Reva: Real-Time Vulnerability Detection through Contextual Probing of Large Language Models
Reva screens each new function for vulnerabilities in real time by probing an LLM's internal states, meant as a first check on agent-written code.
Paper (from PDF)
Read full textR : Real-Time Vulnerability Detection through EVA Contextual Probing of Large Language Models Amine Lbath, Massih-Reza Amini, Université Grenoble Alpes, CNRS, France Abstract—A vulnerability costs more to fix the later it is the function-level detection literature, and VulAgent [7] enrich discoveredinthesoftwarelifecycle.Ascodingagentsnowgenerate thepromptwithretrievedvulnerabilityknowledgeandprogram codefasterthandeveloperscanreviewit,softwareneedsastronger facts, and VulTrial [8] lets several agents debate a verdict. first line of defense that screens each new function in real time, This reasoning, however, spans several model calls, which as it is generated. LLM agents have recently become capable of finding real-world vulnerabilities by working as a security expert amounts to minutes per function. Faster AI-based detectors, would: they run analysis tools, explore the surrounding code, which fine-tune deep learning models or prompt an LLM for test hypotheses and weigh the evidence before forming their own a direct verdict, reduce this latency but are considerably less judgement. This reasoning, however, spans many model calls, accurate [9]–[11]. so that each verdict takes minutes of compute, far too long to keeppacewithcodegeneration.FasterAI-baseddetectors,which REVA is designed to close this gap between speed and fine-tune deep learning models or prompt an LLM for a direct improved accuracy. Instead of letting the LLM gather context verdict, are considerably less accurate: they judge a function through multiple rounds of tool calls, REVA assembles it in without the context an agent gathers, and an LLM’s generated the prompt, including a threat model of the function’s module, verdict has proven unreliable in prior work even when some of its static analysis findings, its call graph and its file. Instead that context is given. of reasoning towards a verdict, the LLM then processes this We present REVA (REal-time Vulnerability Analysis), an AI vulnerability detector that brings the security context and code prompt in a single forward pass without generating text, and understanding components behind agentic detectors into a single a small probe trained on labeled functions maps its internal forward pass of an LLM. For each new function, REVA provides representations of the code tokens to a risk score. This second the LLM with a pre-computed threat model of its module, choice builds on evidence that LLMs encode knowledge that along with lightweight static …
Explained
What happened
Coding agents now write code faster than people can review it. Agent-based vulnerability detectors are accurate but slow: they call tools, explore code and reason over many model calls, which takes minutes per function. Fast detectors, which just ask an LLM for a verdict, are much less accurate. REVA (REal-time Vulnerability Analysis) tries to get agent-level accuracy at real-time speed.
- Pre-build the context. For each project, a threat model of each module is built ahead of time. For each new function, REVA adds
Semgrepfindings, the call graph (callers, callees, helper signatures) and file context (includes, types, macros, sibling functions) extracted withtree-sitter. The median prompt is 3,840 tokens, 601 of them code. - One forward pass, no text. The LLM reads the prompt once and stops after the deepest of four probed layers, between 38% and 85% of model depth. It generates no tokens.
- Probe the hidden states. REVA keeps only the hidden states of the function's own tokens, projects each layer to 1,024 dimensions, and feeds them to a small attention probe (8 heads, 0.57M parameters) that outputs a risk score. The probe is trained on labeled functions with a loss that also ranks each vulnerable function above its fixed version.
- Results on PrimeVul (C and C++ functions from 651 projects, 121 CWE types): with
GLM-5.3-Flash, REVA reaches 60.0% accuracy in about one second per function, on par with the agentic VulTriage (59.2%) on the same model while being over 250x faster and under a tenth of the cost. On the same prompt, the probe beats the LLM's own written verdict by 14 to 17 points. On two other open models it is 9% to 13% more accurate than both agentic baselines. One full analysis takes 0.93 s on one H200, of which 0.46 s is context extraction.
Why it works
LLMs often know more than they say. Earlier work showed hidden states encode whether a statement is true or an answer is correct, even when the generated text is wrong. Chain-of-thought is also not always faithful to the model's real computation.
So instead of trusting the model's sentence, REVA reads its internal representation of the code after giving it the context an agent would have gathered. The expensive part of agentic detection, collecting context, is moved offline or done with cheap tools, and the reasoning loop is replaced by a learned readout.
The bigger pattern
This is amortization: pay once for project-level analysis, then make per-item decisions cheap. It is also part of a growing trend of using probes on hidden states as fast classifiers instead of generating answers.
The authors propose a tiered design: a fast screen on every function, with likely bugs escalated to slower agents that try to build a proof of vulnerability. Note that 60% accuracy on paired functions is still far from a final judge; it is a triage signal.
What it means in practice
- For checks on agent-written code, consider a two-tier pipeline: a cheap per-change scorer in CI, and expensive agent review only on high-risk changes.
- If you run open models, probing hidden states can give better and cheaper classifiers than asking the model to answer, for tasks like moderation or routing.
- Precompute context per repo or module (threat models, call graphs) so per-request prompts stay small.
- Benchmark detectors on paired vulnerable and fixed code; single-label accuracy can hide models that just learn surface features.