{"_canonicalization":{"envelope_id":"axm_ + sha256(envelope minus {signature, axiom_id, anchors})","envelope_signature":"ed25519(envelope minus {signature, axiom_id})","json":"sort_keys=True, separators=(',',':'), ensure_ascii=False, allow_nan=False, utf-8","leaf_hash":"sha256(0x00 || canonical_json(envelope_full))","seal_signature":"ed25519(seal minus {signature, sig_algorithm})"},"axiom_id":"axm_c9befad2fb9d82e514a183c8acf1933c481fdeaf4fd23fb5c3015961249aab48","bitcoin_anchor":{"bitcoin_attestations":[],"calendar_attestations":[],"ots_url":"","stamped_at":"","status":"pending_next_stamp"},"envelope":{"anchors":[{"chain":"crovia.axiom_graph","height":0,"merkle_proof":"spider_vendor_press_v1","root_at_anchor":"spider_vendor_press_v1"}],"axiom_id":"axm_c9befad2fb9d82e514a183c8acf1933c481fdeaf4fd23fb5c3015961249aab48","axiom_type":"AX.OBS","body":{"axiom_subtype":"news.vendor_press.v1","category":"news","fingerprint":"cee3f23a59edcd4c5955e85262b4d0412d35cc8ca5b67f5e8bedae33d2e37964","published":"Thu, 04 Jun 2026 00:00:00 -0400","receipt_hash":"cee3f23a59edcd4c5955e85262b4d0412d35cc8ca5b67f5e8bedae33d2e37964","schema":"spider.news.vendor_press.v1","spider":"vendor_press","spider_record":{"axiom_subtype":"news.vendor_press.v1","category":"news","decision_hint":"POSITIVE","envelope_target":"AX.OBS","fingerprint":"cee3f23a59edcd4c5955e85262b4d0412d35cc8ca5b67f5e8bedae33d2e37964","observed_at":"2026-06-04T04:43:08.243501Z","parent_run_hash":"298818240313a3c9ce3ace3750dbf55845013dc3bc59aeced6331eccefdb61ac","published":"Thu, 04 Jun 2026 00:00:00 -0400","runtime_version":"0.1.0","schema":"spider.news.vendor_press.v1","source_status":200,"source_url":"https://export.arxiv.org/rss/cs.AI","spider":"vendor_press","summary_excerpt":"arXiv:2606.04739v1 Announce Type: cross \nAbstract: Large language models (LLMs) have shown strong potential for automated software vulnerability detection, particularly in retrieval-augmented generation (RAG) settings. However, for approaches relying on proprietary models and APIs, reproducibility and replicability remain largely unexplored, raising the question of whether reported results generalize or depend primarily on specific model choices. In this work, we present a reproducibility study of Vul-RAG, a RAG-based framework for source code vulnerability detection that enhances LLMs with high-level vulnerability knowledge. We first replicate the results in a fully local and open-weights setting using the reported open-weight baseline models. We then extend the evaluation to a diverse set of recent open-weight LLMs, including code-specialized, general-purpose, and reasoning models of varying parameter sizes. The results confirm that the findings of Vul-RAG are reproducible under loca","title":"Revisiting Vul-RAG: Reproducibility and Replicability of RAG-based Vulnerability Detection with Open-Weight Models","url":"https://arxiv.org/abs/2606.04739","vendor":"arxiv_cs_ai"},"summary":"arXiv:2606.04739v1 Announce Type: cross \nAbstract: Large language models (LLMs) have shown strong potential for automated software vulnerability detection, particularly in retrieval-augmented generation (RAG) settings. However, for approaches relying on proprietary models and APIs, reproducibility and replicability remain largely unexplored, raising the question of whether reported results generalize or depend primarily on specific model choices. In this work, we present a reproducibility study of Vul-RAG, a RAG-based framework for source code vulnerability detection that enhances LLMs with high-level vulnerability knowledge. We first replicate the results in a fully local and open-weights setting using the reported open-weight baseline models. We then extend the evaluation to a diverse set of recent open-weight LLMs, including code-specialized, general-purpose, and reasoning models of varying parameter sizes. The results confirm that the findings of Vul-RAG are reproducible under loca","title":"Revisiting Vul-RAG: Reproducibility and Replicability of RAG-based Vulnerability Detection with Open-Weight Models","vendor":"arxiv_cs_ai"},"confidence":{"method":"deterministic"},"decision":"POSITIVE","issued_at":"2026-06-04T04:43:08Z","notes":"Spider vendor_press (news) news.vendor_press.v1","object":{"captured_by":"crovia.spider.vendor_press","primary_source_url":"https://arxiv.org/abs/2606.04739"},"predecessors":[],"schema":"crovia.axiom.v1","signature":"ed25519:e90e8cd748a417fd247533ac353472596c1028bb76f5c074f4b2f1ebfe53121131ee817c61fc601e3b285b81728fe3c7f5ae0750d0cfdf2f1a6ea3b1fdc77b0a","signer":"crovia.substrate","subject":{"observed_at":"2026-06-04T04:43:08Z","source_collector":"spider:vendor_press","target_id":"https://arxiv.org/abs/2606.04739"},"tsa":{"authority":"crovia.substrate.bootstrap","rfc3161_token":"{\"kind\":\"crovia.bootstrap.tsa\",\"source_jsonl\":\"/opt/crovia/spider/data/news/vendor_press_v1.jsonl\",\"source_seal_merkle_root\":\"spider_vendor_press_v1\",\"upgrade_path\":\"Sessione H \\u2014 OpenTimestamps weekly anchor\"}"},"zk_mode":"clear","zk_proof":null},"ledger":{"leaf_hash":"7559d933bee5eecd036bf80b8318adc5b17989a71f643176fbfa865c1ec56809","leaf_index":212718,"ledger_path":"/opt/crovia/substrate/axiom_ledger.jsonl"},"merkle_proof":{"hash_alg":"sha256","leaf_prefix":"0x00","node_prefix":"0x01","odd_leaf_rule":"duplicate_last","path":[{"sibling":"12d636617a0166861ff29a8a0ccccd2c129b70f26d25fc92a851a1721ac2a7a4","side":"right"},{"sibling":"26092ccc1d6d1b2dc66db453a74fa9f1a9b79f575239352b1a71593b22f1af22","side":"left"},{"sibling":"687406d9a705e5664b0cfcc8fe01c7b7cb2be8ca4d39700908e48c95b0e515c2","side":"left"},{"sibling":"095dc4714cc72841a65272855cb957f81047975aa5301aae32898efbb810d939","side":"left"},{"sibling":"769ce86b1089d6ae0d93920e18ac4efa07617f065b2d65137679ab29c0616191","side":"right"},{"sibling":"bd890c71fe702d7d590bb5b603f8932d1e6102b9c963e5889ab47c476b7d3810","side":"left"},{"sibling":"aa2a087d744cdb0fc9ed84d70ba0527bef5f726c738f58a25cae0e735775683f","side":"left"},{"sibling":"2943aa232ba1099978a3aeee29e3e0c39faa6231597512d9c82160e7a5a2db32","side":"left"},{"sibling":"c78f0d662697b816291c956749c41d06c16e4dc4c3d390f9a90590e3f2821765","side":"right"},{"sibling":"cfb460164a914d1f96a36aa17124b45bb5417829d2adbe5ca48375dbd842ec44","side":"left"},{"sibling":"a84ebc8e894a9893ee34d1afc942d15f28243b926f1e5f9d7f10a3de1e795262","side":"left"},{"sibling":"f8f6bd9da448fa097e2115b71146f61691d9f8807aca291c87c633192a7224e9","side":"left"},{"sibling":"2dca509b3eb767a47cf215d4315f230ce9103a76264412008ae23a349b519ef1","side":"left"},{"sibling":"24d1bb4b13e0e46131b27b70a48e65fcf4e2e14b95e3bb83ade821e9df530f6b","side":"left"},{"sibling":"422bcf7e281ca3a607f3726a5e6b8fabdb85e8b32199b4a86356998e260a0b34","side":"right"},{"sibling":"54a99163a4a62374c3ca6fb46294222f1d4b1a9d0b636e27256b0e093e98239a","side":"right"},{"sibling":"c300cf0154c136afc09b1702a0be98f4ba5b6dc5cf57e8cc714ec1eaf4196eff","side":"left"},{"sibling":"d841ad93efda0869e5eb97678f348f03f5caab4353e05ff4bf18f47fb945b822","side":"left"}]},"schema":"crovia.axiom_proof.v1","seal":{"first_collector_run_id":"","first_receipt_hash":"","jsonl_path":"/opt/crovia/substrate/axiom_ledger.jsonl","key_id":"430895f101d38164","last_collector_run_id":"","last_receipt_hash":"","leaf_count":213053,"merkle_root":"19d104b92c4d7299881c447fb8422611fc9cb8615d37a538959e34a2da7ef55f","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","run_id":"hourly_json_retrofit_20260604T053701Z","schema":"crovia.seal.v1","seal_family_version":"crovia-seal-family/1","seal_kind":"substrate_batch","sealed_at":"2026-06-04T05:37:49Z","sig_algorithm":"ed25519","signature":"630748e88645187aa3b4d4cb8c872cc146180d0301e4c6656f15f99081d7776432715cea2a997b32b7b3a5216f215d19c1b536c0b093100ec843fa0bd65f2101","signer_version":"1.1.0"},"trust_root":{"key_id":"430895f101d38164","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","signature_algorithm":"ed25519","url":"/registry/canon/TRUST_ROOT.md"},"verifier":{"spec":"/registry/canon/AXIOM_RECEIPT_v1.md","url":"/v/axm_c9befad2fb9d82e514a183c8acf1933c481fdeaf4fd23fb5c3015961249aab48"}}