Paper deep dive

Refute-or-Promote: An Adversarial Stage-Gated Multi-Agent Review Methodology for High-Precision LLM-Assisted Defect Discovery

Abhinav Agarwal

Year: 2026Venue: arXiv preprintArea: cs.CRType: PreprintEmbeddings: 49

Intelligence

Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 98%

Last extracted: 4/26/2026, 10:43:27 PM

Summary

The paper introduces 'Refute-or-Promote', an adversarial, stage-gated multi-agent methodology designed to improve the precision of LLM-assisted defect discovery. The system uses a four-stage pipeline: Stratified Context Hunting (SCH) for candidate generation, two stages of adversarial code review (Stages A and B) with context asymmetry, an empirical validation gate (Stage C), and a Cross-Model Critic (Stage D). The methodology aims to reduce the high false-positive rates typical of LLM-generated reports by employing 'kill mandates' where agents attempt to disprove candidates. The system was evaluated across seven targets (including OpenSSL, lcms2, and wolfSSL), achieving a ~79% aggregate kill rate of false positives and resulting in several real-world outcomes such as CVEs and ISO C++ contributions. A notable failure case involved 80+ agents unanimously endorsing a non-existent Bleichenbacher padding oracle in OpenSSL, which was only caught by empirical testing.

Entities (8)

Bleichenbacher padding oracle · vulnerability-type · 100%Cross-Model Critic · mechanism · 100%ISO C++ Standard · standard · 100%lcms2 · software-library · 100%OpenSSL · software-library · 100%Refute-or-Promote · methodology · 100%Stratified Context Hunting · mechanism · 100%wolfSSL · software-library · 100%

Relation Signals (4)

Refute-or-Promote → identifieddefectin → OpenSSL

confidence 100% · our subsequent campaign on the same codebase identified CVE-2026-34183.

Refute-or-Promote → uses → Stratified Context Hunting

confidence 100% · combining Stratified Context Hunting (SCH) for candidate generation

Refute-or-Promote → uses → Cross-Model Critic

confidence 100% · and a Cross-Model Critic (CMC).

Bleichenbacher padding oracle → wasfalsepositivein → OpenSSL

confidence 100% · ten dedicated reviewers unanimously endorsed a non-existent Bleichenbacher padding oracle in OpenSSL's CMS module

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:LLM-assisted defect discovery has a precision crisis: plausible-but-wrong reports overwhelm maintainers and degrade credibility for real findings. We present Refute-or-Promote, an inference-time reliability pattern combining Stratified Context Hunting (SCH) for candidate generation, adversarial kill mandates, context asymmetry, and a Cross-Model Critic (CMC). Adversarial agents attempt to disprove candidates at each promotion gate; cold-start reviewers are intended to reduce anchoring cascades; cross-family review can catch correlated blind spots that same-family review misses. Over a 31-day campaign across 7 targets (security libraries, the ISO C++ standard, major compilers), the pipeline killed roughly 79% of 171 candidates before advancing to disclosure (retrospective aggregate); on a consolidated-protocol subset (lcms2, wolfSSL; n=30), the prospective kill rate was 83%. Outcomes: 4 CVEs (3 public, 1 embargoed); LWG 4549 accepted to the C++ working paper; 5 merged C++ editorial PRs; 3 compiler conformance bugs; 8 merged security-related fixes without CVE; an RFC 9000 errata filed under committee review; and 1+ FIPS 140-3 normative compliance issues under coordinated disclosure -- all evaluated by external acceptance, not benchmarks. The most instructive failure: ten dedicated reviewers unanimously endorsed a non-existent Bleichenbacher padding oracle in OpenSSL's CMS module; it was killed only by a single empirical test, motivating the mandatory empirical gate. No vulnerability was discovered autonomously; the contribution is external structure that filters LLM agents' persistent false positives. As a preliminary transfer test beyond defect discovery, a simplified cross-family critique variant also solved five previously unsolved SymPy instances on SWE-bench Verified and one SWE-rebench hard task.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

48,673 characters extracted from source content.

Expand or collapse full text

Refute-or-Promote: Adversarial Stage-Gated Multi-Agent Review for High-Precision LLM-Assisted Defect Discovery Abhinav Agarwal April 2026 Abstract LLM-assisted defect discovery has a precision crisis: plausible-but-wrong reports overwhelm maintainers and degrade credibility for real findings. We present Refute- or-Promote, an inference-time reliability pattern com- bining Stratified Context Hunting (SCH) for candidate generation, adversarial kill mandates, context asymme- try, and a Cross-Model Critic (CMC). Adversarial agents attempt to disprove candidates at each promotion gate; cold-start reviewers are intended to reduce anchoring cascades; cross-family review can catch correlated blind spots that same-family review misses. Over a 31-day campaign across 7 targets (security li- braries, the ISO C++ standard, major compilers), the pipeline killed∼79% of∼171 candidates before advancing to disclosure (retrospective aggregate); on a consolidated- protocol subset (lcms2, wolfSSL;n= 30), the prospec- tive kill rate was 83%. Outcomes span three eviden- tiary states: public, accepted, or assigned under embargo (4 CVEs [3 public, 1 embargoed]; LWG 4549 accepted to the ISO C++ Working Paper; 5 merged ISO C++ editorial PRs; 3 compiler conformance bugs; 8 merged security-related fixes without CVE); filed under review (an RFC 9000 errata); and under coordinated disclo- sure (one or more FIPS 140-3 normative compliance issues)—evaluated by external acceptance signals (main- tainer merge, CVE assignment, standards-body accep- tance, vendor coordination), not benchmarks. The most instructive failure: ten dedicated review- ers unanimously endorsed a non-existent Bleichenbacher padding oracle in OpenSSL’s CMS module; it was killed only by a single empirical test, motivating the manda- tory empirical gate. No vulnerability was discovered autonomously; the contribution is external structure that filters LLM agents’ persistent false positives. As a prelim- inary transfer test beyond defect discovery, a simplified cross-family critique variant also solved five previously unsolved SymPy instances on SWE-bench Verified and one SWE-rebench hard task. 1 Introduction LLMs can identify genuine vulnerabilities in production software [1,39], yet their practical deployment faces unacceptable false-positive rates on real-world codebases [4, 5]. Open-source maintainers have described the influx of LLM-generated reports as a denial-of-service attack [6,7]: curl’s bug bounty program was permanently closed after AI-generated submissions drove the confirmed rate below 5%, and HackerOne paused the Internet Bug Bounty programme in March 2026 citing AI-amplified submission volume overwhelming triage capacity [42]. The core problem is that LLMs are optimised for plausi- bility, not correctness. We encountered this at every sever- ity level, from minor misclassifications to a case where 80+ agents—including dedicated adversarial reviewers— unanimously endorsed a Bleichenbacher padding oracle in OpenSSL’s CMS module that did not exist (§4.2). Refute-or-Promote. We propose adversarial stage- gated multi-agent review, a methodology in which comple- mentary mechanisms—adversarial kill mandates, context asymmetry, a Cross-Model Critic (CMC), and empiri- cal validation—are intended to target distinct classes of false positives that cooperative debate may not catch. Adversarial framing alone is insufficient: the methodol- ogy’s most instructive failure was killed not by better adversarial framing but by a single empirical test. Complementarity with coverage-oriented sweeps. Our methodology is precision- rather than coverage- oriented: after AISLE’s January 2026 sweep reported 12 OpenSSL CVEs [16], our subsequent campaign on the same codebase identified CVE-2026-34183. Discovery came from the pipeline’s scope-partitioned, self-critiquing candidate generation (prior-defect research, git-hotspot targeting, iterative re-seeding); the refute-or-promote stages then filtered the candidate to disclosure-ready precision. Coverage-oriented sweeps, diversity-oriented candidate generation, and adversarial filtering appear complementary rather than substitutes. Contributions. 1.The Refute-or-Promote methodology: a four-stage adversarial pipeline with architectural requirements for Stratified Context Hunting (SCH) for candidate generation, adversarial kill mandates, a Cross-Model Critic (CMC), context asymmetry, and a manda- tory validation gate. Each stage runs parallel cre- 1 arXiv:2604.19049v1 [cs.CR] 21 Apr 2026 ative (false-negative reduction) and adversarial (false- positive reduction) tracks evaluated jointly before promotion. Presented as a retrospective codification of practice that evolved across the campaign rather than a preregistered protocol. 2.Real-world evaluation: 36+ outcomes across 7 tar- gets, spanning three evidentiary states—public, accepted, or assigned under embargo (3 public CVEs [libfuse×2, lcms2], 1 CVE under embargo [OpenSSL], 1 LWG defect accepted into the ISO C++ Working Paper, 5 merged ISO C++ editorial PRs, 3 compiler conformance bugs, 8 merged security- related fixes without CVE [two of which, on wolfSSL, have a disputed CVE status]); filed under review (1 RFC 9000 errata); and under coordinated disclo- sure (1+ FIPS 140-3 normative compliance issues)— evaluated by external acceptance signals (maintainer merge, CVE assignment, standards-body acceptance, vendor coordination), not benchmarks. 3. Quantitative false-positive analysis:∼79% aggre- gate retrospective kill rate, 83% prospective kill rate on the consolidated-protocol subset (n= 30), front- loaded per-stage kill rates (Stage A∼63% of entrants, Stage B∼42% of survivors; apparent per-stage spe- cialisation is not validated by leave-one-out ablation), and CVSS calibration data showing adversarial re- view adjusted severity scores downward in 8 of 9 cases. 4.Honest failure reporting: the CMS Bleichenbacher false positive (80+ agents wrong, killed by one test); the resurrected lcms2CubeSize()finding that became CVE-2026-41254 despite unanimous kill (unanimity-as-warning in both directions); two methodology regressions under domain transfer; and the protocol-evolution confounder. 2 Related Work LLM-assisted vulnerability discovery. Big Sleep [1, 2,37,38] is a production single-agent system; it isolated SQLite CVE-2025-6965 from threat-intelligence indica- tors before in-the-wild exploitation, with no adversar- ial self-critique. DeepMind’s CodeMender [41] pursues agentic detect-and-patch under human review. RepoAu- dit [40] is a single-agent auditor with a validator module. Heelan [39] documents the first publicly-reported single- LLM zero-day (CVE-2025-37899, Linux ksmbd UAF via o3) with an approximate 28% FP rate—empirical ground- ing for the false-positive problem. AISLE [16] reports 100+ CVEs without published pipeline architecture or FP rates. Frontier capability demonstrations—Anthropic’s zero-day evaluation [20], Claude Mythos [27,28], and OpenAI’s GPT-5.4-Cyber via the Trusted Access for Cy- ber programme [21,29]—shift the open question from “can LLMs find bugs” to “can we verify findings at the precision required for responsible disclosure.” Multi-agent debate and ensembles. Reflexion [43] and Self-Refine [44] established the iterative-refinement paradigm using same-model self-critique; Irving et al. [45] foundationally proposed debate for AI alignment. Refute- or-Promote differs: the critic carries a kill mandate rather than an improve/evaluate mandate, uses cross-family reviewers to catch shared-prior blind spots, and oper- ates over a context-isolated view. Debate improves fac- tuality [8] and helps non-expert judges [9], but naive debate can also diminish accuracy [10]. Song [11,12] independently showed that fresh-context review outper- forms same-session review (p= 0.008) and that addi- tional rounds degrade quality—directly supporting our stage-gated design. POPPER [13] is a Popperian falsifica- tion framework with formal statistical control. Mixture- of-Agents [36] aggregates heterogeneous outputs; Self- MoA [35] counters that same-model repeated sampling beats heterogeneous MoA by 6.6%. Our kill-mandate gating is structurally distinct from aggregation-style en- sembles. Kim et al. [30] empirically document that LLMs agree∼60% of the time when both err, with correlation increasing with model capability—establishing the empir- ical basis for our cross-family (not merely cross-instance) design. Concurrent industry work [34] applies adversarial consensus to malware-analysis tool reconciliation. AEGIS and VulTrial. AEGIS [3] and VulTrial [15] employ dialectic (AEGIS: verifier arguments-for-and- against + audit veto) and role-play (VulTrial: prose- cutor/defense mock-court) structures that converge to a verdict rather than assign a pure destruction mandate; both use single model families and evaluate on bench- marks. Our work adds hard adversarial kill mandates (destruction, not convergence), cross-model heterogene- ity, real-world CVE discovery, and systematic failure documentation. Other multi-agent vulnerability-detection systems. IRIS [17] (LLM + static analysis), MAVUL [18] (analyst– architect feedback), and VulAgent [19] (perspective- specialised scanning + hypothesis validation) are recent systems; all treat proposer output as a claim to verify or refine rather than falsify, none use cross-family reviewers, and all evaluate on benchmarks. LLM-based false-positive reduction. Concurrent work applies LLM agents to filter SAST tool alerts [24,25]. These systems filter candidates with deterministic rule provenance from static analysers—a structurally different problem from filtering candidates with probabilistic LLM provenance, where the generator and evaluator share the same training-data biases. Recent work also confirms cooperative debate’s fragility: a single persuasive agent can override majority-vote mechanisms [26], a structural failure that Refute-or-Promote’s context isolation was designed to prevent. 2 Contemporaneous adversarial and multi-agent work. Several recent systems sharpen the position of Refute-or-Promote. Denisov-Blanch et al. [46] and Jain et al. [50] both motivate falsification-first or minority-veto protocols over vote-style consensus—Jain quantifies the agreeableness bias (96% TPR,<25% TNR) and shows minority-veto beats a 14-LLM ensemble by 2×. Our kill- gate is the architectural analogue. The closest adversarial comparator is InfCode [47] (79.4% on SWE-bench Veri- fied via a symmetric patch/test dual-agent loop within a single model family); Refute-or-Promote differs in ways we hypothesise to be important—asymmetric roles, cross- family reviewers, and context asymmetry as a pillar (see Table 1). SWE-Debate [48] pursues convergent multi- agent debate in the same SWE-bench setting; Refute-or- Promote explicitly forbids convergence-by-debate. Ar- gus [49] likewise targets multi-agent CVE discovery but as a cooperative RAG+ReAct ensemble rather than an adversarial gate. D3 [51] provides theoretical grounding for adversarial role specialisation; Refute-or-Promote re- stricts reviewers to a pure prosecution role rather than two-sided advocacy. Finally, CVE-GENIE [52] repro- duces known CVEs at $2.77/CVE (a different task from our discovery-and-disclosure pipeline; see §4). Position summary. Table 1 summarises architectural differences across the closest adjacent adversarial and multi-agent systems we identified; it is not an exhaus- tive field survey. Among published field methodologies we found, Refute-or-Promote appears to be the first to combine (i) Stratified Context Hunting for candidate gen- eration, (i) hard adversarial kill mandates, (i) a Cross- Model Critic (CMC), (iv) cold-start context asymmetry, and (v) a mandatory validation gate (empirical tests for security findings, implementation-divergence or commit- tee acceptance for spec findings)—evaluated on real-world defect discovery with external institutional acceptance artifacts (4 CVEs, LWG 4549, merged ISO C++ editorial PRs, merged OpenSSL PRs, GCC/MSVC conformance bugs) rather than benchmarks. Jain et al. [50] inde- pendently apply cross-family, context-isolated review to LLM-as-judge evaluation but without candidate genera- tion, a kill-mandate architecture, or an execution-grade oracle. 3 Methodology Retrospective codification. Refute-or-Promote is presented in its final standardised form: a four-stage ad- versarial protocol distilled retrospectively from iterative real-world campaigns rather than deployed as a fixed pre- registered workflow from the outset. Earlier campaigns (libfuse, OpenSSL) operated with less structure—findings emerged from substantial manual prompting and evolving agent configurations, with rules written down after each failure mode surfaced. Later campaigns (lcms2, wolf- SSL) applied the consolidated protocol more uniformly. The codification process itself—56 rules distilled from OpenSSL failures,∼30 transferring directly to wolfSSL (learning loop below)—is reported as observational con- text: this paper is a field study of methodology evolution plus real-world outcomes, not a preregistered evaluation of one fixed pipeline. Individual campaigns further used class-specific prompt configurations (security-bug hunting, FIPS conformance, spec review, compiler divergence) tai- lored to each domain’s validation oracle; the four stages capture the shared architectural pattern—parallel cre- ative/adversarial tracks, context asymmetry, cross-model verification, empirical gate—not a single uniform prompt template. The pipeline consists of seven phases: Prepare condi- tions the target; Candidate Generation seeds parallel hunters with diverse, scope-partitioned context; four ad- versarial stages (A–D) apply escalating kill pressure; and Disclosure prepares reports under continued ad- versarial review. Inter-stage routing is executed by the orchestrator agent per the protocol; a human reviews the final disclosure-ready findings and handles overrides (target selection, resurrection of unanimously-killed can- didates, severity negotiation). Prepare phase. Before any candidate generation, the target is conditioned by three steps: (1) checkout of the latest stable release branch rather than mainline HEAD— maintainers routinely reject findings against unreleased code, and the branch discipline aligns the campaign with what downstream distributions actually ship; (2) three parallel research agents compile historical CVEs from the target repository, sibling libraries, and structurally similar codebases, producing a prior-art brief that is fed to downstream hunters; and (3) agit loghotspot analysis identifies the most-edited code regions in the past twelve months, prioritising churn-heavy subsystems as attack surface. Steps (2) and (3) run concurrently. Candidate Generation: Stratified Context Hunt- ing (SCH). We name the candidate-generation mech- anism Stratified Context Hunting (SCH): three or more hunters are dispatched in parallel and stratified along three orthogonal axes. Source-stratified—each hunter is primed with a distinct context slice (prior defects, git hotspots, normative spec text, bug-archetype check- lists). Scope-stratified—each hunter is scoped to a non- overlapping subsystem (e.g., memory-safety paths, pars- ing logic, deep-format handlers, pixel/transform code). Wave-stratified—generation runs iteratively; after one to three candidates pass through the refute-or-promote stages, hunters are re-seeded with concrete learnings from the completed analyses (which candidates were promoted, which were killed as red herrings, and the specific rea- soning that distinguished them), so later waves exploit promoted patterns and avoid previously-killed failure classes. Each hunter must self-critique before reporting: 3 Table 1: Architectural comparison with adjacent adversarial/multi-agent LLM systems. MethodCand. gen.? Adversarial? Cross-family? Context-iso.? Empirical? Real-world? InfCode [47]✗✓ (sym.)✗✓✗ SWE-Debate [48]✗✓ (conv.)✗✓✗ Argus [49]P✗ (coop.)✗P✓ AEGIS [3]✗P (dialectic)✗ VulTrial [15]✗P (mock-court)✗ CVE-GENIE [52]P (repro.)✗✓ (PoC)✗ (repro.) Jain et al. [50]✗P (judge-vote)✓✗ Refute-or-Promote (ours)✓ (iter.)✓ (kill)✓ ✓=explicit design property;✗=absent; P=partial. “Cand. gen.” = scope-partitioned iterative candidate generation (past-defect research, git-hotspot targeting, re-seeding from prior kills). “Empirical” = empirical/runtime validation gate (tests, PoC, or equivalent). “Real-world” = evaluation includes externally-accepted artifacts beyond benchmarks (CVEs, merged upstream PRs, accepted standards-body defects, vendor advisories). For benchmark issue-resolution baselines (InfCode, SWE-Debate), candidate generation is out of scope because the benchmark supplies the issue. for every candidate it identifies, the agent is required to ar- ticulate why the candidate might not be exploitable. Per- candidate state is persisted on-disk to preserve it across sessions and keep pre-kill context out of adversarial-agent prompts. Stages A and B (Adversarial code review). Each of the first two stages runs two concurrent tracks: a creative track that argues the candidate is a vulnerability—developing the exploitation path to reduce false negatives—and an adversarial track that argues it is not, attacking reachability, preconditions, and plau- sible triggers to reduce false positives. Both tracks run in parallel on fresh contexts; the orchestrator evaluates them jointly before promotion. Stage A dispatches one creative agent and two adversarial agents; adversarial agents receive only the candidate claim, not the creative agent’s reasoning, preventing anchoring on the advo- cate’s framing. A candidate survives Stage A only if no adversarial agent produces a code-grounded refutation and the creative agent produces a plausible exploitation argument. Stage B escalates to two creative and three adversarial agents, with one adversarial agent drawn from a senior model tier. On the creative side, both agents argue exploitability with different context depths (one full synthesis, one cold-start). On the adversarial side, deliberate context asymmetry splits the attackers into an informed attacker (full synthesis), a naive attacker (claim only), and a senior-tier agent with a selective summary. Cold-start agents that independently reach a different conclusion—on either track—provide higher-value signal than consensus among informed agents. Stage C (Validation & Impact Calibration). Em- pirical validation gate: no candidate reaches disclosure without empirical confirmation. Where local reproduc- tion was infeasible (platform-specific triggers, resource- heavy PoCs, or production-like environments), back- ground agents under orchestrator control provisioned cloud VM instances to execute PoCs, extending empiri- cal validation beyond what a single-workstation pipeline could reach. Surviving candidates then undergo adver- sarial CVSS recalibration—adversarial agents systemati- cally corrected overclaimed severity scores downward in 8 of 9 measured cases. Candidates with strong theoret- ical arguments but no empirical confirmation advance provisionally to Stage D but are flagged. Stage D (Cross-Model Critic). We name this stage’s mechanism the Cross-Model Critic (CMC): one or more agents from a different model family receive minimal context (a candidate summary and entry points) and perform an independent critique. CMC complements the same-family adversarial critique of Stages A and B: same- family critics catch reasoning errors a single agent missed, while the cross-family critic catches correlated training- data errors that same-family review tends to miss when replicas fail similarly [30]. The principle draws a partial analogy to N-version programming [22], whose indepen- dence assumption is itself empirically contested under correlated errors [23]. Partial kills—where CMC refutes a specific subclaim but not the overall finding—re-enter earlier stages for refinement rather than dropping the candidate. Across campaigns, CMC killed∼5 candidates (∼3% of all kills) that had survived earlier stages—false positives that would otherwise have advanced toward dis- closure. In the libfuse campaign specifically, CMC found correctness errors in 3/19 (∼16%) same-family-approved proposed fixes and independently surfaced 3 bugs that same-family review had missed; wider evaluation is future work. The stage evolved from ad hoc to standardised during the campaign. Retrospective stage attribution. Of the∼171 initial candidates, Stage A eliminated∼63% outright; of those surviving Stage A, Stage B killed∼42%; Stages C and D accounted for the remainder. We hypothesise that each stage targets a distinct failure class; leave-one-out 4 ablation was not performed. These are retrospective point-estimates from a single-rater mapping onto the consolidated stage taxonomy; inter-rater reliability was not measured. Learning loop. The OpenSSL campaign generated 56 codified rules across multiple sessions: each rule was distilled from a specific observed failure or near-miss (misclassification, false consensus, overlooked precondi- tion), with the originating incident retained as backing evidence.∼30 rules transferred directly to wolfSSL— selected because the two codebases share structural sim- ilarity (both are C cryptographic libraries with compa- rable session/state machinery); transfer to structurally dissimilar domains is open work. Rules include both advisory constraints and lightweight process-compliance checks. 4 Evaluation 4.1 Aggregate Results Table 2 summarises the pipeline findings across defect classes. The 79% figure is a retrospective aggregate: kills from all seven campaigns were mapped onto the consoli- dated stage taxonomy after the fact. Per-wave funnels are monotonic; the multi-campaign aggregate is not, be- cause libfuse and the FIPS review ran multiple candidate- generation waves whose Stage C rosters accumulate across waves. 2 For the two campaigns that applied the consol- idated protocol without contributing to its formation (lcms2, wolfSSL;n= 30), the prospective kill rate was 83% (25 killed / 30 candidates), consistent with the ag- gregate. Of∼171 initial security-funnel candidates,∼135 (∼79%) were killed by adversarial review, leaving∼36 validated within that funnel. Table 2 reports the paper- wide cross-domain total (36+ outcomes), which adds C++ domain-transfer items (LWG defects, editorial PRs, compiler conformance bugs) evaluated under the same adversarial architecture but with domain-adapted valida- tion oracles (committee acceptance rather than runtime tests); these are not scored in the security-funnel arith- metic. The kill distribution within the security funnel is front-loaded: Stage A eliminates∼63% of candidates; Stage B kills ∼42% of survivors. Two concurrent campaigns—V8/Chrome and Langflow—generated candidates that were killed during adversarial review. We include these negative results be- cause omitting unsuccessful campaigns would constitute selection on the dependent variable. 1 Findings across classes were produced by class-specific cam- paign configurations; the four-stage architecture describes the shared adversarial pattern, not a uniform prompt template. 2 Per-wave stage counts decrease monotonically as candidates are killed; when waves are merged for aggregate reporting, Stage C’s roster can exceed Stage B’s because additional waves contribute fresh candidates that reach empirical validation. The prospective n = 30 subset (lcms2, wolfSSL) is single-wave and monotonic. 4.2OpenSSL: The Bleichenbacher Fail- ure The initial OpenSSL campaign deployed 80+ agents. Ten dedicated agents—including a senior-tier arbiter— unanimously confirmed a CMS Bleichenbacher padding oracle (CVSS 5.9). A separate instance with fresh con- text compiled OpenSSL and ran three test cases: both wrong-key cases returned identical values. One test killed what 80+ agents’ reasoning could not. The root cause: all agents assumed “valid PKCS#1 padding→real CEK extracted,” which holds only for the original ciphertext. For Bleichenbacher probes, valid padding produces a wrong CEK that also fails the GCM check—indistinguishable from invalid padding. This failure drove the addition of mandatory empir- ical validation (Stage C) and the 56-rule methodology codification. Our second OpenSSL campaign (March 29 onward) applied the evolved methodology with mandatory empir- ical validation and hunters seeded with targeted specs, producing CVE-2026-34183 (MODERATE severity). 4.3 libfuse: Cross-Model Verification The libfuse campaign produced 2 CVEs (CVE-2026- 33150, CVSS 7.8; CVE-2026-33179, CVSS 5.5), 2 merged non-CVE hardening fixes (PRs #1470, #1471), and ad- ditional concurrency and hardening defects submitted in open PRs #1480/#1481/#1482 (under upstream review). Codex (a different model family) found 3 bugs that same- family review missed and identified correctness issues in 3 of 19 proposed fixes (16%)—bugs that additional Claude-family agents in our runs did not catch. 4.4 C++ Standard: Domain Transfer The C++ campaign applied Refute-or-Promote to a do- main with a formal specification, no executable oracle, and multiple reference implementations. The CMS Ble- ichenbacher catastrophe was partly a case of negative transfer: the spec-review habit of pure reasoning against text (the only method available for LaTeX normative prose) carried over to security where empirical testing was available but unused. The campaign produced LWG 4549 (accepted into the working draft), 5 merged editorial PRs, and 3 compiler conformance bugs. The specification funnel:∼23 candi- dates,∼20 confirmed (19 editorial to 1 normative). A complementary sibling hunting strategy (starting from known open CWG/LWG issues to find analogous con- structs) produced four high-confidence CWG candidates. A divergence-hunting campaign submitted 587 test cases via the Godbolt Compiler Explorer API, with higher defect counts observed in sections with larger recently integrated paper diffs. The adversarial pipeline caught all 4 false-positive CWG/LWG candidates, including one where multiple same-family agents confirmed a defect 5 Table 2: Pipeline findings by defect class. 1 Defect classInternal findings Public identifiers / notes CVEs4 CVE-2026-33150 [GHSA-qxv7-xrc2-qmfx] [High, CVSS 7.8] [libfuse] CVE-2026-33179 [GHSA-x669-v3mq-r358] [Medium, CVSS 5.5] [libfuse] CVE-2026-41254 [Medium] [lcms2] CVE-2026-34183 [Medium] [OpenSSL] (embargoed) Spec defects20+ QUIC RFC 9000 Errata (EID 8875, under committee review) [rfc-editor] ISO C++ LWG defect [LWG 4549] accepted to Working Paper [LWG] ISO C++ editorial PRs: #8799, #8800, #8801, #8802, #8803 merged to cplusplus/draft Compiler conformance bugs3GCC #124590 (rejects-valid); MSVC reports #11063494 (typedef access control), #11063498 (P3068R6 constexpr exceptions) Security-related fixes (no CVE)8 OpenSSL PRs: #30490, #30550, #30531 OpenSSL PR #30718: merged as a security fix without CVE (no remote trigger identified) libfuse merged hardening PRs: #1470 (memory leak inprint_module_help), #1471 (uninitialised eventfd in teardown watchdog) wolfSSL ML-DSA zeroisation PR #10100, PR #10113 (disputed) FIPS compliance issues1+ Under coordinated disclosure Total36+ that was a deliberate design decision documented only in a paper inter-revision changelog. Towards LLM-assisted conformance testing. Three techniques from the C++ campaign generalise to domains with formal specifications and multiple im- plementations: (1) Divergence hunting—submit LLM- generated tests toNimplementations, flag disagreements, adjudicate against normative text (applied here via God- bolt across GCC/Clang/MSVC); (2) Sibling hunting— start from known open specification issues (CWG/LWG defects, RFC errata, CMVP findings) and search for anal- ogous constructs with the same structural problem; and (3) Spec-diff targeting—recently changed specification text has the highest defect density. 4.5 Precision in Practice: Unanimity Patterns Two campaigns illustrate the unanimity-as-warning ob- servation (n= 2)—that unanimous agent agreement (in either direction) can be misleading, as is unanimous disagreement, because both reflect shared training-data priors rather than convergent truth. wolfSSL: unanimous error. The ML-DSA private- key zeroisation campaign surfaced a systematic byte- ordering error made unanimously by 3 independent workhorse-tier agents reading the same specification text. The adversarial pipeline corrected the error: a senior- tier adversarial agent, operating with cold-start context, identified that the three agents had all adopted the same (wrong) byte-order interpretation—a case where same- family consensus actively propagated a mistake that a fresh-context reviewer caught. lcms2: unanimous kill, resurrected. The lcms2 CubeSize()integer overflow (CVE-2026-41254) was unanimously killed in Round 4 (“DO NOT FILE”, on the grounds of a 174 MB minimum trigger with no plau- sible delivery path) and resurrected only via a creative uplift agent tasked with a different role—searching the dimension-parameter space, which produced a 4.8 KB trigger and restored plausible delivery. 5 Discussion Failure modes. We observe recurring failure modes across 5 categories—reasoning errors, information gaps, systematic biases, validation failures, and overclaiming. A recurring high-risk pattern: unanimous multi-agent agreement on wrong findings (3 documented cases). A named failure mode—PoC self-contamination—occurred when a wolfSSL proof-of-concept detected its own nonce computation rather than the library’s leak, producing a false-positive confirmation; this prompted a rule that PoCs must measure target behaviour, not their own arti- facts. Adversarial review catches reasoning errors but not empirical errors—motivating the two-gate architecture. Unanimity is a low-signal event. Agents may con- verge because a finding is genuine, or because they share training-data priors. Unanimity therefore should not raise confidence by itself; empirical verification, not con- 6 Table 3: Automatability of human decisions. DecisionStatus Rejecting false kills, override decisionsHuman-essential Methodology refinement (new rules)Human-essential Target selection, subsystem focusPartially automatable Domain expertise injectionPartially automatable Disclosure routing, severity negotiation Partially automatable Cross-model bridgingPartially automatable Applying codified patternsFully automatable sensus count, is what changes our belief. The CMS Bleichenbacher case (80+ agents endorsed a non-existent vulnerability, killed by one test) illustrates how shared priors can manufacture apparent consensus. Human orchestrator. No vulnerability was discov- ered autonomously. Several decision categories still re- quire human judgment (Table 3). The methodology reduces human effort but does not eliminate human ne- cessity. Cost.∼$250 out-of-pocket on a standard LLM sub- scription for 36+ outcomes (including 4 CVEs)—roughly $62/CVE at subscription pricing. Figures exclude re- searcher labour and are not directly comparable to reproduction-oriented systems such as CVE-GENIE [52]. Limitations. Single operator with domain expertise (not independently replicated). No ablation studies iso- lating individual mechanisms. Target selection confound: 2 CVEs from∼15 agents on libfuse versus 0 from 80+ on Chrome. Strongest results concentrated in C/C++. Two methodology regressions under domain transfer (FIPS no-oracle, PoC self-contamination), corrected within the triggering campaign. Over-refusal in authorised cybersecurity work- flows. Across∼940 delegated tasks in four coordinated- disclosure campaigns, we observed 6 hard refusals (≈0.6%). All occurred in workhorse-tierClaude Sonnet subagents; the senior-tierClaude Opusprincipal pro- duced none. We treat this as case-study evidence of model-tier refusal asymmetry: within a single vendor’s lineup, lower-tier models may over-refuse authorised dual- use security tasks more aggressively than higher-tier models. Refused tasks were legitimate research oper- ations: CVSS calibration, PoC execution on researcher- controlled VMs, disclosure-timing analysis, and exploit- severity assessment. Two refusals were factually wrong, asserting that researcher-assigned CVE identifiers “do not exist”—a particularly harmful failure mode in which stale or unverifiable facts become false predicates for de- nial. 3 These observations extend benchmark work on 3 A recursive case outside the 940-task disclosure-campaign cor- pus: an Opus agent tasked with drafting this paragraph declined over-refusal [31,32] into authorised cybersecurity work- flows [33] and motivate two architectural requirements for agentic security systems: explicit authorisation sig- nals in task context, and propagation of trust context to delegated subagents. Scale and artifact diversity. The 36+ outcomes (in- cluding 4 CVEs) over 31 days reflect a solo campaign conducted alongside full-time employment on a stan- dard LLM subscription, without vendor-scale data ac- cess or red-team staff. Contemporaneous industrial sys- tems [16,27–29] operate with dedicated teams and privi- leged data but typically do not publish architecture or FP rates. Our contribution is methodology transparency and externally-validated progress across a diverse arti- fact set, not raw discovery volume. This set spans three evidentiary states: public, accepted, or assigned under embargo (4 CVEs, LWG 4549 accepted to the ISO C++ Working Paper, 5 mergedcplusplus/drafteditorial PRs, compiler conformance bugs, and security-related upstream patches); formally filed outcomes under review (the RFC 9000 errata); and issues under coordinated disclosure (FIPS 140-3 normative compliance issues). Protocol evolution as confounder. Because the four- stage protocol evolved during the campaign, early suc- cesses (libfuse and OpenSSL CVEs) cannot be attributed solely to the final formulation; target selection, operator learning, and manual prompt iteration are confounders. The case studies therefore serve a dual role—substantive discovery outcomes and empirical substrate from which the final protocol was derived. We treat them as evidence for mechanism-level claims (adversarial framing, context asymmetry, cross-family verification, empirical valida- tion) and for cross-domain transfer, not as a controlled causal estimate of a single immutable pipeline. Decentralised adversarial architectures. Refute- or-Promote uses asymmetric mandates (kill vs. creative) under a centralised human orchestrator; controlled com- parison against sealed-then-debate and unrestricted peer debate variants [10] is future work. False negatives and the unidirectional pipeline. Refute-or-Promote optimises precision but does not mea- sure recall. The pipeline is architecturally unidirectional: it has structural mechanisms against false positives (kill mandates) but relies on the human orchestrator to res- cue true positives incorrectly killed. One documented case confirms the false-negative risk (§4.5): the lcms2 CubeSize()overflow (CVE-2026-41254) was unani- mously killed and recovered only via human override. The the work on “jailbreak cookbook” grounds, characterising academic safety-refusal analysis as adversarial. We record it as a distinct data point about how refusal calibration interacts with academic safety research itself, not a counter-example to the zero refusals in the 940-task disclosure corpus above. 7 unanimity-as-warning observation (n= 2) applies sym- metrically across the two documented cases: the wolfSSL ML-DSA byte-ordering case supplies the false-positive di- rection (unanimous error corrected by adversarial review) and lcms2 supplies the false-negative direction (unani- mous kill corrected by human override). Both reflect shared training-data priors rather than convergent truth. A natural architectural complement—a context-isolated resurrection agent with an explicit confirm mandate, fir- ing after unanimous kills—could partially automate the override function; empirical evaluation is future work. Generalization beyond defects. As a preliminary transfer test we applied a simplified variant of the pipeline—retaining cross-family verification (Claude or- chestrator and analysts, GPT-5.4 Codex critic), context isolation, and empirical gating against the SWE-bench harness, but omitting parallel creative/adversarial tracks and stage-gated escalation—to SWE-bench Verified in- stances where all 134 publicly-logged submissions failed. The variant produced 5 verified SymPy fixes, plus a 914- byte patch for the “hardest task” on swe-rebench.com (Nov–Dec 2025). Our denominator is the 134-instance unsolved subset, not the full benchmark, so the result is not comparable to leaderboard scores such as InfCode’s 79.4% [47,48]; it shows only that cross-family critique can solve instances where all prior attempts failed. Leader- board submission is future work. Broader implications. Several named ideas from Refute-or-Promote apply beyond defect dis- covery. Methodology codification as inference-time self-improvement (observed, not claimed as a general result): our 56 rules transferred directly to a structurally similar codebase (wolfSSL), appearing to improve preci- sion before that campaign’s first failure. Cross-domain transfer to dissimilar codebases is open work. The combination of adversarial mandates with context asymmetry can be viewed as engineered failure-mode de-correlation—a partial analogue of N-version pro- gramming’s independence assumption for agents that share training data [22,23]. The C++-to-security transfer failure is an instance of methodology-level negative transfer, distinct from weight-level negative transfer in transfer learning and relevant to cross-domain LLM pipeline deployment. Extensions to pre-action verification for autonomous agents, proof-assistant-oracle formal verification, and AI-assisted code review are natural next steps. Artifacts and reproducibility. The 56 codified refute-or-promote rules and thestrat.mdorchestration playbook—covering target preparation, scope-partitioned candidate generation, round-by-round adversarial proto- col, PoC workflow, and the cross-model final critique step—are released via a public GitHub repository 4 with a Zenodo-archived tagged release 5 and as arXiv ancil- lary files. Per-candidate logs (prompts, agent outputs, kill/promote decisions) contain pre-disclosure vulnerabil- ity material; a scrubbed subset for methodology repro- duction will be released after embargoes lift. 6 Conclusion We presented Refute-or-Promote—an adversarial, stage- gated, multi-agent review methodology for high-precision LLM-assisted defect discovery. Our central observation is that consensus among AI agents does not equal correctness: 80+ agents unanimously endorsed a non- existent vulnerability; 3 independent agents made identi- cal errors; in the libfuse campaign, cross-family review found correctness issues in 3/19 (∼16%) same-family- approved proposed fixes. The methodology’s response is architectural: adversar- ial agents tasked with disproving findings, a Cross-Model Critic (CMC) for orthogonal error detection, and manda- tory empirical validation as the final gate. We hypothesise that the three mechanisms target distinct failure classes (reasoning bias, anchoring, and correlated training errors respectively) and that their composition forms a relia- bility pattern applicable to other LLM output domains where ground truth is independently verifiable. The be- fore/after pattern—0 CVEs from 80+ agents in the first OpenSSL campaign (pre-pipeline, Bleichenbacher era) versus 2 CVEs from∼15 agents in the libfuse campaign with the evolving adversarial pipeline (libfuse preceded the final four-stage codification; see §3), and subsequently CVE-2026-34183 from the second OpenSSL campaign with the evolved methodology—constitutes a real-world (non-benchmark) case study of adversarial multi-agent review, though we cannot isolate the methodology’s con- tribution from confounds including target selection, op- erator learning, and retrospective rule codification. We hypothesise that the principle generalises: in any domain where training-distribution bias produces corre- lated LLM errors, adversarially mandated context asym- metry may serve as a reliability primitive. Validation of this claim beyond the security and specification domains studied here is future work. References [1] Google Project Zero and Google DeepMind. Big Sleep: Real-world vulnerability discovery with large language models. Google Security Blog, November 2024. [2]Google DeepMind. Project Naptime: Evaluating 4 https://github.com/abhinavagarwal07/refute-or-promote 5 DOI: 10.5281/zenodo.19668799 8 Offensive Security Capabilities of Large Language Models. Google Security Blog, June 2024. [3]S. Fang, W. Ding, Z. Cao, Z. Yang, and B. Xu. AEGIS: From Clues to Verdicts—Graph-Guided Deep Vulnerability Reasoning via Dialectics and Meta-Auditing. arXiv:2603.20637, March 2026. [4]S. Ullah, M. Sultana, and L. Williams. On the Reliability of Large Language Models to Mitigate Security Vulnerabilities. In IEEE S&P 2024. [5]Semgrep, Inc. AI-Assisted SAST: False Positive Rates in Production. semgrep.dev/blog, 2025. [6] D. Stenberg. AI bug reports and the maintainer burden. daniel.haxx.se/blog, 2024–2026. [7] D. Stenberg. The end of the curl bug bounty. daniel.haxx.se/blog, January 2026. [8] Y. Du, S. Li, A. Torralba, J. B. Tenenbaum, and I. Mordatch. Improving Factuality and Reasoning in Language Models through Multiagent Debate. arXiv:2305.14325, 2023. [9]A. Khan et al. Debating with More Persuasive LLMs Leads to More Truthful Answers. In ICML 2024 (Best Paper). [10]A. Wynn, H. Satija, and G. Hadfield. Talk Isn’t Always Cheap: Understanding Failure Modes in Multi-Agent Debate. arXiv:2509.05396, September 2025. [11]T.-E. Song. Cross-Context Review: Improving LLM Output Quality by Separating Production and Re- view Sessions. arXiv:2603.12123, March 2026. [12]T.-E. Song. More Rounds, More Noise: Why Multi- Turn Review Fails to Improve Cross-Context Verifi- cation. arXiv:2603.16244, March 2026. [13]K. Huang, Y. Jin, R. Li, M. Y. Li, E. Candès, and J. Leskovec. POPPER: Automated Hypothe- sis Validation with Agentic Sequential Falsifications. arXiv:2502.09858, 2025. In ICML 2025. [14]D. Lifshitz et al. Multi-Agent Verification: Scal- ing Test-Time Compute with Multiple Verifiers. arXiv:2502.20379, February 2025. [15] R. Widyasari, M. Weyssow, I. C. Irsan, H. W. Ang, F. Liauw, E. L. Ouh, L. K. Shar, H. J. Kang, and D. Lo. Let the Trial Begin: A Mock-Court Approach to Vulnerability Detection using LLM-Based Agents (VulTrial). arXiv:2505.10961, May 2025. Accepted at ICSE 2026. [16]O. Vlcek, J. Baloo, and S. Fort. AISLE: An AI- Native Cyber Reasoning System for Autonomous Vulnerability Remediation.https://aisle.com/ about-us, 2025–2026. [17]Z. Li, S. Dutta, and M. Naik. IRIS: LLM-Assisted Static Analysis for Detecting Security Vulnerabilities. arXiv:2405.17238, 2024. [18]Y. Li, K. Joshi, X. Wang, and E. Wong. MAVUL: Multi-Agent Vulnerability Detection via Contextual Reasoning and Interactive Refinement. arXiv:2510.00317, 2025. [19]Z. Wang, G. Li, J. Li, H. Zhu, and Z. Jin. VulAgent: Hypothesis-Validation based Multi-Agent Vulnera- bility Detection. arXiv:2509.11523, September 2025. [20]Anthropic. Zero-Day Vulnerability Discovery with Frontier Models.https://red.anthropic.com/ 2026/zero-days/, February 2026. [21]OpenAI. Codex Security: Now in Research Preview. openai.com, March 2026. [22]A. Avizienis and J. P. J. Kelly. Fault Tolerance by Design Diversity: Concepts and Experiments. Computer, 17(8):67–80, 1984. [23] J. C. Knight and N. G. Leveson. An Experimen- tal Evaluation of the Assumption of Independence in Multiversion Programming. IEEE Transactions on Software Engineering, SE-12(1):96–109, January 1986. [24] Y. Xiong and T. Zhang. Sifting the Noise: A Com- parative Study of LLM Agents in Vulnerability False Positive Filtering. arXiv:2601.22952, January 2026. [25]X. Du et al. Reducing False Positives in Static Bug Detection with LLMs: An Empirical Study in Industry. arXiv:2601.18844, January 2026. In ICSE 2026. [26] I. Kraidia, I. Qaddara, A. Almutairi, N. Alzaben, and S. B. Belhouari. When Collaboration Fails: Persuasion-Driven Adversarial Influence in Multi- Agent LLM Debate. Scientific Reports, April 2026. [27]Anthropic.Claude Mythos Preview. red.anthropic.com, April 2026.https: //red.anthropic.com/2026/mythos-preview/ [28]Anthropic. Project Glasswing: Securing Critical Software for the AI Era. anthropic.com, April 2026. https://w.anthropic.com/glasswing [29]OpenAI.Trusted Access for the Next Era of Cyber Defense.openai.com, April 2026.https://openai.com/index/ scaling-trusted-access-for-cyber-defense/ [30] E. Kim, A. Garg, K. Peng, and N. Garg. Correlated Errors in Large Language Models. In ICML 2025. arXiv:2506.07962. 9 [31]P. Röttger, H. Kirk, B. Vidgen, G. Attanasio, F. Bianchi, and D. Hovy. XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Models. In Proceedings of NAACL 2024, p. 5377–5400. arXiv:2308.01263. [32]J. Cui, W.-L. Chiang, I. Stoica, and C.-J. Hsieh. OR-Bench: An Over-Refusal Benchmark for Large Language Models. In ICML 2025. arXiv:2405.20947. [33]N. Linder, M. Segal, O. Antverg, G. Gekker, T. Fichman, O. Bodenheimer, E. Maor, and O. Nevo. A Content-Based Framework for Cyberse- curity Refusal Decisions in Large Language Models. arXiv:2602.15689, February 2026. [34]P. Stokes. Building an Adversarial Consensus Engine: Multi-Agent LLMs for Automated Malware Analysis. SentinelOne Labs, March 2026. [35] W. Li, Y. Lin, M. Xia, and C. Jin. Rethinking Mixture-of-Agents: Is Mixing Different Large Lan- guage Models Beneficial? arXiv:2502.00674, Febru- ary 2025. [36] J. Wang, J. Wang, B. Athiwaratkun, C. Zhang, and J. Zou. Mixture-of-Agents Enhances Large Lan- guage Model Capabilities. In ICLR 2025 (Spotlight). arXiv:2406.04692. [37]S. Joyce. Cloud CISO Perspectives: Our Big Sleep Agent Makes a Big Leap. Google Cloud Blog, July 2025. [38]L. Franceschi-Bicchierai. Google Says Its AI- Based Bug Hunter Found 20 Security Vulnerabilities. TechCrunch, August 2025. [39] S. Heelan. How I Used o3 to Find CVE-2025-37899, a Remote Zeroday Vulnerability in the Linux Kernel’s SMB Implementation. sean.heelan.io, May 2025. [40] J. Guo, C. Wang, X. Xu, Z. Su, and X. Zhang. RepoAudit: An Autonomous LLM-Agent for Repository-Level Code Auditing. In ICML 2025. arXiv:2501.18160. [41] R. A. Popa and F. Flynn. Introducing CodeMender: An AI Agent for Code Security. Google DeepMind Blog, October 2025. [42]M. Cooter. Internet Bug Bounty Program Hits Pause on Payouts. InfoWorld, April 2026. [43]N. Shinn, F. Cassano, A. Gopinath, K. Narasimhan, and S. Yao. Reflexion: Language Agents with Verbal Reinforcement Learning. In NeurIPS 2023. arXiv:2303.11366. [44]A. Madaan, N. Tandon, P. Gupta, et al. Self-Refine: Iterative Refinement with Self-Feedback. In NeurIPS 2023. arXiv:2303.17651. [45]G. Irving, P. Christiano, and D. Amodei. AI Safety via Debate. arXiv:1805.00899, 2018. [46]Y. Denisov-Blanch, J. Kazdan, J. Chudnovsky, R. Schaeffer, S. Guan, S. Adeshina, and S. Koyejo. Consensus is Not Verification: Why Crowd Wisdom Strategies Fail for LLM Truthfulness. arXiv:2603.06612, 2026. [47] K. Li, M. Wang, H. Zhang, et al. InfCode: Adversar- ial Iterative Refinement of Tests and Patches for Re- liable Software Issue Resolution. arXiv:2511.16004, November 2025. [48]H. Li, Y. Shi, S. Lin, et al. SWE-Debate: Competi- tive Multi-Agent Debate for Software Issue Resolu- tion. arXiv:2507.23348, July 2025. [49] Z. Liang, Q. Xie, J. He, B. Xue, W. Wang, Y. Cai, F. Luo, B. Zhang, H. Hu, and K. Wu. Ar- gus: Multi-Agent Ensemble Reorchestrating Static Analysis for Full-Chain Vulnerability Detection. arXiv:2604.06633, 2026. [50]S. Jain, U. Z. Ahmed, S. Sahai, and B. Leong. Be- yond Consensus: Mitigating the Agreeableness Bias in LLM Judge Evaluations. arXiv:2510.11822, Oc- tober 2025. [51]A. Harrasse, C. Bandi, and H. Bandi. Debate, De- liberate, Decide (D3): A Cost-Aware Adversarial Framework for Reliable and Interpretable LLM Eval- uation. arXiv:2410.04663, 2024. EACL 2026. [52]S. Ullah, P. Balasubramanian, W. Guo, A. Burnett, H. Pearce, C. Kruegel, G. Vigna, and G. Stringhini. From CVE Entries to Verifiable Exploits: CVE- GENIE Multi-Agent Framework. arXiv:2509.01835, September 2025. 10

Instant research discovery