RAVE-Code: A Risk-Aware Verification Engine for AI-Generated Code Security Using Composite Risk Scoring and CWE-Conditioned Model Checking
Maher Alharby1,*, Ali Alssaiari2,3
1 Department of Cybersecurity, College of Computer Science and Engineering, Taibah University, Madinah, Saudi Arabia
2 Computer Science Department, College of Science and Arts at Sharoura, Najran University, Sharurah, Saudi Arabia
3 Scientific and Engineering Research Center, Najran University, Najran, Saudi Arabia
* Corresponding Author: Maher Alharby. Email: 
Computers, Materials & Continua https://doi.org/10.32604/cmc.2026.084639
Received 27 April 2026; Accepted 12 June 2026; Published online 02 July 2026
Abstract
Large Language Models (LLMs) are increasingly being used to generate source code. However, a substantial proportion of their output contains security vulnerabilities. Existing defenses typically apply uniform analysis to all code fragments, irrespective of their risk profiles. This study presents RAVE-Code, a three-layer framework that calibrates the verification effort based on the risk associated with each detected weakness. The Detection layer employs Bandit for pattern-based static analysis, annotating findings with their respective Common Weakness Enumeration (CWE) classes. The Risk Scoring layer calculates a composite risk score for each weakness instance by integrating the Common Vulnerability Scoring System (CVSS) severity, the prevalence of CWEs in AI-generated code, and actual exploitability data. The Verification layer directs each code fragment to an appropriate depth of Bounded Model Checking (BMC) using the Efficient SMT-Based Bounded Model Checker (ESBMC), with solver parameters customized for each CWE class. The framework is evaluated on three public benchmarks. On SecurityEval, Bandit identifies 28.5% of vulnerabilities with zero false positives, establishing a baseline for static analysis coverage. On FormAI, RAVE-Code achieves a detection rate of 86.0% (
F1=0.909), compared to 73.8% (
F1=0.834) for uniform verification, and uniquely detects 41 vulnerabilities that uniform analysis misses. Because FormAI’s labels are based on ESBMC, these results show how consistent two ESBMC configurations rather than agreement with an independent standard. On the Juliet Test Suite, which provides structurally independent ground truth, RAVE-Code achieves a detection rate of 57.3% (
F1=0.614) compared to 40.8% (
F1=0.479), detecting a total of 104 vulnerabilities. Applying all flags uniformly results in a detection rate 18.8 percentage points lower than the proposed per-CWE tailoring. This indicates that detection gains arise from routing rather than flag selection.
Keywords
AI-generated code security; bounded model checking; vulnerability detection; risk prioritisation; static analysis; CWE; DevSecOps; formal verification
Open Access
Login
Register
Submit a Paper
Propose a Special lssue
Download PDF
Downloads
Citation Tools
