Paper deep dive
MultiVer: Zero-Shot Multi-Agent Vulnerability Detection
Shreshth Rajan
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 91%
Last extracted: 7/20/2026, 11:14:31 PM
Summary
The paper introduces MultiVer, a zero-shot multi-agent system for vulnerability detection that achieves state-of-the-art recall on the PyVul benchmark (82.7%) by using a four-agent ensemble (security, correctness, performance, style) with union voting. It surpasses fine-tuned GPT-3.5 in recall but trades off precision (48.8%) compared to fine-tuned baselines, demonstrating that multi-agent ensembles are effective for security applications where false negatives are costlier than false positives.
Entities (14)
Relation Signals (10)
MultiVer â achievesrecallon â PyVul
confidence 98% · achieves 82.7% recall on PyVul
MultiVer â outperforms â GPT-3.5
confidence 95% · exceeding fine-tuned GPT-3.5 (81.3%) by 1.4 percentage points
MultiVer â uses â Union Voting
confidence 95% · A four-agent ensemble ... with union voting achieves 82.7% recall
CodeQL â achievesrecallon â PyVul
confidence 90% · CodeQL detects 10.8% of vulnerabilities in PyVul
Bandit â achievesrecallon â PyVul
confidence 90% · Bandit detects 5.3%
MultiVer â consistsof â Security Agent
confidence 90% · A four-agent ensemble (security, correctness, performance, style)
MultiVer â consistsof â Correctness Agent
confidence 90% · A four-agent ensemble (security, correctness, performance, style)
MultiVer â usesmodel â Claude Opus 4.5
confidence 90% · The third tier invokes Claude Opus 4.5
Vul-RAG â achievesdetectionon â SecurityEval
confidence 85% · Vul-RAG (Du et al., 2024) achieves 78.9% on SecurityEval
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:We present MultiVer, a zero-shot multi-agent system for vulnerability detection that achieves state-of-the-art recall without fine-tuning. A four-agent ensemble (security, correctness, performance, style) with union voting achieves 82.7% recall on PyVul, exceeding fine-tuned GPT-3.5 (81.3%) by 1.4 percentage points -- the first zeroshot system to surpass fine-tuned performance on this benchmark. On SecurityEval, the same architecture achieves 91.7% detection rate, matching specialized systems. The recall improvement comes at a precision cost: 48.8% precision versus 63.9% for fine-tuned baselines, yielding 61.4% F1. Ablation experiments isolate component contributions: the multi-agent ensemble adds 17 percentage points recall over single-agent security analysis. These results demonstrate that for security applications where false negatives are costlier than false positives, zero-shot multi-agent ensembles can match and exceed fine-tuned models on the metric that matters most.
Tags
Links
- Source: https://arxiv.org/abs/2602.17875v1
- Canonical: https://arxiv.org/abs/2602.17875v1
Trouble viewing inline? Open PDF directly â
Full Text
26,656 characters extracted from source content.
Expand or collapse full text
MultiVer: Zero-Shot Multi-Agent Vulnerability Detection Shreshth Rajan 1 Abstract We present MULTIVER, a zero-shot multi-agent system for vulnerability detection that achieves state-of-the-art recall without fine-tuning.A four-agent ensemble (security, correctness, perfor- mance, style) with union voting achieves 82.7% recall on PyVul, exceeding fine-tuned GPT-3.5 (81.3%) by 1.4 percentage pointsâthe first zero- shot system to surpass fine-tuned performance on this benchmark. On SecurityEval, the same architecture achieves 91.7% detection rate, match- ing specialized systems. The recall improvement comes at a precision cost: 48.8% precision versus 63.9% for fine-tuned baselines, yielding 61.4% F1. Ablation experiments isolate component con- tributions: the multi-agent ensemble adds 17 per- centage points recall over single-agent security analysis. These results demonstrate that for secu- rity applications where false negatives are costlier than false positives, zero-shot multi-agent ensem- bles can match and exceed fine-tuned models on the metric that matters most. 1. Introduction Vulnerability detection performance depends strongly on the analysis approach. Static analysis tools achieve high precision but low recall: CodeQL detects 10.8% of vulnera- bilities in PyVul, Bandit detects 5.3% (Quan et al., 2025). Large language models improve recall but require fine- tuning: GPT-4 zero-shot achieves 33.3% recall, GPT-3.5 zero-shot reaches 61.1%, and fine-tuned GPT-3.5 reaches 81.3% (Quan et al., 2025). The gap between zero-shot and fine-tuned performanceâ20 percentage pointsârepresents the cost of acquiring labeled vulnerability data. We investigate whether multi-agent ensembles can close this gap without training data. The hypothesis is straightforward: vulnerabilities manifest across multiple dimensions (secu- 1 Harvard College, Cambridge, MA, USA. Correspondence to: Shreshth Rajan<shreshthrajan@college.harvard.edu>. Proceedings of the43 rd International Conference on Machine Learning, Seoul, South Korea. PMLR 306, 2026. Copyright 2026 by the author(s). rity flaws, correctness bugs, performance issues, style vio- lations), and an ensemble analyzing all dimensions should detect more vulnerabilities than any single-dimension anal- ysis. Union votingâflagging code when any agent detects an issueâmaximizes this effect. Empirically, this hypothesis holds. On PyVul, a four-agent ensemble with union voting achieves 82.7%±0.6% recall (mean over 3 runs), exceeding fine-tuned GPT-3.5 (81.3%) by 1.4 percentage pointsâthe first zero-shot system to sur- pass fine-tuned performance on this benchmark. The im- provement is consistent: on SecurityEval, the same system achieves 91.7% detection rate, matching specialized systems like Aardvark (92%) that require domain-specific engineer- ing. The recall gain comes with a precision trade-off. Our system achieves 48.8% precision versus 63.9% for fine-tuned GPT- 3.5, yielding 61.4% F1 compared to 71.6% for the fine-tuned baseline. This trade-off reflects a design choice: union voting increases recall by accepting more false positives. For security audits, where a missed vulnerability can lead to a breach while a false positive costs only review time, this trade-off is favorable. We make four contributions. First, we demonstrate that zero- shot multi-agent ensembles can exceed fine-tuned recall: 82.7% versus 81.3% on PyVul, a 1.4p improvement with- out training data. Second, we achieve 61.4% F1, competitive with the best zero-shot systems (CodeQwen 61.8%, GPT-3.5 55.5%, GPT-4 44.3%). Third, we isolate component con- tributions through ablation: the multi-agent ensemble adds 17p recall over security-only analysis, and the correctness agent alone contributes 11p. Fourth, we characterize the recall-precision trade-off: weighted voting achieves 37.7% recall with 35.3% FPR; union voting achieves 82.7% recall with 85.0% FPR. 2. Related Work Static analysis tools achieve high precision but low recall. On PyVul, CodeQL (GitHub, 2024) detects 10.8% of vul- nerabilities, Bandit (PyCQA, 2024) detects 5.3%, and PySA detects 0% (Quan et al., 2025). These tools miss over 89% of real-world vulnerabilities. Performance on synthetic benchmarks overestimates real- 1 arXiv:2602.17875v1 [cs.MA] 19 Feb 2026 MultiVer: Zero-Shot Multi-Agent Vulnerability Detection world capability. Ding et al. (2024) show that a 7B param- eter model achieves 68.26% F1 on BigVul but only 3.09% F1 on PrimeVulâa 22Ădrop when evaluated on realis- tic vulnerability data. PyVul exposes similar gaps: none of the evaluated static tools effectively identify its curated vulnerabilities. Large language models improve recall but the gap between zero-shot and fine-tuned performance remains large. On PyVul, GPT-4 zero-shot achieves 33.3% recall (44.3% F1), GPT-3.5 zero-shot reaches 61.1% recall (55.5% F1), and fine-tuned GPT-3.5 achieves 81.3% recall (71.6% F1) (Quan et al., 2025). Fine-tuning provides a 20 percentage point recall improvement but requires labeled vulnerability data. Retrieval augmentation and specification-guided approaches reduce the need for fine-tuning. Vul-RAG (Du et al., 2024) achieves 78.9% on SecurityEval by retrieving vulnerability knowledge rather than similar code. VulInstruct (Zhu et al., 2025) reaches 45% F1 on PrimeVul through specification- guided analysis, a 32.7% improvement over baselines. Multi-agent architectures improve detection through com- plementary analysis. MAVUL (Li et al., 2025) improves pairwise accuracy by 62% through inter-agent communi- cation. VulAgent (Wang et al., 2025) reduces false posi- tive rate by 36% using hypothesis validation. LLMxCPG (Lekssays et al., 2025) achieves 15â40% F1 improvement by combining code property graphs with LLM analysis. Ensemble aggregation methods determine how agent out- puts combine. Kaesberg et al. (2025) find that voting im- proves accuracy by 13.2% on reasoning tasks, compared to 2.8% for consensus-based debate on knowledge tasks. CodeX-Verify (Rajan, 2025) demonstrates that information- theoretic ensemble methods achieve 39.7p improvement in code verification. Vulnerability detection is a reasoning task; we use voting. 3. Method 3.1. Architecture MULTIVER processes code through four specialized agents executing in parallel (Figure 1). Each agent analyzes a different dimension: the security agent (weight 0.45) per- forms CWE-mapped pattern matching and RAG-augmented LLM analysis; the correctness agent (weight 0.35) detects bugs through AST analysis of exception handling and input validation; the performance agent (weight 0.15) identifies algorithmic inefficiencies; and the style agent (weight 0.05) assesses code quality. Agent weights derive from empir- ically measured accuracy on held-out data (Rajan, 2025). Agents execute in parallel with results combined through ensemble voting. Code Input Security (0.45) Correct. (0.35)Perf. (0.15) Style (0.05) Tier 1: Pattern Tier 2: RAG Tier 3: LLM Ensemble Voting Verdict Figure 1. MULTIVER architecture. Four agents analyze code in parallel across different dimensions. Each agent follows a three- tier pipeline (pattern matchingâRAG retrievalâLLM analy- sis). Agent outputs combine through ensemble voting (union or weighted). 3.2. Three-Tier Analysis Pipeline Each agent follows a three-tier pipeline optimized for cost and accuracy. The first tier runs deterministic pattern match- ing against CWE-mapped vulnerability signatures (SQL injection, command injection, path traversal). Pattern match- ing completes in under 50ms at zero cost and achieves 53% recall on security vulnerabilitiesâsufficient to trigger down- stream analysis but insufficient alone. The second tier retrievesk = 5similar examples from a curated knowledge base using FAISS (Johnson et al., 2019), plus 3 relevant specifications describing vulnerability causes and fixes. Retrieval adds approximately 100ms latency. The knowledge base contains 1,199 labeled examples from CVEFixes, BugsInPy, and synthetic samples. The third tier invokes Claude Opus 4.5 (Anthropic, 2025) with extended thinking (10K token budget). The LLM re- ceives pattern results, retrieved examples, and specifications, then produces a structured verdict (PASS/WARNING/FAIL) with confidence and reasoning. This tier dominates latency (approximately 30s) and cost ($0.13 per call). LLM invocation is selective based on pattern recall rates. For security (53% pattern recall) and performance (28.6%), we always invoke the LLM. For correctness (99.5% pattern recall), we invoke the LLM only when patterns find nothing or code complexity exceeds a threshold. For style (100% pattern recall), we skip the LLM entirelyâdeterministic patterns suffice. 3.3. Context Extraction For injection vulnerabilities specifically, we extract addi- tional context using tree-sitter (Tree-sitter, 2024). The ex- tractor identifies input sources (function parameters, request fields, file reads), sensitive sinks (execute, eval, open, sys- tem), data flow paths from sources to sinks with 2-level 2 MultiVer: Zero-Shot Multi-Agent Vulnerability Detection inter-procedural tracking, and validation checks (isinstance, sanitize, escape). This context is extracted only when pat- terns detect injection-type vulnerabilities. Empirically, pro- viding context on non-injection bugs reduces accuracyâthe LLM over-indexes on data flow when the vulnerability is a missing authentication check with no explicit flow. 3.4. Ensemble Voting Agent verdicts combine through ensemble voting. We im- plement two modes reflecting the recall-precision trade-off measured in ablation. Union voting maximizes recall: any security or correct- ness WARNING/FAIL triggers an overall warning. This achieves 82.7% recall but 48.8% precision (Table 1). The logic reflects cost asymmetryâmissing a vulnerability risks a breach; a false positive costs only review time. Weighted voting balances precision and recall. The ensem- ble score is P i w i · v i · c i wherew i is agent weight (0.45, 0.35, 0.15, 0.05),v i is verdict severity (PASS=0, WARN- ING=0.5, FAIL=1), andc i is confidence. Weighted voting achieves 37.7% recall with 35.3% FPRâmuch lower recall but also fewer false alarms. 3.5. Self-Consistency For the security agent, we employ self-consistency sam- pling (Wang et al., 2023) to reduce variance. The primary call uses extended thinking at temperature 1.0 (required by the API when thinking is enabled). Two diversity samples run without extended thinking at temperatures 0.7 and 0.9, enabling actual temperature variation. The three calls exe- cute in parallel; the final verdict is determined by majority vote. Self-consistency adds approximately $0.26 cost and 5s latency but reduces verdict variance on ambiguous cases. 4. Experiments 4.1. Benchmarks We evaluate on two benchmarks spanning real-world and synthetic vulnerabilities. PyVul (Quan et al., 2025) con- tains 1,569 real Python vulnerabilities extracted from PyPI packages with their corresponding fixes. The balanced test set contains 300 samples (150 vulnerable, 150 fixed); we evaluate on the 202 Python-only samples (100 vulnerable, 102 fixed) to ensure language consistency with our Python- focused analysis pipeline. This benchmark is challenging: rule-based detectors achieve only 5â11% recall, and the gap between synthetic and real-world performance is severeâ Ding et al. (2024) show that models achieving 68% F1 on synthetic data drop to 3% on realistic vulnerabilities. SecurityEval (Siddiq & Santos, 2022) contains 121 synthetic Table 1. PyVul results. MULTIVER achieves highest recall among all systems including fine-tuned models. Results show mean±std over 3 runs with different random seeds on the same fixed test set. Baseline numbers from Quan et al. (2025). SystemTypeRecallPrec.F1 CodeQLRule10.8%â BanditRule5.3%â GPT-4 zero-shotZero33.3%65.8%44.3% GPT-3.5 zero-shotZero61.1%50.8%55.5% CodeQwen zero-shotZero66.9%57.4%61.8% CodeQwen fine-tunedFT75.3%60.1%66.9% GPT-3.5 fine-tunedFT81.3%63.9%71.6% MULTIVER (Ours) Zero 82.7± 0.6%48.8%61.4% vulnerability samples across 69 CWEs. While less realistic than PyVul, it enables comparison with prior work including Vul-RAG (Du et al., 2024) and Aardvark. 4.2. Baselines Baselines span rule-based, zero-shot, fine-tuned, and spe- cialized systems. Rule-based detectors CodeQL (GitHub, 2024) and Bandit (PyCQA, 2024) achieve 10.8% and 5.3% recall respectively on PyVul (Quan et al., 2025). Zero-shot language models perform better: GPT-4 achieves 33.3% recall (44.3% F1), GPT-3.5 reaches 61.1% recall (55.5% F1), and CodeQwen (Alibaba, 2024) achieves 66.9% recall (61.8% F1). Fine-tuning closes the gap further: fine-tuned GPT-3.5 achieves 81.3% recall with 63.9% precision (71.6% F1), and fine-tuned CodeQwen reaches 75.3% recall (66.9% F1). On SecurityEval, Vul-RAG (Du et al., 2024) achieves 78.9% detection and Aardvark reaches 92%. 4.3. Main Results Table 1 presents results on PyVul. MULTIVER with union voting achieves 82.7%±0.6% recall (mean over 3 runs with different random seeds on a fixed test set), exceeding fine- tuned GPT-3.5 (81.3%) by 1.4 percentage points without any training data. This is the first zero-shot system to surpass fine-tuned recall on this benchmark. The recall improvement comes at a precision cost. MUL- TIVER achieves 48.8% precision compared to 63.9% for fine-tuned GPT-3.5, yielding 61.4% F1 versus 71.6%. Among zero-shot systems, our F1 is competitive with Code- Qwen (61.8%) and exceeds GPT-3.5 (55.5%) by 5.9p. The precision trade-off reflects a design choice: union voting prioritizes recall because false negatives (missed vulnerabil- ities) are costlier than false positives (unnecessary reviews) in security applications. On SecurityEval, MULTIVER achieves 91.7% detection (111/121 samples), competitive with Aardvark (92%) and 3 MultiVer: Zero-Shot Multi-Agent Vulnerability Detection Table 2. Ablation study on PyVul balanced test set. All configura- tions use union voting with self-consistency. Mean±std over 3 runs where applicable. ConfigurationTPRFPRâ TPR Full System (RAG + 4 agents)82.7%85.0%â No-RAG92.0%94.1%+9.3p Security-only65.7%ââ17.0p No-Correctness71.7%ââ11.0p Weighted Voting37.7%35.3%â45.0p exceeding Vul-RAG (78.9%) by 12.8p. The consistent performance across benchmarks suggests the multi-agent architecture generalizes beyond any single vulnerability dis- tribution. 4.4. Ablation Study Table 2 isolates component contributions. All configurations use union voting with self-consistency on the same balanced test set (202 Python samples: 100 vulnerable, 102 fixed). The multi-agent ensemble contributes substantially: security-only achieves 65.7% recall, while the full ensem- ble reaches 82.7%âa 17p improvement. The correctness agent alone adds 11p (comparing no-correctness 71.7% to full 82.7%), validating the hypothesis that vulnerabilities manifest across multiple dimensions. Retrieval augmentation presents an unexpected trade-off. Disabling RAG increases TPR from 82.7% to 92.0% but also increases FPR from 85.0% to 94.1%. The mechanism is instructive: RAG retrieves examples with similar syntax, which grounds the modelâs analysis in known patterns. This grounding reduces both true positives (novel vulnerabilities not matching retrieved patterns) and false positives (safe code matching vulnerability patterns). The main results (Table 1) use RAG with union voting, which achieves a balance: 82.7% TPR with 85.0% FPR. 4.5. Error Analysis Of 100 vulnerable samples, MULTIVER misses 18 (18% false negative rate). Missed vulnerabilities cluster into three categories: sanitization functions that appear safe but have edge cases (7 samples), cryptographic issues requiring spe- cialized domain knowledge (6 samples), and complex multi- file vulnerabilities beyond single-function analysis scope (5 samples). False positives are frequent: 86 of 102 fixed samples are incorrectly flagged (85% FPR). The primary failure mode is the LLMâs inability to distinguish vulnerable code from its patched counterpart when they differ minimally. Functions likegeturl()andgetsafeurl()may differ by a single validation call, but the model flags both as potentially vulnerable because the dangerous pattern (URL handling) is present in both. This limitation suggests that contrastive training on vulnerable/fixed pairs could substantially reduce FPR. 5. Discussion The 82.7% recall with 48.8% precision reflects a deliber- ate design choice. Fine-tuned GPT-3.5 achieves higher F1 (71.6% versus 61.4%) by trading recall for precisionâit detects 81.3% of vulnerabilities with 63.9% precision. Our system inverts this trade-off: higher recall (82.7%) at lower precision (48.8%). For security applications, this inversion is favorable: a false negative deploys a vulnerability that may cause a breach, while a false positive costs only the engineer time to review flagged code. The 1.4p recall im- provement means catching approximately 1â2 additional vulnerabilities per 100 that fine-tuned systems miss; the pre- cision cost (48.8% versus 63.9%) means roughly twice as many false positives per true detection. In pre-deployment security audits, the additional reviews are acceptable; the missed vulnerabilities are not. Retrieval augmentation presents an unexpected trade-off. Disabling RAG increases TPR from 82.7% to 92.0% but also increases FPR from 85.0% to 94.1%. The mechanism is instructive: code-level RAG retrieves examples with sim- ilar syntax, which grounds the modelâs analysis in known patterns. This grounding reduces both true positives (novel vulnerabilities not matching retrieved patterns) and false positives (safe code matching vulnerability patterns). For maximum recall at any precision cost, disabling RAG is optimal; for deployment scenarios requiring some precision, RAG provides a modest benefit. Weighted voting offers an alternative operating pointâ37.7% recall with 35.3% FPRâbut this reduces recall below all baselines, negating the architectureâs advantage. The 85% FPR is the primary deployment constraint. This rate stems from the modelâs inability to distinguish vulnera- ble code from its patched counterpart when they differ by a single validation call. The same pattern recognition that enables high recallâdetecting dangerous operations like execute(),eval(),open()âcauses false positives when those operations are properly guarded. The $0.46 per- sample cost and 55-second latency compound this limitation: the system is unsuitable for real-time CI/CD gating, but ap- propriate for targeted audits of high-value code where com- prehensive detection justifies manual review. More broadly, this tension between recall and precision in ensemble sys- tems may generalize beyond vulnerability detectionâany task where agents analyze overlapping failure modes will face similar trade-offs when aggregating verdicts. 4 MultiVer: Zero-Shot Multi-Agent Vulnerability Detection Reducing FPR without sacrificing recall is the central chal- lenge for future work. Contrastive training on vulnera- ble/fixed code pairs could teach the model to recognize protective patterns, directly addressing the patch-confusion failure mode; if such training correctly classified even half of current false positives, FPR would drop from 85% to approximately 43% while maintaining recall. Knowledge- level RAG (Du et al., 2024)âretrieving vulnerability causes and fixes rather than similar codeâachieved 78.9% on Se- curityEval through semantic grounding; adapting this ap- proach could provide the precision benefits our code-level retrieval lacks. Hybrid architectures using faster models for initial screening could reduce cost below $0.10 per sample and latency below 10 seconds while preserving recall on the subset requiring deep analysis. 6. Conclusion Multi-agent ensembles can achieve state-of-the-art recall for vulnerability detection without training data. On PyVul, the four-agent architecture achieves 82.7%±0.6% recall, exceeding fine-tuned GPT-3.5 (81.3%) by 1.4 percentage pointsâthe first zero-shot system to surpass fine-tuned per- formance on this benchmark. On SecurityEval, it reaches 91.7%, matching specialized systems. Ablation experiments isolate the source: security analysis alone achieves 65.7% recall, and the multi-agent ensemble adds 17 percentage points by detecting vulnerabilities that manifest across cor- rectness, performance, and style dimensions. The recall advantage comes at a precision cost. At 48.8% precision with 85% FPR, the system generates approxi- mately one false positive per true detectionâunsuitable for automated CI/CD blocking but acceptable for pre- deployment audits where missed vulnerabilities are costlier than unnecessary reviews. Reducing false positives without sacrificing recallâthrough contrastive training on vulner- able/fixed pairs or knowledge-level retrievalâremains the central challenge for future work. These results demonstrate that for tasks where false nega- tives outweigh false positives, zero-shot multi-agent archi- tectures can outperform fine-tuned models on the metric that matters most. References Alibaba. Codeqwen1.5: An open-source code language model. Technical Report, 2024. 61.8% F1 zero-shot, 66.9% fine-tuned on PyVul. Anthropic. Claude opus 4.5 model card.https://w. anthropic.com/claude/opus-4-5, November 2025. Ding, Y. et al.Vulnerability detection with code lan- guage models: How far are we? arXiv preprint arXiv:2403.18624, April 2024. PrimeVul benchmark showing 68% BigVul drops to 3% on real-world. Du, X., Zheng, G., Wang, K., Zou, Y., Wang, Y., Deng, W., Feng, J., Liu, M., Chen, B., Peng, X., Ma, T., and Lou, Y. Retrieval-augmented vulnerability detec- tion with knowledge-level analysis. arXiv preprint arXiv:2406.11147, June 2024. Vul-RAG: 78.9% Securi- tyEval, retrieves knowledge not code. GitHub. Codeql: Semantic code analysis.https:// codeql.github.com/, 2024. 10.8% detection rate on PyVul. Johnson, J., Douze, M., and J Ì egou, H. Billion-scale simi- larity search with gpus. IEEE Transactions on Big Data, 2019. Kaesberg, S. et al. When to vote, when to debate: Un- derstanding multi-agent llm reasoning. In ACL, 2025. arXiv:2502.19130, voting Âż debate for reasoning tasks. Lekssays, A. et al. Llmxcpg: Combining code property graphs with llm analysis. In USENIX Security, 2025. arXiv:2507.16585, 15-40% F1 improvement. Li, Z. et al. Multi-agent contextual reasoning for vulnerabil- ity detection. arXiv preprint arXiv:2510.00317, October 2025. MAVUL: Cross-function vulnerability tracking. PyCQA. Bandit: Security linter for python.https:// bandit.readthedocs.io/ , 2024. 5.3% detection rate on PyVul. Quan, X., Zhang, T., et al. An empirical study of vulnerabili- ties in python packages and their detection. arXiv preprint arXiv:2509.04260, September 2025. PyVul benchmark: 1,569 real Python vulnerabilities from PyPI. Rajan, S. Multi-agent code verification via information the- ory. arXiv preprint arXiv:2511.16708, November 2025. CodeX-Verify: +39.7p improvement with submodular ensemble. Siddiq, M. L. and Santos, J. C. Securityeval dataset: Min- ing vulnerability examples to evaluate machine learning- based code generators. In MSR4P&S, 2022. 121 synthetic vulnerability samples across 69 CWEs. Tree-sitter.Tree-sitter:An incremental parsing system.https://tree-sitter.github.io/ tree-sitter/, 2024. Wang, X. et al.Self-consistency improves chain of thought reasoning in language models. In ICLR, 2023. arXiv:2203.11171, +10-17% accuracy on reasoning. 5 MultiVer: Zero-Shot Multi-Agent Vulnerability Detection Wang, Z., Li, G., Li, J., Zhu, H., and Jin, Z. Hypothesis- validation paradigm for vulnerability detection. arXiv preprint arXiv:2509.11523, September 2025. VulAgent: Multi-agent hypothesis testing. Zhu, P. et al. Specification-guided vulnerability detection. arXiv preprint arXiv:2511.04014, November 2025. VulIn- struct: 45% F1 on PrimeVul. A. Implementation Details All experiments use Claude Opus 4.5 (claude-opus-4-5- 20251101) with extended thinking enabled and a 10K token budget. The RAG system uses a FAISS index with all- MiniLM-L6-v2 embeddings (384 dimensions). The knowl- edge base contains 1,199 curated examples from CVEFixes, BugsInPy, and synthetic samples. Voting weights are se- curity (0.45), correctness (0.35), performance (0.15), and style (0.05), derived from empirical accuracy measurements. The security agent uses self-consistency with 3 samples at temperatures 1.0, 0.7, and 0.9. Average cost is $0.46 per sample with 55-second latency. All reported results use a fixed test set (202 Python samples: 100 vulnerable, 102 fixed) with 3 independent runs using different random seeds (42, 43, 44) to establish reproducibility. B. Additional Results On SecurityEval (121 samples across 69 CWEs), MUL- TIVER achieves 91.7% detection rate (111/121 vulnerabili- ties), competitive with Aardvark (92%) and exceeding Vul- RAG (78.9%) and GPT-4 (64%). Union voting achieves 82.7% recall with 85% FPR on the balanced PyVul test set; weighted voting achieves 37.7% recall with 35.3% FPR. Disabling RAG increases recall to 92% but also increases FPR to 94%. The choice between configurations depends on whether the application prioritizes recall (security audits) or precision (production triage). C. Per-CWE Analysis Table 3 shows detection rates by CWE category on Securi- tyEval. MULTIVER achieves 100% detection on injection vulnerabilities (CWE-078, 089, 094), cross-site scripting (CWE-079, 080), path traversal (CWE-022), authentication issues (CWE-287, 306, 798), and information disclosure (CWE-200, 209). Lower detection rates occur on input validation edge cases (78%) and cryptographic vulnerabili- ties (80%), where subtle implementation details determine exploitability. Exception handling (CWE-703) achieves 0% detection. These patterns represent code quality issuesâimproper er- ror handling, unchecked return valuesârather than directly Table 3. SecurityEval detection by CWE category. MULTIVER achieves 100% on most security-critical categories; lower rates on edge cases involving subtle implementation details. Category (CWE)Det.Tot.Rate Injection (078, 089, 094)88100% XSS (079, 080)44100% Path Traversal (022)44100% Auth (287, 306, 798)33100% Info Disclosure (200, 209)22100% Deserialization (502)44100% XXE (611)66100% SSRF (918)22100% Open Redirect (601)55100% Crypto (327, 330)4580% Input Valid. (020, 117)7978% Exception (703)030% Overall111 121 91.7% exploitable security vulnerabilities. Detecting them requires understanding API contracts and error propagation that cur- rent LLMs handle poorly without fine-tuning. 6