Internal probe for language models uncovers code vulnerabilities in a second and outperforms agents

While software development teams race to employ AI agents for code generation at speeds that exceed developers’ ability to review them, the biggest security challenge emerges: the cost of fixing a vulnerability doubles the later it is discovered in the system’s lifecycle. Software testing requires a first line of defense capable of scanning every new function in real time. However, the testing tools available today leave engineers with two limited options: either rely on fast detectors that query the models directly but lack precision and context, or turn to smart agents that act as security experts in code inspection, trace its paths, and test hypotheses, yet they take several minutes of compute per function, a duration that is far too long and hampers instantaneous auditing.

In a new research paper titled “REVA”, we report that researchers Amin Labat and Maseeh Reza Amini introduced a novel architecture for real-time vulnerability detection that integrates security context and code understanding within a single forward pass of a large language model. The system feeds the model a pre-computed threat model for the software unit, lightweight static-analysis results, and call-graph information. Instead of asking the model to produce a direct textual judgment, REVA uses a trained probe to read the model’s internal neural representations while it processes the new code function in this context.

Laboratory results have shown that models store the security inference in their internal layers before translating it into words.When the system was evaluated on the PrimeVul benchmark using the open-source GLM-5.3-Flash model, REVA achieved an accuracy of about 60.0 % in roughly one second per function. This result matched the efficiency of the leading agent-based detector VulTriage, which recorded 59.2 % on the same model, but REVA did so at more than 250 times the speed of the agent and with compute cost less than one-tenth of its cost.

The technical surprise revealed by the experiments was that probing the internal representations outperformed the model’s own answers; the probe recorded an accuracy higher by 14 to 17 percentage points compared with the direct judgment issued by the model using the same prompt. When the technique was tested across three open-source language models, REVA achieved accuracy comparable to or exceeding that of VulTriage, delivering roughly a 10 % gain in two of them, which demonstrates that the model’s internal weights capture what the agent aggregates over multiple reasoning passes without incurring the agent’s computational latency.

This development reshapes technical priorities in development environments within banks, fintech firms, and digital-transformation platforms across the Gulf, Egypt, and the Levant. If you lead a software team that relies on code-generation agents to boost productivity, the real bottleneck shifts from writing speed to ensuring that code is free of defects before it reaches production servers. Running a security agent that takes several minutes and accumulates compute charges per function is a path that cannot be applied in rapid-release pipelines, whereas probe-based testing enables instant cyber-guarding of locally hosted open models, allowing companies to lower infrastructure costs and meet strict data-protection regulations without hindering developers.

Moving from multi-turn dialogue with agents to probing internal weights opens a practical path for automating software testing.This architecture gives engineering teams a way to enforce strict oversight of automatically generated code in one second, confirming that shortening processing time does not require sacrificing security accuracy.