NAVIGATE: Multi-Agent Graph-Based Vulnerability Detection with Adversarial Severity Assessment
Automated vulnerability severity assessment is critical for prioritizing security remediation efforts, yet existing approaches face significant challenges. Traditional text-based methods rely solely on vulnerability descriptions, lacking the technical depth present in source code. Meanwhile, Large Language Models (LLMs) have shown promise in code understanding but struggle with long input sequences and lack structured semantic information, leading to unreliable severity predictions. This paper presents NAVIGATE, a multi-agent graph-centric framework that synergizes Code Property Graphs (CPGs) with LLM-powered reasoning for automated vulnerability severity assessment. A key innovation is the deployment of an autonomous ReAct (Reasoning + Acting) agent with a documentation subagent for dynamic query generation, enabling the discovery of complex vulnerability patterns without relying on predefined static rules. Another core contribution is the adversarial multi-agent debate mechanism using AG2 (AutoGen 2), where Security Analyst, Red Team Expert, Blue Team Expert, and Severity Judge agents engage in structured deliberation to achieve consensus-based severity ratings. Our approach employs a multi-stage pipeline comprising: (1) CPG-based code representation, (2) dual-agent vulnerability discovery with context compression, (3) dataflow-guided slicing with Tree-sitter-based syntactic reconstruction, (4) LLM-based path filtering with Top-K selection, and (5) adversarial debate for CVSS v3-aligned severity classification. Experiments on a benchmark of 594 CVEs in C/C++ demonstrate that NAVIGATE achieves a severity classification accuracy of 72.73%, F1-score of 70.0%, and MCC of 0.544. Compared to the SVACL baseline [1] (63.47% accuracy), our dataflow-guided slicing approach—which uses Joern’s inter-procedural reachableByFlows analysis to extract vulnerability-relevant code paths—improves accuracy by 9.26 percentage points.
Paper
Full text
NAVIGATE: Multi-Agent Graph-Based Vulnerability Detection with Adversarial Severity Assessment
Semantic Scholar · 2026
Abstract
Automated vulnerability severity assessment is critical for prioritizing security remediation efforts, yet existing approaches face significant challenges. Traditional text-based methods rely solely on vulnerability descriptions, lacking the technical depth present in source code. Meanwhile, Large Language Models (LLMs) have shown promise in code understanding but struggle with long input sequences and lack structured semantic information, leading to unreliable severity predictions. This paper presents NAVIGATE, a multi-agent graph-centric framework that synergizes Code Property Graphs (CPGs) with LLM-powered reasoning for automated vulnerability severity assessment. A key innovation is the deployment of an autonomous ReAct (Reasoning + Acting) agent with a documentation subagent for dynamic query generation, enabling the discovery of complex vulnerability patterns without relying on predefined static rules. Another core contribution is the adversarial multi-agent debate mechanism using AG2 (AutoGen 2), where Security Analyst, Red Team Expert, Blue Team Expert, and Severity Judge agents engage in structured deliberation to achieve consensus-based severity ratings. Our approach employs a multi-stage pipeline comprising: (1) CPG-based code representation, (2) dual-agent vulnerability discovery with context compression, (3) dataflow-guided slicing with Tree-sitter-based syntactic reconstruction, (4) LLM-based path filtering with Top-K selection, and (5) adversarial debate for CVSS v3-aligned severity classification. Experiments on a benchmark of 594 CVEs in C/C++ demonstrate that NAVIGATE achieves a severity classification accuracy of 72.73%, F1-score of 70.0%, and MCC of 0.544. Compared to the SVACL baseline [1] (63.47% accuracy), our dataflow-guided slicing approach—which uses Joern’s inter-procedural reachableByFlows analysis to extract vulnerability-relevant code paths—improves accuracy by 9.26 percentage points.