%，不过误报率也不低，适合研究代码安全的人看看。
论文提出 SBVul，用两阶段智能体在 C/C++ 函数中定位可利用语句：Phase 1 由 LLM 探索函数及代码仓库并找出候选语句，Phase 2 由第二个智能体分析控制流与数据流后确认或排除。作者为 PrimeVul Paired 测试集中 200 对函数人工标注了可利用语句作为基准，并测试了 Qwen 3.8、DeepSeek V4.1 Flash、Sonnet 5.5 和 Opus 5.5 四个模型。Phase 1 在 56–77% 的漏洞函数中命中基准语句，Opus 5.5 拿到最高的语句级精确率 0.315、召回率 0.605。函数级配对分类上，SBVul 配 Opus 5.5 达到 42.0% 正确率，高于此前最佳方法的 33.8%，但在已修复函数中仍有 23–61% 的误确认。
SBVUL: Statement-Based Vulnerability Detection
Many recent approaches for vulnerability detection use large language models (LLMs) to classify functions as vulnerable or benign, leaving developers to locate the exploitable statements. Furthermore, while these approaches have shown performance improvements, they still fall short in distinguishing vulnerable from patched real-world functions. This paper presents SBVul, an agentic approach that detects exploitable statements in C/C++ functions. In Phase~1, an LLM agent explores the function and its repository and identifies candidate statements. In Phase~2, a second agent analyzes the control and data flow of each candidate and confirms it, rules it out, or marks it uncertain. We created a manually verified ground truth of exploitable statements for 200 pairs of the PrimeVul Paired test set and ran SBVul with the open-weight models Qwen 3.8 and DeepSeek V4.1 Flash and Anthropic's Sonnet 5.5 and Opus 5.5. Phase~1 identifies ground-truth statements in 56--77% of the vulnerable functions, and Phase~2 confirms such a statement with an explanation accepted by an LLM judge in 26--73%. However, all models also confirm candidates in 23--61% of the patched functions. Across vulnerable and patched functions, the highest statement-level precision is 0.315 at a recall of 0.605 obtained with Opus 5.5 (xhigh). At the function level, SBVul with Opus 5.5 classifies 42.0% of the pairs correctly, compared with 33.8% reported for the best previous approach.