Pith Number

pith:OXBLGI7Y

pith:2026:OXBLGI7YWEHMEK57HKA5664BVK

not attested not anchored not stored refs pending

VulWeaver: Weaving Broken Semantics for Grounded Vulnerability Detection

Bihuan Chen, Jiayi Deng, Miaohua Li, Susheng Wu, Xingman Chen, Xin Hu, Xin Peng, Xueying Du, Yihao Chen, Yiheng Cao, Yiheng Huang, Zhuotong Zhou

VulWeaver repairs inaccurate static-analysis dependency graphs by integrating LLM semantic inference with deterministic rules to support grounded vulnerability detection.

arxiv:2604.10767 v2 · 2026-04-12 · cs.SE

Open paper page JSON Open Graph Bundle Merged state Verified badge What is a Pith Number?

Add to your LaTeX paper

\usepackage{pith}
\pithnumber{OXBLGI7YWEHMEK57HKA5664BVK}

Prints a linked badge after your title and injects PDF metadata. Compiles on arXiv. Learn more · Embed verified badge

Record completeness

1 Bitcoin timestamp

2 Internet Archive

3 Author claim open · sign in to claim

4 Citations open

5 Replications open

✓ Portable graph bundle live · download bundle · merged state

The bundle contains the canonical record plus signed events. A mirror can host it anywhere and recompute the same current state with the deterministic merge algorithm.

Claims

C1strongest claim

VulWeaver achieves a F1-score of 0.75 on the PrimeVul4J dataset, outperforming state-of-the-art learning-based, LLM-based, and agent-based baselines by 23%, 15%, and 60% in F1-score respectively, while also detecting 26 true vulnerabilities in real-world Java projects with 15 developer confirmations and 5 assigned CVEs.

C2weakest assumption

That LLM-based semantic inference reliably repairs inaccuracies in the static-analysis dependency graph without introducing new errors or hallucinations that would invalidate the subsequent context extraction and reasoning steps.

C3one line summary

VulWeaver improves Java vulnerability detection to 0.75 F1 by enhancing dependency graphs with LLM semantic fixes, extracting full context from slices plus implicit usage info, and applying type-specific meta-prompting with majority voting.

Receipt and verification

First computed	2026-07-16T01:22:39.738133Z
Builder	pith-number-builder-2026-05-17-v1
Signature	Pith Ed25519 (`pith-v1-2026-05`) · public key
Schema	pith-number/v1.0

Canonical hash

75c2b323f8b10ec22bbf3a81df7b81aabc3546cdd1381e0e9e09b39ea2de0537

Aliases

arxiv: 2604.10767 · arxiv_version: 2604.10767v2 · doi: 10.48550/arxiv.2604.10767 · pith_short_12: OXBLGI7YWEHM · pith_short_16: OXBLGI7YWEHMEK57 · pith_short_8: OXBLGI7Y

Agent API

Resolver JSON Graph JSON Events JSON Schema Signing key

Verify this Pith Number yourself

curl -sH 'Accept: application/ld+json' https://pith.science/pith/OXBLGI7YWEHMEK57HKA5664BVK \
  | jq -c '.canonical_record' \
  | python3 -c "import sys,json,hashlib; b=json.dumps(json.loads(sys.stdin.read()), sort_keys=True, separators=(',',':'), ensure_ascii=False).encode(); print(hashlib.sha256(b).hexdigest())"
# expect: 75c2b323f8b10ec22bbf3a81df7b81aabc3546cdd1381e0e9e09b39ea2de0537

Canonical record JSON

{
  "metadata": {
    "abstract_canon_sha256": "cd53ce211b8f4dac9d5d6f228ee5f5b91f8921d9aed5e16f33e7dd19332ad9b4",
    "cross_cats_sorted": [],
    "license": "http://creativecommons.org/licenses/by-nc-nd/4.0/",
    "primary_cat": "cs.SE",
    "submitted_at": "2026-04-12T18:31:46Z",
    "title_canon_sha256": "4421b7c30a687fe51b02628b60c16b1664ada2a91b353ab7ae682e775e9c0459"
  },
  "schema_version": "1.0",
  "source": {
    "id": "2604.10767",
    "kind": "arxiv",
    "version": 2
  }
}