RAVE-Code: A Risk-Aware Verification Engine for AI-Generated Code Security Using Composite Risk Scoring and CWE-Conditioned Model Checking
TL;DR
This study presents RAVE-Code, a three-layer framework that calibrates the verification effort based on the risk associated with each detected weakness, and demonstrates how consistent two ESBMC configurations rather than agreement with an independent standard can be.
Abstract
: Large Language Models (LLMs) are increasingly being used to generate source code. However, a substantial proportion of their output contains security vulnerabilities. Existing defenses typically apply uniform analysis to all code fragments, irrespective of their risk profiles. This study presents RAVE-Code, a three-layer framework that calibrates the verification effort based on the risk associated with each detected weakness. The Detection layer employs Bandit for pattern-based static analysis, annotating findings with their respective Common Weakness Enumeration (CWE) classes. The Risk Scoring layer calculates a composite risk score for each weakness instance by integrating the Common Vulnerability Scoring System (CVSS) severity, the prevalence of CWEs in AI-generated code, and actual exploitability data. The Verification layer directs each code fragment to an appropriate depth of Bounded Model Checking (BMC) using the Efficient SMT-Based Bounded Model Checker (ESBMC), with solver parameters customized for each CWE class. The framework is evaluated on three public benchmarks. On SecurityEval, Bandit identifies 28.5% of vulnerabilities with zero false positives, establishing a baseline for static analysis coverage. On FormAI, RAVE-Code achieves a detection rate of 86.0% ( F 1 = 0.909), compared to 73.8% ( F 1 = 0.834) for uniform verification, and uniquely detects 41 vulnerabilities that uniform analysis misses. Because FormAI’s labels are based on ESBMC, these results show how consistent two ESBMC configurations rather than agreement with an independent standard. On the Juliet Test Suite, which provides structurally independent ground truth, RAVE-Code achieves a detection rate of 57.3% ( F 1 = 0.614) compared to 40.8% ( F 1 = 0.479), detecting a total of 104 vulnerabilities. Applying all flags uniformly results in a detection rate 18.8 percentage points lower than the proposed per-CWE tailoring. This indicates that detection gains arise from routing rather than flag selection.