ARQ: Agentic CodeQL Query Refinement for C/C++ Vulnerability Detection

• URL: http://arxiv.org/abs/2608.20637v1
• Date: Fri, 21 Aug 2026 00:20:55 GMT
• Title: ARQ: Agentic CodeQL Query Refinement for C/C++ Vulnerability Detection
• Abstract summary: We present ARQ, a framework that automatically refines C/C++ CodeQL queries using execution-grounded evidence from synthesized C/C++ programs.<n>Unlike previous query refining methods, ARQ requires no labeled datasets, no commit history, and no vulnerability-specific templates.<n>We show that ARQ-refined queries detect substantially more true positives, by up to 119.8%, with a Precision of at least 98.0% throughout.
• Score: 21.303380348840392
• License: http://creativecommons.org/publicdomain/zero/1.0/
• Abstract: Static analyzers have been widely adopted for vulnerability detection in C/C++ programs. Query-based static analyzers (e.g., CodeQL) encode vulnerable code patterns in detection queries and match them against source code. However, existing queries still suffer from false positives (FPs, incorrectly flagging benign code as vulnerable) and false negatives (FNs, missing real vulnerabilities). We present ARQ, an agentic framework that automatically refines C/C++ CodeQL queries using execution-grounded evidence from synthesized C/C++ programs. Our key insight is that a synthesized program exposes a query's weakness whenever its execution disagrees with the query's verdict. If the program is genuinely vulnerable but the query stays silent, the query has an FN weakness; if the program is safe but the query fires anyway, it has an FP weakness. ARQ then runs an LLM-based refinement loop that repairs the query using these disagreements as ground truth. Unlike previous query refining methods, ARQ requires no labeled datasets, no commit history, and no vulnerability-specific templates. We demonstrate the effectiveness of ARQ by refining 12 official CodeQL queries using three commercial LLMs (GPT-5.4, Claude-Sonnet-4.6, and Gemini-3.5-flash). We compare both ARQ-refined and original CodeQL queries on the Juliet v1.3 and FormAI v2 datasets and show that ARQ-refined queries detect substantially more true positives, by up to 119.8\%, with a Precision of at least 98.0\% throughout. ARQ successfully fixed three unresolved GitHub issues raised in the official CodeQL query repository that had remained open for as long as \textit{27 months}. The refined queries also exposed two previously undiscovered bugs in the real-world libraries libpng and zlib.

Related papers

• Generating Complex Code Analyzers from Natural Language Questions [23.315299132854438]
  We present Merlin, a new system for answering free-form questions that require analytical reasoning about code.<n>We develop a RAG-based iterative query-generation approach and a novel self-test technique.
  arXiv  Detail & Related papers  (2026-05-10T04:02:10Z)
• QRS: A Rule-Synthesizing Neuro-Symbolic Triad for Autonomous Vulnerability Discovery [3.52359746858894]
  We introduce QRS (Query, Review, Sanitize), a neuro-symbolic framework that inverts this paradigm.<n>Rather than filtering results from static rules, QRS employs three autonomous agents that generate CodeQL queries from a structured schema definition and few-shot examples, then validate through semantic reasoning and automated exploit synthesis.<n>In 20 historical CVEs in popular PyPI libraries, QRS 90.6% detection accuracy.
  arXiv  Detail & Related papers  (2026-02-10T13:35:24Z)
• QLCoder: A Query Synthesizer For Static Analysis of Security Vulnerabilities [18.588864089739598]
  QLCoder is an agentic framework that automatically synthesizes queries in CodeQL, a powerful static analysis engine.<n>QLCode embeds an LLM in a synthesis loop with execution feedback, while constraining its reasoning using a custom MCP interface.<n>We evaluate QLCode on 176 existing CVEs across 111 Java projects.
  arXiv  Detail & Related papers  (2025-11-11T17:06:04Z)
• FIRESPARQL: A LLM-based Framework for SPARQL Query Generation over Scholarly Knowledge Graphs [0.5120567378386615]
  We propose a modular framework that supports fine-tuned LLMs as a core component, with optional context provided via RAG and a SPARQL query correction layer.<n>We measure query accuracy using BLEU and ROUGE metrics, and query result accuracy using relaxed exact match(RelaxedEM)<n> Experimental results demonstrate that fine-tuning achieves the highest overall performance, reaching 0.90 ROUGE-L for query accuracy and 0.85 RelaxedEM for result accuracy on the test set.
  arXiv  Detail & Related papers  (2025-08-14T09:08:50Z)
• The benefits of query-based KGQA systems for complex and temporal questions in LLM era [55.20230501807337]
  Large language models excel in question-answering (QA) yet still struggle with multi-hop reasoning and temporal questions.<n> Query-based knowledge graph QA (KGQA) offers a modular alternative by generating executable queries instead of direct answers.<n>We explore multi-stage query-based framework for WikiData QA, proposing multi-stage approach that enhances performance on challenging multi-hop and temporal benchmarks.
  arXiv  Detail & Related papers  (2025-07-16T06:41:03Z)
• Diagnosing and Addressing Pitfalls in KG-RAG Datasets: Toward More Reliable Benchmarking [63.84117489519164]
  Knowledge Graph Question Answering systems rely on high-quality benchmarks to evaluate complex multi-hop reasoning.<n>Despite their widespread use, popular datasets such as WebQSP and CWQ suffer from critical quality issues.<n>We introduce KGQAGen, an LLM-in-the-loop framework that systematically resolves these pitfalls.<n>Our findings advocate for more rigorous benchmark construction and position KGQAGen as a scalable framework for advancing KGQA evaluation.
  arXiv  Detail & Related papers  (2025-05-29T14:44:52Z)
• Effective Instruction Parsing Plugin for Complex Logical Query Answering on Knowledge Graphs [51.33342412699939]
  Knowledge Graph Query Embedding (KGQE) aims to embed First-Order Logic (FOL) queries in a low-dimensional KG space for complex reasoning over incomplete KGs. Recent studies integrate various external information (such as entity types and relation context) to better capture the logical semantics of FOL queries. We propose an effective Query Instruction Parsing (QIPP) that captures latent query patterns from code-like query instructions.
  arXiv  Detail & Related papers  (2024-10-27T03:18:52Z)
• Is Complex Query Answering Really Complex? [28.8459899849641]
  We show that the current benchmarks for CQA might not be as complex as we think.<n>We propose a set of more challenging benchmarks composed of queries that require models to reason over multiple hops.
  arXiv  Detail & Related papers  (2024-10-16T13:19:03Z)
• Is the House Ready For Sleeptime? Generating and Evaluating Situational Queries for Embodied Question Answering [48.43453390717167]
  We present and tackle the problem of Embodied Question Answering with Situational Queries (S-EQA) in a household environment.<n>Unlike prior EQA work, situational queries require the agent to correctly identify multiple object-states and reach a consensus on their states for an answer.<n>We introduce a novel Prompt-Generate-Evaluate scheme that wraps around an LLM's output to generate unique situational queries and corresponding consensus object information.
  arXiv  Detail & Related papers  (2024-05-08T00:45:20Z)
• Allies: Prompting Large Language Model with Beam Search [107.38790111856761]
  In this work, we propose a novel method called ALLIES. Given an input query, ALLIES leverages LLMs to iteratively generate new queries related to the original query. By iteratively refining and expanding the scope of the original query, ALLIES captures and utilizes hidden knowledge that may not be directly through retrieval.
  arXiv  Detail & Related papers  (2023-05-24T06:16:44Z)
• IfQA: A Dataset for Open-domain Question Answering under Counterfactual Presuppositions [54.23087908182134]
  We introduce the first large-scale counterfactual open-domain question-answering (QA) benchmarks, named IfQA. The IfQA dataset contains over 3,800 questions that were annotated by crowdworkers on relevant Wikipedia passages. The unique challenges posed by the IfQA benchmark will push open-domain QA research on both retrieval and counterfactual reasoning fronts.
  arXiv  Detail & Related papers  (2023-05-23T12:43:19Z)
• Language Models are Causal Knowledge Extractors for Zero-shot Video Question Answering [60.93164850492871]
  Causal Video Question Answering (CVidQA) queries not only association or temporal relations but also causal relations in a video. We propose a novel framework, Causal Knowledge Extraction from Language Models (CaKE-LM), leveraging causal commonsense knowledge from language models to tackle CVidQA. CaKE-LM significantly outperforms conventional methods by 4% to 6% of zero-shot CVidQA accuracy on NExT-QA and Causal-VidQA datasets.
  arXiv  Detail & Related papers  (2023-04-07T17:45:49Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.