Antaeus: Hunting Repository-Level Logic Vulnerabilities via Context-Grounded LLM Reasoning

Abstract: LLM-based vulnerability detectors have shown promising results in identifying memory-safety bugs and vulnerability classes whose violations can often be expressed through established security properties. Logic vulnerabilities, however, pose a different challenge, as their identification requires inferring application-specific security invariants and implicit assumptions about intended behavior. Even frontier agentic models struggle because these invariants are often implicit and buried among unrelated code. Motivated by this gap, we present Antaeus, a framework for detecting logic vulnerabilities that grounds LLM reasoning in repository-level code context. Antaeus follows a repository-scale pipeline combining function prioritization, context-grounded reasoning, comparative validation, and structured reporting. It ranks functions using lightweight repo-wide security signals, directing costly LLM analysis toward relevant code and reducing calls, cost, and triage effort. For each prioritized function, Antaeus combines local code context with a repository-level view of the application's functionality, security resources, and trust boundaries. This enables reasoning about how the function is executed within the broader application rather than as an isolated snippet. Antaeus identifies security-sensitive sinks, derives safety conditions for safe execution, and checks whether they are locally satisfied. Candidate findings undergo comparative validation, pruning concerns that reflect project-wide norms rather than distinctive violations. Finally, Antaeus reports sinks, violated safety conditions, and evidence, making findings actionable and traceable. We evaluate Antaeus on 28 repositories with confirmed logic vulnerabilities and compare it against function-level and agentic models. Antaeus detects and explains 15 vulnerabilities, outperforming baselines with comparable token usage and cost.

• The paper presents Antaeus, a five-stage, structured LLM pipeline that leverages both local and repository-wide context to detect logic vulnerabilities in code.
• It integrates heuristic prioritization and contextual grounding to reduce analysis workload by ~30x while maintaining high recall and precise safety evaluations.
• Empirical results on 28 real-world C/C++ repositories show that Antaeus outperforms function-level and agentic baselines with clear, evidence-backed vulnerability reports.

Antaeus: A Repository-Level LLM-Grounded Framework for Logic Vulnerability Detection

Problem Statement and Motivation

Detection of logic vulnerabilities (LVs) in code repositories, especially for systems software (e.g., C/C++), presents an orthogonal challenge to traditional vulnerability detection. LVs such as CWE-284 (improper access control) and CWE-200 (information exposure) arise not from syntactic errors or explicit dataflow violations but from the failure to enforce application-specific security invariants spread across distributed and implicit repository semantics. Existing automated solutions—static analyzers, pattern-driven, or taint-based tools—are effective where syntactic anchors exist but fail for LVs because the critical evidence is encoded non-locally and often only implicit in codebase-wide conventions.

LLM-based detection approaches have shown success for concrete bug classes but perform poorly for LVs. Agentic LLM systems that traverse and analyze repositories often waste resources on irrelevant code and lack the semantic anchoring to reconstruct non-local security invariants. Function-level LLM analysis lacks the project context required for LV detection and yields low recall/precision. The central hypothesis of this work is that structured, context-grounded LLM reasoning guided by repository-wide evidence and coupled with multi-stage analysis is necessary for scalable, effective logic vulnerability detection.

Pipeline Overview

Antaeus is architected as a five-stage repository-level pipeline: prioritization, context-grounding, structured LLM reasoning, validation, and reporting.

Figure 1: Overview of the Antaeus five-stage pipeline: prioritization, context-grounding, structured reasoning, validation, and reporting.

1. Prioritization

To avoid exhaustive and inefficient function-by-function analysis, Antaeus deploys a high-recall, lightweight pre-analysis stage that heuristically prunes uninteresting code (based on file types, keywords), constructs abstract function-level summaries (signatures, callees), and allows an LLM to globally rank likely security-relevant candidates. This process yields a $\sim$30x reduction in the number of functions for in-depth analysis compared to a naïve approach, while retaining high recall of potentially vulnerable code.

2. Contextual Grounding

Each prioritized function is augmented with a local program context (including direct callees, macro/constant expansions, relevant typedefs, and imports) extracted via lightweight static analysis (Tree-sitter). Crucially, this evidence is supplied explicitly, ensuring the LLM can ground semantics in actual project definitions rather than relying on potentially misleading prior knowledge.

In parallel, a repository-level security context bundle is extracted per repository. This bundle encapsulates the application’s domain semantics: purpose, principal/actor model, protected objects, information outputs, and trust boundaries. It is constructed via repository-wide LLM analysis and attached to all subsequent function-level reasoning steps, providing the semantic substrate necessary for LV detection.

3. Structured LLM Reasoning

Rather than free-form vulnerability classification, Antaeus prompts LLMs to output structured findings per function, including:

• Sinks: Security-sensitive operations as inferred from code and context (not fixed APIs).
• Safety Conditions: Precise predicates that must be satisfied for each sink, along with evidence-backed satisfaction judgments.
• Justification: Citations to specific code artifacts that support (or undermine) the safety argument.

A candidate vulnerability is surfaced only when at least one safety condition for a sink is violated and supported by explicit evidence.

4. Comparative Validation

LVs are definitionally anomalies—project-specific deviations from otherwise uniformly enforced invariants. Antaeus quantitatively validates each flagged safety condition by comparing it against structurally and semantically similar sinks across the repository. This comparative validation utilizes UniXcoder and transformer-based code/condition embeddings, calibrated per-repository to avoid spurious elimination in heterogeneous or duplicated codebases. Conditions that recur uniformly are classified as project norms (false positives) and pruned; only distinctive anomalies persist.

5. Structured Reporting

Only evidence-grounded, validated findings are retained. Antaeus outputs machine-readable, auditable reports specifying function, sink, violated safety condition, and supporting contextual evidence. This format enables downstream triage, aggregation, and human-in-the-loop auditability while maximizing transparency.

Empirical Evaluation

Antaeus was evaluated on 28 real-world C/C++ repositories from ReposVul, each annotated with a confirmed CWE-200/284 logic vulnerability (CVEs). No prior knowledge of the vulnerability was disclosed to Antaeus during analysis.

Effectiveness

• Using Claude Opus 4.7, Antaeus detected and explicitly explained 15/28 CVEs; with GPT-5.4, it detected 12/28. Detections require that both the correct sink and the rationale—that is, the violated invariant—match the CVE, not merely function overlap.
• In contrast, function-level baselines (no grounding or validation) only recovered 4–5/28, even with state-of-the-art models (Opus 4.8, GPT-5.4).
• Agentic baselines (which allow LLMs to traverse repositories autonomously with/without Antaeus’s prioritization) detected 3–5 CVEs, but at higher cost or with more muted yield.

Resource Efficiency

Despite suppling orders-of-magnitude more relevant context, Antaeus operates within practical analysis budgets:

• Total API spend across 28 repos is approximately \$440, with marginal cost per detected vulnerability ($\sim$\$30) substantially below non-pipelined agentic baselines.
• Prioritization and validation sharply bound the triage and computation costs, as opposed to broad agentic search or function-level analysis.

Ablation

• Removing either local augmentation or repository context halves recall, demonstrating their necessity and non-redundancy.
• Disabling comparative validation increases false positives by 20–26% with no gain in recall.

Implications and Limitations

Antaeus empirically demonstrates that repository-structured, context-grounded LLM reasoning is essential for practical LV detection in real repositories. The pipeline outperforms both function-level and agentic LLM baselines in recall while maintaining resource efficiency and triage tractability.

However, the framework makes several tradeoffs:

• It is tuned for LV classes that can be decomposed as sink-plus-safety-condition; classes requiring explicit state-machine or workflow modeling (multi-step protocol/transaction invariants) remain outside scope.
• Local grounding is intentionally shallow (callee depth 1); deeper contexts may be required for certain invariants and could be traded off with cost.
• Project-level context assumes recoverability from code, a limitation when semantics are only in documentation/config.
• Effectiveness is sensitive to prompt design and the quality of function prioritization.

Future Directions

Scaling Antaeus to new languages, repository types (e.g., proprietary enterprise code), and broader logic vulnerability classes is promising, given the language-agnostic pipeline structure. Integrating explicit stateful reasoning, leveraging more advanced representation learning for repository context, and further optimizing prioritization and validation are natural extensions. Increased automation and validation will be essential for deployment at enterprise or supply-chain scale.

Conclusion

Antaeus offers a practical, highly structured solution for detecting repository-level logic vulnerabilities using LLMs. By grounding reasoning in both local and repository-scale evidence, tightly integrating prioritization and post-hoc anomaly validation, and insisting on structured, rationale-backed findings, Antaeus achieves detection rates previously unattainable by LLM-based approaches for this vulnerability class. Structured, context-grounded frameworks such as Antaeus are essential for harnessing LLMs in complex security reasoning at realistic, practical cost profiles.

---

Reference

For further technical depth, full descriptions, benchmarks, limitations, and future work, refer to "Antaeus: Hunting Repository-Level Logic Vulnerabilities via Context-Grounded LLM Reasoning" (2607.01138).