ARQ Refines CodeQL Queries With Synthesized Programs, Lifting True Positives by up to 119.8% and Closing a 27-Month-Old GitHub Issue

arXiv 2608.20637·high signalXBlueskyLinkedInCopy link

ARQ (arXiv 2608.20637, Aug 21) refines C/C++ CodeQL queries by synthesizing programs whose execution disagrees with the query verdict, treating that disagreement as ground truth for an LLM repair loop, with no labeled dataset, commit history, or vulnerability templates required. Using GPT-5.4, Claude-Sonnet-4.6 and Gemini-3.5-flash on 12 official queries, refined versions detected up to 119.8% more true positives on Juliet v1.3 and FormAI v2 while holding precision at or above 98.0%. It closed three unresolved issues in the official CodeQL repo, one open for 27 months, and surfaced two previously undiscovered bugs in libpng and zlib.