SecRAG: A Retrieval-Augmented and LLM-Driven Framework for Function Level Code Vulnerability Detection and CWE Classification

Abstract

Static code vulnerability detection and CWE classification are fundamentally chal lenging due to noisy labels, skewed distributions, and a lack of grounded evidence in model predictions. Traditional fine-tuning of Pre-trained Language Models (PLMs) incurs significant time and resource costs and is not easily expandable to dynamic or newvulnerabilitycategories. WeintroduceSecRAG,atwo-stage,retrieval-augmented LLM powered framework that overcomes this limitation for interpretable, function level vulnerability analysis. Stage I (Data Curation & Diagnostics) establishes a high integrity, CWE-awareknowledgebasebymergingandrepairingBigVulandPrimeVul data. This involved deduplication, rebalancing non-vulnerable samples, and select ing only well-supported categories, resulting in a 22k+-sample corpus spanning 12 CWEclasses. Diagnostics selected UniXcoder as the optimal embedding model (Vul nerability F1 of 74.65%) over CodeBERT and GraphCodeBERT. Stage II (RAG Infer ence) uses UniXcoder embeddings to retrieve the top-3 nearest vulnerable neighbors, which are then used to constrain downstream LLMs (GPT-4.1, Llama-3.3-70B, etc.) with a parseable prompt schema for final binary and multi-class predictions. Empiri cally, SecRAG significantly improves CWE-level classification performance over fine tuned PLM baselines. For instance, GPT-4.1 achieved a CWE Accuracy of 61.37%—a substantial improvement over the best-performing baseline (UniXcoder at 53.26%). The retrieval mechanism preserves competitive binary detection and yields comple mentary strengths: GPT-4.1 excels in CWE accuracy (61.37%) and Precision (59.69%), while GPT-4o mini offers stronger vulnerability Recall (79.95%). By leveraging clean, CWE-aware retrieval coupled with constrained LLM generation, SecRAG delivers a reproducible, interpretable, and dynamically updatable pipeline where predictions are directly grounded in retrieved evidence