Samridh Anand

Research

Published at ICCCT 2025 (International Conference on Computer and Communication Technology).

Springer · 2025

A Multi-Agent RAG Framework for Automated Source Code Vulnerability Detection and Repair

Samridh Anand, Sakshi S, Samritha R, Samarth S I, Shruthi L. PES University, Bengaluru.

Read the paper

Problem

Manual code review is slow, static analysers raise many false positives, good real-world vulnerability datasets are scarce, and most tools stop at detection and leave the fix to a developer.

Approach

Three specialised LLM agents cooperate: one identifies attack vectors, one confirms a specific CWE, one writes the fix. A ChromaDB knowledge base of MITRE's Top 25 CWEs, embedded with all-MiniLM-L6-v2, grounds each step to reduce hallucination. The loop repeats until no vulnerability remains or an attempt limit is reached. Output is structured JSON with explicit validation.

Results

Evaluated on 92 C and C++ samples from CVEFixes, against a single-LLM baseline without RAG or agents.

Multi-agent RAG framework for vulnerability detection and repair C and C++ source goes through three LLM agents in turn: attack vector identification, vulnerability detection and remediation. The loop repeats until no vulnerabilities remain or an attempt limit is reached, then outputs patched code. Detection and remediation retrieve context from a ChromaDB store built from MITRE's Top 25 CWEs. Source codeC and C++ Attack vector agentfinds potential weaknesses Detection agentconfirms a specific CWE Remediation agentwrites the secure fix Patchedcode repeat until no vulnerabilities remain or the attempt limit is reached MITRE Top 25 CWEsdescriptions, mitigations, examples Embedding modelall-MiniLM-L6-v2 ChromaDBvector knowledge base retrieved context groundsdetection and repair Agents run on Gemini 1.5 Flash; structured JSON output is validated at each step.
Framework overview, redrawn from the paper's method: three LLM agents in a repair loop, grounded by retrieval over MITRE's Top 25 CWEs.
MetricMulti-agent + RAGSingle LLMChange
Correct predictions45 / 9228 / 92+60.71%
Incorrect predictions33 / 9238 / 92-13.16%
System errors14 / 9226 / 92-46.15%

Limitations

  • Weaker on authorisation and privilege escalation flaws that need project-wide context.
  • Occasional JSON escaping problems with special characters in structured output.
  • Scoped to MITRE's Top 25 CWEs; 3 to 10 seconds per function.