标题： MAVUL：通过上下文推理和交互式优化进行多智能体漏洞检测 显示英文标题

标题： MAVUL: Multi-Agent Vulnerability Detection via Contextual Reasoning and Interactive Refinement

摘要： 开放源代码软件（OSS）的广泛采用需要减轻漏洞风险。 大多数漏洞检测（VD）方法由于缺乏上下文理解、限制性的单轮交互和粗粒度评估而受到限制，导致模型性能不佳和评估结果偏差。 为了解决这些挑战，我们提出了MAVUL，一种新颖的多代理VD系统，该系统整合了上下文推理和交互式优化。 具体而言，设计了一个漏洞分析师代理，以灵活地利用工具使用能力和上下文推理，实现跨过程代码理解和有效挖掘漏洞模式。 通过在跨角色代理交互中的迭代反馈和优化决策，系统实现了可靠的推理和漏洞预测。 此外，MAVUL引入了多维真实信息用于细粒度评估，从而提高了评估的准确性和可靠性。 在成对漏洞数据集上进行的大量实验表明MAVUL表现出色。 我们的研究结果表明，MAVUL显著优于现有的多代理系统，成对准确率高出超过62%，比单代理系统平均性能高出超过600%。 随着漏洞分析师代理和安全架构师代理之间通信轮次的增加，系统的有效性明显提高，这突显了在追踪漏洞流中上下文推理的重要性以及关键反馈作用。 此外，集成的评估代理作为一个关键且无偏的裁判，通过防止误导性的二元比较，确保了系统实际应用的更准确和可靠估计。 显示英文摘要

摘要： The widespread adoption of open-source software (OSS) necessitates the mitigation of vulnerability risks. Most vulnerability detection (VD) methods are limited by inadequate contextual understanding, restrictive single-round interactions, and coarse-grained evaluations, resulting in undesired model performance and biased evaluation results. To address these challenges, we propose MAVUL, a novel multi-agent VD system that integrates contextual reasoning and interactive refinement. Specifically, a vulnerability analyst agent is designed to flexibly leverage tool-using capabilities and contextual reasoning to achieve cross-procedural code understanding and effectively mine vulnerability patterns. Through iterative feedback and refined decision-making within cross-role agent interactions, the system achieves reliable reasoning and vulnerability prediction. Furthermore, MAVUL introduces multi-dimensional ground truth information for fine-grained evaluation, thereby enhancing evaluation accuracy and reliability. Extensive experiments conducted on a pairwise vulnerability dataset demonstrate MAVUL's superior performance. Our findings indicate that MAVUL significantly outperforms existing multi-agent systems with over 62% higher pairwise accuracy and single-agent systems with over 600% higher average performance. The system's effectiveness is markedly improved with increased communication rounds between the vulnerability analyst agent and the security architect agent, underscoring the importance of contextual reasoning in tracing vulnerability flows and the crucial feedback role. Additionally, the integrated evaluation agent serves as a critical, unbiased judge, ensuring a more accurate and reliable estimation of the system's real-world applicability by preventing misleading binary comparisons.