SemWeaver: Refining LLM-Generated Static Vulnerability Checkers with Analyzer-Internal Evidence
A plug-in refinement layer that selects evidence from static-analysis engines to help LLM-generated vulnerability checkers distinguish vulnerable code from fixed code.
Huazhong University of Science and Technology · Macquarie University
Read abstract
LLM-based patch-driven synthesis can automatically generate static vulnerability checkers from security fixes, but the resulting checkers often capture only the syntactic shape of the patch while missing the semantic conditions (path guards, state invariants, data-flow relations, and API contracts) needed to distinguish vulnerable code from fixed code. Existing refinement loops rely on behavioral feedback alone, which reveals symptoms but not causes, reducing refinement to prompt-level retry. We observe that static-analysis engines already compute the missing predicates as intermediate results during checker execution, yet these results are never exposed to the refinement process. Directly feeding all intermediate results to the LLM is impractical due to their volume and noise. SemWeaver is a plug-in refinement layer that bridges this gap through adaptive evidence selection: a patch-mechanism classifier identifies the bug category and collects only the relevant analyzer-native facts, which are then normalized with patch context and validation feedback into a typed semantic evidence bundle. A target-preserving gate ensures that each refinement preserves the vulnerable-side trigger while eliminating fixed-side warnings. We evaluate SemWeaver on real-world Linux kernel vulnerability patches. On 12 refinable KNighter derived CSA checkers, SemWeaver raises the patch-discriminating success rate from 0% to 91.7%. On 20 cross-backend detectors (CSA and CodeQL) from an independent generator, it achieves a 50% relative improvement. Ablation and model-robustness studies confirm the contribution of analyzer-native evidence beyond validation-only retry.