REVA: Real-Time Vulnerability Detection in a Single Forward Pass, 250× Faster

When Code Generation Outpaces Human Review: Vulnerability Detection Needs a "First Line of Defense"

The later a vulnerability is discovered, the more expensive it is to fix. This long-standing problem in software development has become even more acute with the widespread adoption of AI coding assistants—the speed at which coding agents generate code has far outpaced the speed at which developers can manually review it.

There are two traditional approaches. One is to have an LLM agent work like a security expert: running analysis tools, exploring surrounding code, validating hypotheses, and synthesizing evidence before making a judgment. This approach achieves decent accuracy, but the reasoning process spans multiple model calls, taking minutes of compute time per judgment—too slow for real-time screening. The other is to fine-tune a deep learning model or have the LLM give a direct judgment, which is fast but noticeably less accurate—because they lack the context that agents carefully collect, and even with partial context, judgments generated directly by LLMs are themselves not reliable enough.

REVA (REal-time Vulnerability Analysis), from a research team, attempts to break this dilemma: it compresses the security context and code understanding capabilities behind agent-based detectors into a single forward pass of an LLM.

How REVA Achieves "Fast and Accurate"

Context Injection: Front-Loading the Agent's Preparation Work

REVA's core insight is straightforward: the strength of agent-based detectors lies in context, and their weakness lies in the overhead of step-by-step reasoning. So, can we prepare the context but skip the reasoning process?

For each new function, REVA provides the LLM with three types of pre-built information: a precomputed threat model for the enclosing module, lightweight static analysis findings, and call graph information. These are exactly what an agent would actively collect during its exploration phase, but REVA injects them directly at runtime, eliminating the multi-turn interaction where the model has to "find clues" on its own.

Static analysis refers to techniques that infer program properties by parsing source code or bytecode without executing the program; common methods include data flow analysis, taint tracking, and control flow analysis. It can detect suspicious patterns at low cost—for example, unvalidated external input flowing directly into a dangerous function—but often comes with many false positives that require further vetting by humans or models. A call graph characterizes the caller-callee relationships between functions, helping determine whether a piece of code has already validated parameters upstream and who will use it downstream; it is fundamental to vulnerability reachability analysis. A threat model in this context refers to a structured description of what attacks a module might face and which data constitutes sensitive input; REVA precomputes it and injects it, effectively giving the model a prior of "what to pay attention to" before it reads the function. Together, these three form the contextual material that an agent would actively collect during its exploration phase.

Training a Probe to Read Internal Representations

Given a new function with context, REVA does not rely on the LLM to generate a textual verdict. Instead, it uses a trained probe to read the model's internal representation of the function under that context. This bypasses the unreliable step of having the LLM "express its judgment in natural language" and extracts safety signals directly from the representation layer.

A key conclusion emerges from the research: the LLM's internal representations already encode most of the information that agent-based detectors obtain only through reasoning. In other words, much of the intelligence gathered through reasoning steps is already "implicit" in the network activations once the model sees sufficient context.

A probe is a common technique in representation engineering: freeze all parameters of the large model and train only a lightweight classifier (such as a linear layer or a small MLP) on the activation vector of a certain layer to predict the target label. Because the probe has very few parameters, is cheap to train, and does not modify the original model, it can test whether "a certain type of information already exists in the model's internal representations." If a simple probe can achieve high accuracy, the relevant information is already linearly separable in the activations. REVA uses this to turn "judging whether a function is safe" into a classification task over hidden states, thereby bypassing autoregressive decoding—the model does not need to generate a conclusion token by token; it only needs a single forward pass to produce a representation, from which the probe reads the signal. This is also the key to keeping latency at the sub-second level.

Empirical Data: The Speed-Accuracy Trade-off Redefined

On the PrimeVul held-out test set, REVA paired with GLM-5.3-Flash achieves 60.0% accuracy at about one second per function.

The comparison is VulTriage—a state-of-the-art agent-based detector also running on GLM-5.3-Flash—with 59.2% accuracy. With comparable accuracy, REVA is over 250× faster and costs less than one-tenth as much.

Under the same prompt conditions, reading internal representations with a probe yields 14% to 17% higher accuracy than having the LLM give a direct verdict. This gap shows that the problem is not entirely about model capability but about the output format—having the model "state a conclusion" itself loses information.

In cross-model validation, on three open-source LLMs, REVA's accuracy is at least on par with VulTriage, and about 10% higher on two of them. This multi-source consistency indicates that the method does not depend on the characteristics of a specific model but leverages a general property of LLM representation layers.

Significance and Boundaries of This Work

The value of REVA is not just a new number. It proposes a paradigm worth attention: use probes instead of generation, and use precomputed context instead of multi-turn reasoning. If internal representations reliably carry the information needed for safety judgments, then real-time vulnerability screening is engineering-feasible—a throughput of one function per second is enough to embed into CI/CD pipelines and complete a first-pass filter before code is merged.

Of course, the results presented in the materials are concentrated on a single benchmark, PrimeVul, and an accuracy of around 60% is still far from perfect; probe quality depends on the coverage of the training data, and the quality of threat models and static analysis also propagates to the final judgment. For high-security codebases, REVA is better suited as an initial screening layer rather than a final arbiter.

A broader implication is that there may be substantial redundancy between an agent's "reasoning capability" and the model's "representation capability." When reasoning is used to collect context, a single forward pass combined with a probe may be able to take on a considerable portion of the work—this has reference value for all scenarios that require low-latency AI judgments.

PrimeVul is a function-level vulnerability detection benchmark proposed in recent years. Its distinguishing feature is stricter temporal splitting and deduplication/de-leakage processing to avoid duplicate or highly similar samples between training and test sets, thereby more realistically reflecting the model's generalization ability to unseen vulnerabilities. This is also why an accuracy of around 60% is already substantial on this benchmark—early datasets often reported inflated numbers above 90% due to data leakage. Understanding this helps correctly interpret the comparison between REVA and VulTriage: although the gap between the two on the same held-out set is small, the benchmark itself is harder, making the conclusion more informative. At the same time, it should be recognized that parity on a single benchmark is not enough to assert that the method is generally superior in real codebases; cross-dataset and cross-language validation remain necessary follow-up work.

One-line Summary

REVA uses pre-injected context plus a probe that reads LLM internal representations to achieve second-level vulnerability screening.

Paragraph Summary

The article introduces the vulnerability detection system REVA, aimed at addressing the predicament in the AI coding era where code generation outpaces human review. Traditional agent-based detection is accurate but requires multi-turn reasoning and takes minutes, while fast approaches sacrifice accuracy. REVA injects context such as threat models, static analysis findings, and call graphs into the LLM in one go, then uses a trained probe to read the model's internal representations rather than generating a textual verdict, completing the judgment within a single forward pass. On the PrimeVul held-out set, REVA paired with GLM-5.3-Flash achieves 60.0% accuracy, on par with the agent-based detector VulTriage's 59.2%, while being over 250× faster and costing less than one-tenth as much; probe-read representations yield 14% to 17% higher accuracy than direct verdict generation. The authors consider it suitable as an initial screening layer in CI/CD rather than a final arbiter.