{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:OXBLGI7YWEHMEK57HKA5664BVK","short_pith_number":"pith:OXBLGI7Y","canonical_record":{"source":{"id":"2604.10767","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2026-04-12T18:31:46Z","cross_cats_sorted":[],"title_canon_sha256":"4421b7c30a687fe51b02628b60c16b1664ada2a91b353ab7ae682e775e9c0459","abstract_canon_sha256":"cd53ce211b8f4dac9d5d6f228ee5f5b91f8921d9aed5e16f33e7dd19332ad9b4"},"schema_version":"1.0"},"canonical_sha256":"75c2b323f8b10ec22bbf3a81df7b81aabc3546cdd1381e0e9e09b39ea2de0537","source":{"kind":"arxiv","id":"2604.10767","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2604.10767","created_at":"2026-07-16T01:22:39Z"},{"alias_kind":"arxiv_version","alias_value":"2604.10767v2","created_at":"2026-07-16T01:22:39Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2604.10767","created_at":"2026-07-16T01:22:39Z"},{"alias_kind":"pith_short_12","alias_value":"OXBLGI7YWEHM","created_at":"2026-07-16T01:22:39Z"},{"alias_kind":"pith_short_16","alias_value":"OXBLGI7YWEHMEK57","created_at":"2026-07-16T01:22:39Z"},{"alias_kind":"pith_short_8","alias_value":"OXBLGI7Y","created_at":"2026-07-16T01:22:39Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:OXBLGI7YWEHMEK57HKA5664BVK","target":"record","payload":{"canonical_record":{"source":{"id":"2604.10767","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2026-04-12T18:31:46Z","cross_cats_sorted":[],"title_canon_sha256":"4421b7c30a687fe51b02628b60c16b1664ada2a91b353ab7ae682e775e9c0459","abstract_canon_sha256":"cd53ce211b8f4dac9d5d6f228ee5f5b91f8921d9aed5e16f33e7dd19332ad9b4"},"schema_version":"1.0"},"canonical_sha256":"75c2b323f8b10ec22bbf3a81df7b81aabc3546cdd1381e0e9e09b39ea2de0537","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-16T01:22:39.739025Z","signature_b64":"4wx9CI0EjMNSgU/qYPcKU4czDoYMs/8KJT1h3wGjTuZpaqCih7AsFKiqRHh7WZ/LRaBekbx/jC6B2jy3bwaWDg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"75c2b323f8b10ec22bbf3a81df7b81aabc3546cdd1381e0e9e09b39ea2de0537","last_reissued_at":"2026-07-16T01:22:39.738133Z","signature_status":"signed_v1","first_computed_at":"2026-07-16T01:22:39.738133Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2604.10767","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-16T01:22:39Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"4JPowPZd56nqyRVuzxX3HG+wz3SDowWhWtAbxVjDbXGnejSXrpGBgFJin9SXnRD65OK5lCPkUP3qqr86zLrkAA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-01T08:59:46.028078Z"},"content_sha256":"31b9021788668df31cb244378d87c5d18883e0cd31c4d13032d6dd51b70f922f","schema_version":"1.0","event_id":"sha256:31b9021788668df31cb244378d87c5d18883e0cd31c4d13032d6dd51b70f922f"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:OXBLGI7YWEHMEK57HKA5664BVK","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"VulWeaver: Weaving Broken Semantics for Grounded Vulnerability Detection","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"VulWeaver repairs inaccurate static-analysis dependency graphs by integrating LLM semantic inference with deterministic rules to support grounded vulnerability detection.","cross_cats":[],"primary_cat":"cs.SE","authors_text":"Bihuan Chen, Jiayi Deng, Miaohua Li, Susheng Wu, Xingman Chen, Xin Hu, Xin Peng, Xueying Du, Yihao Chen, Yiheng Cao, Yiheng Huang, Zhuotong Zhou","submitted_at":"2026-04-12T18:31:46Z","abstract_excerpt":"Detecting vulnerabilities in source code remains critical yet challenging, as conventional static analysis tools construct inaccurate program representations, while existing LLM-based approaches often miss essential vulnerability context and lack grounded reasoning. In this paper, we introduce VulWeaver, a novel LLM-based approach that weaves broken program semantics into accurate representations and extracts holistic vulnerability context for grounded vulnerability detection. VulWeaver first constructs an enhanced unified dependency graph (UDG) by integrating deterministic rules with LLM-base"},"claims":{"count":4,"items":[{"kind":"strongest_claim","text":"VulWeaver achieves a F1-score of 0.75 on the PrimeVul4J dataset, outperforming state-of-the-art learning-based, LLM-based, and agent-based baselines by 23%, 15%, and 60% in F1-score respectively, while also detecting 26 true vulnerabilities in real-world Java projects with 15 developer confirmations and 5 assigned CVEs.","source":"verdict.strongest_claim","status":"machine_extracted","claim_id":"C1","attestation":"unclaimed"},{"kind":"weakest_assumption","text":"That LLM-based semantic inference reliably repairs inaccuracies in the static-analysis dependency graph without introducing new errors or hallucinations that would invalidate the subsequent context extraction and reasoning steps.","source":"verdict.weakest_assumption","status":"machine_extracted","claim_id":"C2","attestation":"unclaimed"},{"kind":"one_line_summary","text":"VulWeaver improves Java vulnerability detection to 0.75 F1 by enhancing dependency graphs with LLM semantic fixes, extracting full context from slices plus implicit usage info, and applying type-specific meta-prompting with majority voting.","source":"verdict.one_line_summary","status":"machine_extracted","claim_id":"C3","attestation":"unclaimed"},{"kind":"headline","text":"VulWeaver repairs inaccurate static-analysis dependency graphs by integrating LLM semantic inference with deterministic rules to support grounded vulnerability detection.","source":"verdict.pith_extraction.headline","status":"machine_extracted","claim_id":"C4","attestation":"unclaimed"}],"snapshot_sha256":"dc2706c0c48c207d2e71f56be695b06be39ac2f350ac8f283e307dd59de5b96f"},"source":{"id":"2604.10767","kind":"arxiv","version":2},"verdict":{"id":"e1d707a2-e2e6-4392-9909-f4f4c5637f7e","model_set":{"reader":"grok-4.3"},"created_at":"2026-05-10T15:27:24.272644Z","strongest_claim":"VulWeaver achieves a F1-score of 0.75 on the PrimeVul4J dataset, outperforming state-of-the-art learning-based, LLM-based, and agent-based baselines by 23%, 15%, and 60% in F1-score respectively, while also detecting 26 true vulnerabilities in real-world Java projects with 15 developer confirmations and 5 assigned CVEs.","one_line_summary":"VulWeaver improves Java vulnerability detection to 0.75 F1 by enhancing dependency graphs with LLM semantic fixes, extracting full context from slices plus implicit usage info, and applying type-specific meta-prompting with majority voting.","pipeline_version":"pith-pipeline@v0.9.0","weakest_assumption":"That LLM-based semantic inference reliably repairs inaccuracies in the static-analysis dependency graph without introducing new errors or hallucinations that would invalidate the subsequent context extraction and reasoning steps.","pith_extraction_headline":"VulWeaver repairs inaccurate static-analysis dependency graphs by integrating LLM semantic inference with deterministic rules to support grounded vulnerability detection."},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2604.10767/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":"e1d707a2-e2e6-4392-9909-f4f4c5637f7e"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-16T01:22:39Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"MAmHAdiNiFdzFKEj+ThNO6OcAK72FZR3PCEPqifrTeqiyskHCWHtCL7kzuMAiGTqouNN/7RY5eiBjwx2naP8DA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-01T08:59:46.028791Z"},"content_sha256":"745fd078f16b2cb07136b7c1e5468e3f1b0a8abf3a9e600bd26ee94fc9785f15","schema_version":"1.0","event_id":"sha256:745fd078f16b2cb07136b7c1e5468e3f1b0a8abf3a9e600bd26ee94fc9785f15"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/OXBLGI7YWEHMEK57HKA5664BVK/bundle.json","state_url":"https://pith.science/pith/OXBLGI7YWEHMEK57HKA5664BVK/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/OXBLGI7YWEHMEK57HKA5664BVK/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-01T08:59:46Z","links":{"resolver":"https://pith.science/pith/OXBLGI7YWEHMEK57HKA5664BVK","bundle":"https://pith.science/pith/OXBLGI7YWEHMEK57HKA5664BVK/bundle.json","state":"https://pith.science/pith/OXBLGI7YWEHMEK57HKA5664BVK/state.json","well_known_bundle":"https://pith.science/.well-known/pith/OXBLGI7YWEHMEK57HKA5664BVK/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:OXBLGI7YWEHMEK57HKA5664BVK","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"cd53ce211b8f4dac9d5d6f228ee5f5b91f8921d9aed5e16f33e7dd19332ad9b4","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2026-04-12T18:31:46Z","title_canon_sha256":"4421b7c30a687fe51b02628b60c16b1664ada2a91b353ab7ae682e775e9c0459"},"schema_version":"1.0","source":{"id":"2604.10767","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2604.10767","created_at":"2026-07-16T01:22:39Z"},{"alias_kind":"arxiv_version","alias_value":"2604.10767v2","created_at":"2026-07-16T01:22:39Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2604.10767","created_at":"2026-07-16T01:22:39Z"},{"alias_kind":"pith_short_12","alias_value":"OXBLGI7YWEHM","created_at":"2026-07-16T01:22:39Z"},{"alias_kind":"pith_short_16","alias_value":"OXBLGI7YWEHMEK57","created_at":"2026-07-16T01:22:39Z"},{"alias_kind":"pith_short_8","alias_value":"OXBLGI7Y","created_at":"2026-07-16T01:22:39Z"}],"graph_snapshots":[{"event_id":"sha256:745fd078f16b2cb07136b7c1e5468e3f1b0a8abf3a9e600bd26ee94fc9785f15","target":"graph","created_at":"2026-07-16T01:22:39Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":4,"items":[{"attestation":"unclaimed","claim_id":"C1","kind":"strongest_claim","source":"verdict.strongest_claim","status":"machine_extracted","text":"VulWeaver achieves a F1-score of 0.75 on the PrimeVul4J dataset, outperforming state-of-the-art learning-based, LLM-based, and agent-based baselines by 23%, 15%, and 60% in F1-score respectively, while also detecting 26 true vulnerabilities in real-world Java projects with 15 developer confirmations and 5 assigned CVEs."},{"attestation":"unclaimed","claim_id":"C2","kind":"weakest_assumption","source":"verdict.weakest_assumption","status":"machine_extracted","text":"That LLM-based semantic inference reliably repairs inaccuracies in the static-analysis dependency graph without introducing new errors or hallucinations that would invalidate the subsequent context extraction and reasoning steps."},{"attestation":"unclaimed","claim_id":"C3","kind":"one_line_summary","source":"verdict.one_line_summary","status":"machine_extracted","text":"VulWeaver improves Java vulnerability detection to 0.75 F1 by enhancing dependency graphs with LLM semantic fixes, extracting full context from slices plus implicit usage info, and applying type-specific meta-prompting with majority voting."},{"attestation":"unclaimed","claim_id":"C4","kind":"headline","source":"verdict.pith_extraction.headline","status":"machine_extracted","text":"VulWeaver repairs inaccurate static-analysis dependency graphs by integrating LLM semantic inference with deterministic rules to support grounded vulnerability detection."}],"snapshot_sha256":"dc2706c0c48c207d2e71f56be695b06be39ac2f350ac8f283e307dd59de5b96f"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2604.10767/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Detecting vulnerabilities in source code remains critical yet challenging, as conventional static analysis tools construct inaccurate program representations, while existing LLM-based approaches often miss essential vulnerability context and lack grounded reasoning. In this paper, we introduce VulWeaver, a novel LLM-based approach that weaves broken program semantics into accurate representations and extracts holistic vulnerability context for grounded vulnerability detection. VulWeaver first constructs an enhanced unified dependency graph (UDG) by integrating deterministic rules with LLM-base","authors_text":"Bihuan Chen, Jiayi Deng, Miaohua Li, Susheng Wu, Xingman Chen, Xin Hu, Xin Peng, Xueying Du, Yihao Chen, Yiheng Cao, Yiheng Huang, Zhuotong Zhou","cross_cats":[],"headline":"VulWeaver repairs inaccurate static-analysis dependency graphs by integrating LLM semantic inference with deterministic rules to support grounded vulnerability detection.","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2026-04-12T18:31:46Z","title":"VulWeaver: Weaving Broken Semantics for Grounded Vulnerability Detection"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2604.10767","kind":"arxiv","version":2},"verdict":{"created_at":"2026-05-10T15:27:24.272644Z","id":"e1d707a2-e2e6-4392-9909-f4f4c5637f7e","model_set":{"reader":"grok-4.3"},"one_line_summary":"VulWeaver improves Java vulnerability detection to 0.75 F1 by enhancing dependency graphs with LLM semantic fixes, extracting full context from slices plus implicit usage info, and applying type-specific meta-prompting with majority voting.","pipeline_version":"pith-pipeline@v0.9.0","pith_extraction_headline":"VulWeaver repairs inaccurate static-analysis dependency graphs by integrating LLM semantic inference with deterministic rules to support grounded vulnerability detection.","strongest_claim":"VulWeaver achieves a F1-score of 0.75 on the PrimeVul4J dataset, outperforming state-of-the-art learning-based, LLM-based, and agent-based baselines by 23%, 15%, and 60% in F1-score respectively, while also detecting 26 true vulnerabilities in real-world Java projects with 15 developer confirmations and 5 assigned CVEs.","weakest_assumption":"That LLM-based semantic inference reliably repairs inaccuracies in the static-analysis dependency graph without introducing new errors or hallucinations that would invalidate the subsequent context extraction and reasoning steps."}},"verdict_id":"e1d707a2-e2e6-4392-9909-f4f4c5637f7e"}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:31b9021788668df31cb244378d87c5d18883e0cd31c4d13032d6dd51b70f922f","target":"record","created_at":"2026-07-16T01:22:39Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"cd53ce211b8f4dac9d5d6f228ee5f5b91f8921d9aed5e16f33e7dd19332ad9b4","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.SE","submitted_at":"2026-04-12T18:31:46Z","title_canon_sha256":"4421b7c30a687fe51b02628b60c16b1664ada2a91b353ab7ae682e775e9c0459"},"schema_version":"1.0","source":{"id":"2604.10767","kind":"arxiv","version":2}},"canonical_sha256":"75c2b323f8b10ec22bbf3a81df7b81aabc3546cdd1381e0e9e09b39ea2de0537","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"75c2b323f8b10ec22bbf3a81df7b81aabc3546cdd1381e0e9e09b39ea2de0537","first_computed_at":"2026-07-16T01:22:39.738133Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-16T01:22:39.738133Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"4wx9CI0EjMNSgU/qYPcKU4czDoYMs/8KJT1h3wGjTuZpaqCih7AsFKiqRHh7WZ/LRaBekbx/jC6B2jy3bwaWDg==","signature_status":"signed_v1","signed_at":"2026-07-16T01:22:39.739025Z","signed_message":"canonical_sha256_bytes"},"source_id":"2604.10767","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:31b9021788668df31cb244378d87c5d18883e0cd31c4d13032d6dd51b70f922f","sha256:745fd078f16b2cb07136b7c1e5468e3f1b0a8abf3a9e600bd26ee94fc9785f15"],"state_sha256":"fdae8820dd52fc9c7031afa805d68511609dced47f86a60987a62ea9e72d7e7b"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"d5m44C9YbjU3JDaOPGJsuOARr51UmcQhN0DTv/wAn9nvSmI9eRNxX7cMxd4kwhkaPtpoPSyIgzxIAnquSHvKDQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-01T08:59:46.035226Z","bundle_sha256":"eee356bbafb2f90e5e16cc5c75b8e812100711ace0e9984a14fe219eeabe0236"}}