LLM Prefill Activations Reveal Code Vulnerabilities, Bypassing Post-Hoc Screening
A recent study published on arXiv (2608.16970) explores whether large language models (LLMs) disclose information about code vulnerabilities during the prefill phase. It points out a shortcoming in existing defenses that depend on post-generation analysis. The researchers propose that LLMs may encode signals of vulnerabilities within hidden activations while processing C/C++ code. They evaluated this by extracting prefill token activations from four models: Granite-4.1-8B, Qwen3.5-9B, Qwen3.6-27B, and Gemma-4-12B, employing lightweight MLP probes. These probes yielded an average F1 score of 41.7% across four benchmarks, with the top probe on Devign achieving 68.8%. The findings indicate the possibility of developing early detection systems, challenging the belief that vulnerability detection must happen after code generation.
Key facts
- The study uses latent activations from LLMs to detect code vulnerabilities.
- It focuses on the prefill stage, before any code is generated.
- Four models were tested: Granite-4.1-8B, Qwen3.5-9B, Qwen3.6-27B, and Gemma-4-12B.
- MLP probes were trained on last prefill token activations.
- Probes use 13.4–16.0M parameters, under 0.2% of base-model size.
- Evaluated on four C/C++ benchmarks: Devign, Big-Vul, Draper VDISC, PrimeVul.
- Average F1 score across all models and benchmarks is 41.7%.
- Best probe (Qwen3.5-9B) achieves 68.8% F1 on Devign, matching SOTA.
- Current defenses are post-hoc: static analyzers, classifiers, or LLM judges.
- The paper suggests vulnerability signals are encoded in hidden activations.
Entities
—