Probing the Prefill: Detecting Code Vulnerabilities via Latent Activations

August 19, 2026 | Source: arXiv AI

Tags: code-security, LLM-probing, vulnerability-detection, Qwen, Granite, Gemma, C++

Researchers show LLM hidden activations encode vulnerability signals in code — tiny MLP probes (under 0.2% of model size) trained on frozen LLM activations match fine-tuned SOTA classifiers on the Devign benchmark (68.8% vs 67.9% F1).

Details

This paper tests a specific, narrow question: when an LLM reads C/C++ code as context, do its hidden states already contain vulnerability information? The answer, at least for one benchmark, appears to be yes. MLP probes trained on last-prefill-token activations from four frozen LLMs (Granite-4.1-8B, Qwen3.5-9B, Qwen3.6-27B, Gemma-4-12B) achieve 41.7% average F1 across four C/C++ vulnerability benchmarks — and on Devign specifically, Qwen3.5-9B achieves 68.8% F1, matching published fine-tuned-classifier SOTA (67.9%). The probes are extremely lightweight: 13.4–16.0M parameters, under 0.2% of the base model size. This matters practically — it suggests that vulnerability screening could be embedded as a near-zero-cost forward pass on top of an existing coding model rather than requiring a separate specialized classifier. Results are uneven: the harder benchmarks (Big-Vul, Draper VDISC, PrimeVul) show the probes trailing SOTA substantially. The authors are careful to frame this as early evidence rather than a complete solution. The finding opens a path toward model-native vulnerability screening that doesn't require fine-tuning or external tools.