A new research paper argues that the hidden activations inside code-reading LLMs already contain clues about whether the code in front of them is vulnerable.
Researchers extracted the last prefill-token activations from four LLMs - Granite-4.1-8B, Qwen3.5-9B, Qwen3.6-27B, and Gemma-4-12B - as each model read C/C++ functions, then trained lightweight MLP probes (13.4-16.0 million parameters, under 0.2% of the base model's size) to classify vulnerability status from those activations alone. Tested across four benchmarks - Devign, Big-Vul, Draper VDISC, and PrimeVul - the probes averaged 41.7% F1. The standout result came from Qwen3.5-9B on Devign, which hit 68.8% F1, edging past the published fine-tuned-classifier state of the art of 67.9%. On the harder, more imbalanced benchmarks, the probes fell well short of specialized detectors.
Today's vulnerability screening for AI-written code is bolted on after the fact: static analyzers, fine-tuned classifiers, or another LLM acting as judge, none of which look at what the original model actually represented internally while producing or reading the code. This work suggests a frozen, general-purpose model's own internal state might already carry a cheap, model-native second opinion on code safety, with no task-specific fine-tuning of the base model required.
The catch is that "informative" and "reliable" aren't the same thing. A 41.7% average F1 across benchmarks means these probes still miss more vulnerable code than they catch, and the imbalanced, messier benchmarks - the ones that look more like real codebases - are exactly where the numbers get worse.