CognixShield: PoV-Guided Vulnerable API Usage Detection in Large Codebases via LLMs

Abstract

The integration of open-source libraries in Java development introduces severe security risks through vulnerable APIs. Existing program analysis and deep learning tools face the challenge of capturing inter-procedural vulnerability semantics at scale. While LLMs show promise for semantic reasoning, they cannot handle large codebases because of context limits and a lack of vulnerability-specific understanding needed to determine exploitability. We present CognixShield, an LLM-powered framework for detecting vulnerable API usage through three core components. First, semantic-preserving AST-based fragmentation partitions large codebases while maintaining syntactic completeness within LLM context-window limits. Second, vulnerability-aware multi-agent RAG traces relevant program context across these fragments, iteratively assembling security-critical context spanning functions and files. Third, PoV-guided semantic reasoning leverages Proof-of-Vulnerability tests that encode precise triggering conditions and exploitation mechanics for vulnerability determination. CognixShield achieves 84% precision, 95% recall, 84% accuracy, and an 89% F1-score on 57 real-world Java applications, outperforming state-of-the-art tools. Our results show that vulnerability detection requires specialized architectural innovations beyond generic LLM applications.