MAVUL: Multi-Agent Vulnerability Detection via Contextual Reasoning and Interactive Refinement

TL;DR

MAVUL addresses vulnerability detection (VD) in open-source software by overcoming context limitations, single-round interactions, and coarse evaluation through a three-agent system that enables contextual reasoning and interactive refinement. The vulnerability analyst, security architect, and evaluation judge collaborate to perform cross-procedural code analysis, iterative feedback, and fine-grained evaluation, supported by tool-using capabilities and memory. On a JitVul-derived dataset, MAVUL outperforms both single-agent and other multi-agent baselines, with performance improving as interaction rounds increase and evaluation bias reduced by the judge. The framework provides a robust, scalable approach to real-world VD, accompanied by open-source artifacts for reproducibility and broader adoption.

Abstract

The widespread adoption of open-source software (OSS) necessitates the mitigation of vulnerability risks. Most vulnerability detection (VD) methods are limited by inadequate contextual understanding, restrictive single-round interactions, and coarse-grained evaluations, resulting in undesired model performance and biased evaluation results. To address these challenges, we propose MAVUL, a novel multi-agent VD system that integrates contextual reasoning and interactive refinement. Specifically, a vulnerability analyst agent is designed to flexibly leverage tool-using capabilities and contextual reasoning to achieve cross-procedural code understanding and effectively mine vulnerability patterns. Through iterative feedback and refined decision-making within cross-role agent interactions, the system achieves reliable reasoning and vulnerability prediction. Furthermore, MAVUL introduces multi-dimensional ground truth information for fine-grained evaluation, thereby enhancing evaluation accuracy and reliability. Extensive experiments conducted on a pairwise vulnerability dataset demonstrate MAVUL's superior performance. Our findings indicate that MAVUL significantly outperforms existing multi-agent systems with over 62% higher pairwise accuracy and single-agent systems with over 600% higher average performance. The system's effectiveness is markedly improved with increased communication rounds between the vulnerability analyst agent and the security architect agent, underscoring the importance of contextual reasoning in tracing vulnerability flows and the crucial feedback role. Additionally, the integrated evaluation agent serves as a critical, unbiased judge, ensuring a more accurate and reliable estimation of the system's real-world applicability by preventing misleading binary comparisons.

Figures (2)

• Figure 1: System Overview of MAVUL
• Figure 2: Distribution of Vulnerability Types