Evaluating Adversarial Robustness of Knowledge-Level RAG For Vulnerability Detection With Open-Weight Llms

Abstract

Knowledge-level Retrieval-Augmented Generation (RAG) has recently been shown to substantially improve LLM-based vulnerability detection by grounding predictions in distilled, historical vulnerability and fix knowledge, a framework introduced as Vul-RAG, and follow-up work has confirmed that these gains reproduce on open-weight, rather than only proprietary, LLMs. Independently, work on the robustness of retrieval-augmented language models (RALMs) has shown that imperfect retrieval, whether unanswerable, adversarial, or conflicting retrieved documents, severely degrades RALM performance in open-domain question answering. These two lines of work have not previously been brought together, since no existing study measures how a knowledge-level vulnerability RAG pipeline, built and evaluated on open-weight LLMs, behaves when its retrieved vulnerability-knowledge items are themselves adversarial, contradictory, or irrelevant. This paper unifies the two topics into a single study, formalizes the resulting research gap, and reports a pilot run of a Colab-reproducible implementation on the real public Vul-RAG Linux-kernel CVE benchmark released by Du et al. Using Qwen2.5-7B-Instruct as both the knowledge-distillation and detection model, the pilot finds that the knowledge-level RAG detector’s accuracy on held-out CVEs is dominated by a severe bias toward predicting code as not vulnerable, with zero percent recall on the vulnerable class under clean retrieval against 93.3 percent recall on the patched class. This bias produces a floor effect in which aggregate accuracy barely moves under GenADV-style adversarial injection, under conflicting-knowledge injection, or under degraded retrieval; the Matthews correlation coefficient for the vulnerable class is in fact negative under clean, adversarial, and conflicting retrieval, indicating worse-than-chance detection rather than mere insensitivity to the attacks. The paper argues that this null robustness signal is itself an informative finding, since at pilot scale aggregate accuracy alone cannot distinguish a robust detector from a degenerate one, and future evaluation of this threat model must report class-conditional recall and confusion-matrix-derived metrics rather than accuracy alone. A second open-weight model, Llama-3.2-3B-Instruct, could not be evaluated in this run because of a Hugging Face gated-repository authentication failure, which is reported here as an execution limitation rather than as a result.