{
  "schema_version": "1.1",
  "id": "archive:https://arxiv.org/abs/2610.35829v1",
  "slug": "2610-35829v1-1co6ulj",
  "url": "https://feed7.dev/p/2610-35829v1-1co6ulj",
  "title": "Reva: Real-Time Vulnerability Detection through Contextual Probing of Large Language Models",
  "why_included": "REVA uses module threat models, static-analysis findings, and call graphs to screen code with an LLM probe in one pass. On PrimeVul, it matched an agentic detector’s accuracy at a fraction of its reported time and cost.",
  "summary": "REVA supplies a function’s LLM with a precomputed module threat model, static-analysis findings, and call-graph information, then uses a trained probe to read internal representations. On PrimeVul’s held-out test set, it reached **60.0% accuracy** in about **one second per function**, matching the reported 59.2% for VulTriage on the same LLM.",
  "practical_implication": "For teams screening code from agents, the result suggests a path to fast, context-aware checks between code generation and review. The paper reports REVA was over **250 times faster** and cost less than a tenth as much as VulTriage; its probe also beat the LLM’s direct verdict by 14–17% on the same prompt.",
  "agent_context": "REVA supplies a function’s LLM with a precomputed module threat model, static-analysis findings, and call-graph information, then uses a trained probe to read internal representations. On PrimeVul’s held-out test set, it reached **60.0% accuracy** in about **one second per function**, matching the reported 59.2% for VulTriage on the same LLM.\n\nFor teams screening code from agents, the result suggests a path to fast, context-aware checks between code generation and review. The paper reports REVA was over **250 times faster** and cost less than a tenth as much as VulTriage; its probe also beat the LLM’s direct verdict by 14–17% on the same prompt.\n\nThese are results from a held-out benchmark, not a guarantee of finding vulnerabilities in a particular codebase. The material does not establish how the detector performs in a production review pipeline.",
  "source": {
    "name": "arXiv",
    "url": "https://arxiv.org/abs/2610.35829v1",
    "published_at": "2026-10-26T17:50:09.000Z"
  },
  "source_class": "blog_post",
  "content_type": "Paper",
  "layer": "benchmark",
  "domains": [
    "coding",
    "security"
  ],
  "topics": [
    "agent-evals",
    "agent-reliability"
  ],
  "verification": {
    "status": "needs_review",
    "label": "Needs Review",
    "method": "unverified",
    "verified_at": null
  },
  "uncertainty": [
    "These are results from a held-out benchmark, not a guarantee of finding vulnerabilities in a particular codebase. The material does not establish how the detector performs in a production review pipeline."
  ],
  "connected_context": {
    "meaning": "This offers a fast, context-aware function-level vulnerability screen that could fit between code generation and human review, with benchmark evidence for accuracy, speed, and cost. It does not establish production performance or repository-scale discovery, so it adds a screening signal rather than evidence that a codebase is secure.",
    "corpus_size": 928,
    "generated_at": "2026-10-27T11:06:56.591Z",
    "connections": [
      {
        "title": "Vulnerability Localization Benchmark: Measuring Agentic Security Analysis at Repository Scale",
        "source_name": "arXiv",
        "source_url": "https://arxiv.org/abs/2609.15939v1",
        "feed7_url": "https://feed7.dev/p/2609-15939v1-0w15mi5",
        "reason": "REVA classifies functions using supplied threat context, while VLoc tests whether agents can locate vulnerable files across repositories; success at the former does not establish the latter."
      },
      {
        "title": "Metrics Failure in LLM-Based Code Vulnerability Repair: An Empirical Study and a Change-Aware Screen",
        "source_name": "arXiv",
        "source_url": "https://arxiv.org/abs/2609.26749v1",
        "feed7_url": "https://feed7.dev/p/2609-26749v1-1fj6jga",
        "reason": "Both concern vulnerability workflows, but REVA detects likely vulnerable functions and the repair study evaluates whether patches are sound; detection results do not validate repair quality."
      }
    ]
  },
  "lifecycle": "Current",
  "published_at": "2026-10-26T17:50:09.000Z",
  "modified_at": "2026-10-26T17:50:09.000Z",
  "supersedes": [],
  "expires_at": null,
  "formats": {
    "html": "https://feed7.dev/p/2610-35829v1-1co6ulj",
    "json": "https://feed7.dev/p/2610-35829v1-1co6ulj.json",
    "markdown": "https://feed7.dev/p/2610-35829v1-1co6ulj.md"
  }
}