Evaluating and enhancing the vulnerability reasoning capability of large language models

The research proposes the DAGVul framework, which models LLM vulnerability reasoning as a directed acyclic graph (DAG) generation task, improving reasoning F1 score by an average of 18.9% over all baselines. Benchmark evidence shows that state-of-the-art models often give correct verdicts based on hallucinated logic while deviating from the true root cause, with 12 systematic failure modes. Its 8B-parameter version surpasses Qwen3-30B-Reasoning and GPT-OSS-20B-High, and at 75.47% approaches Claude-Sonnet-4.5's 76.11%.