{"id":"https://openalex.org/W7153041041","doi":"https://doi.org/10.48550/arxiv.2604.08417","title":"Vulnerability Detection with Interprocedural Context in Multiple Languages: Assessing Effectiveness and Cost of Modern LLMs","display_name":"Vulnerability Detection with Interprocedural Context in Multiple Languages: Assessing Effectiveness and Cost of Modern LLMs","publication_year":2026,"publication_date":"2026-04-09","ids":{"openalex":"https://openalex.org/W7153041041","doi":"https://doi.org/10.48550/arxiv.2604.08417"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.08417","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.08417","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.08417","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5133334727","display_name":"Kevin Lira","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lira, Kevin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5090231856","display_name":"Baldo\u00edno Fonseca","orcid":"https://orcid.org/0000-0002-0730-0319"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Fonseca, Baldoino","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133370528","display_name":"Davy Ba\u00eda","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ba\u00eda, Davy","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133321941","display_name":"M\u00e1rcio Ribeiro","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ribeiro, M\u00e1rcio","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5121126913","display_name":"Wesley K. G. Assun\u00e7\u00e3o","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Assun\u00e7\u00e3o, Wesley K. G.","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.19419999420642853,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.19419999420642853,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.16429999470710754,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.12540000677108765,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.6935999989509583},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.6233999729156494},{"id":"https://openalex.org/keywords/function","display_name":"Function (biology)","score":0.536899983882904},{"id":"https://openalex.org/keywords/control","display_name":"Control (management)","score":0.3540000021457672},{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.3449999988079071}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7164000272750854},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.6935999989509583},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.6233999729156494},{"id":"https://openalex.org/C14036430","wikidata":"https://www.wikidata.org/wiki/Q3736076","display_name":"Function (biology)","level":2,"score":0.536899983882904},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.3540000021457672},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.3449999988079071},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3312999904155731},{"id":"https://openalex.org/C12174686","wikidata":"https://www.wikidata.org/wiki/Q1058438","display_name":"Risk assessment","level":2,"score":0.3206000030040741},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.3066999912261963},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.2831999957561493},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.2662000060081482}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.08417","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.08417","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.08417","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.08417","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.4967288672924042}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Large":[0],"Language":[1],"Models":[2],"(LLMs)":[3],"have":[4,17,193],"been":[5],"a":[6],"promising":[7],"way":[8],"for":[9,159,196],"automated":[10],"vulnerability":[11,183],"detection.":[12],"However,":[13],"most":[14],"prior":[15],"studies":[16,37],"explored":[18],"the":[19,53,68,72,76,114,119,138,155,182,187,191,197],"use":[20],"of":[21,70,78,80,121,170,186,199],"LLMs":[22,83,141],"to":[23,33,99],"detect":[24],"vulnerabilities":[25,39,97,112],"only":[26],"within":[27],"single":[28],"functions,":[29],"disregarding":[30],"those":[31],"related":[32,98],"interprocedural":[34,100,122],"dependencies.":[35,101],"These":[36],"overlook":[38],"that":[40,47,150,204],"arise":[41],"from":[42,113],"data":[43],"and":[44,58,75,91,131,136,145,174,180],"control":[45],"flows":[46],"span":[48],"multiple":[49,210],"functions.":[50],"Thus,":[51],"leveraging":[52],"context":[54,123],"provided":[55],"by":[56],"callers":[57],"callees":[59],"may":[60],"help":[61],"identify":[62],"vulnerabilities.":[63],"This":[64],"study":[65,109],"empirically":[66],"investigates":[67],"effectiveness":[69],"detection,":[71],"inference":[73],"cost,":[74],"quality":[77],"explanations":[79],"four":[81,139],"modern":[82,140],"(Claude":[84],"Haiku":[85,176],"4.5,":[86],"GPT-4.1":[87],"Mini,":[88,90],"GPT-5":[89],"Gemini":[92,151],"3":[93,152],"Flash)":[94],"in":[95,184,209],"detecting":[96],"To":[102],"do":[103],"that,":[104],"we":[105],"conducted":[106],"an":[107,167],"empirical":[108],"on":[110],"509":[111],"ReposVul":[115],"dataset,":[116],"systematically":[117],"varying":[118],"level":[120],"(target":[124],"function":[125,128,133],"code-only,":[126],"target":[127,132],"+":[129,134],"callers,":[130],"callees)":[135],"evaluating":[137],"across":[142,207],"C,":[143],"C++,":[144],"Python.":[146],"The":[147],"results":[148],"show":[149],"Flash":[153],"offers":[154],"best":[156],"cost-effectiveness":[157],"trade-off":[158],"C":[160],"vulnerabilities,":[161],"achieving":[162],"F1":[163],">=":[164],"0.978":[165],"at":[166],"estimated":[168],"cost":[169],"$0.50-$0.58":[171],"per":[172],"configuration,":[173],"Claude":[175],"4.5":[177],"correctly":[178],"identified":[179],"explained":[181],"93.6%":[185],"evaluated":[188],"cases.":[189],"Overall,":[190],"findings":[192],"direct":[194],"implications":[195],"design":[198],"AI-assisted":[200],"security":[201],"analysis":[202],"tools":[203],"can":[205],"generalize":[206],"codebases":[208],"programming":[211],"languages.":[212]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-04-11T00:00:00"}