2026-10-05T21:44:55Z https://drops.dagstuhl.de/oai

oai:drops-oai.dagstuhl.de:27969 2026-10-05T06:44:02Z ddc:004 open_access

CognixShield: PoV-Guided Vulnerable API Usage Detection in Large Codebases via LLMs Fu, Quanzhi Lingxiang, Wang Song, Wenjia Deng, Gelei Liu, Yi Williams, Dan Zhang, Ying Vulnerable API usage detection program analysis LLMs agentic RAG Background. The integration of open-source libraries in Java development introduces severe security risks through vulnerable APIs. Existing program analysis and deep learning tools face challenges in capturing inter-procedural vulnerability semantics at scale. While LLMs show promise for semantic reasoning, they cannot handle large codebases due to context limits, and they lack the vulnerability-specific understanding needed to determine exploitability. Aim. This work aims to overcome these limitations and enable LLM-based detection of vulnerable API usage in large-scale Java applications. Method. We present CognixShield, an LLM-powered framework for detecting vulnerable API usage through three core components. First, semantic-preserving AST-based fragmentation partitions large codebases while maintaining syntactic completeness within LLM context windows. Second, vulnerability-aware multi-agent RAG traces relevant program context across these fragments, iteratively assembling security-critical context spanning functions and files. Third, PoV-guided semantic reasoning uses Proof-of-Vulnerability tests that encode precise triggering conditions and exploitation mechanics to determine vulnerability. Results. CognixShield achieves 84% precision, 95% recall, 84% accuracy, and an 89% F1-score on 57 real-world Java applications, outperforming state-of-the-art tools. Conclusions. Our results show that vulnerability detection requires specialized architectural innovations beyond generic LLM applications. Schloss Dagstuhl – Leibniz-Zentrum für Informatik Quanzhi Fu and Wang Lingxiang and Wenjia Song and Gelei Deng and Yi Liu and Dan Williams and Ying Zhang 2026 Is Part Of LIPIcs, Volume 394, 20th International Symposium on Empirical Software Engineering and Measurement (ESEM 2026) InProceedings Text doc-type:ResearchArticle publishedVersion application/pdf doi:10.4230/LIPIcs.ESEM.2026.1 urn:nbn:de:0030-drops-279698 https://drops.dagstuhl.de/entities/document/10.4230/LIPIcs.ESEM.2026.1 eng https://creativecommons.org/licenses/by/4.0/legalcode