Skip to content

LibVulnWatch: A Deep Assessment Agent System and Leaderboard for Uncovering Hidden Vulnerabilities in Open-Source AI Libraries

🕒 Published (v1): 2025-05-13 12:58 UTC · Source: Arxiv · Venue: ACL 2025 · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

LibVulnWatch is a DAG-orchestrated multi-agent system that performs deep, multi-domain security assessments of open-source AI libraries across five risk domains (licensing, security, maintenance, dependency management, regulatory compliance). It uses iterative evidence retrieval with quality-check loops per domain, runs domains in parallel, synthesizes findings into a scored report, and publishes to a public leaderboard. Applied to 20 AI libraries, it surfaces up to 19 novel findings per library beyond what static tools like OpenSSF Scorecard detect.

Problem

Conventional open-source risk assessment tools (e.g., OpenSSF Scorecard) perform surface-level, rule-based checks and lack the contextual depth to uncover nuanced vulnerabilities—such as RCE chains from insecure defaults, SBOM absence, or regulatory compliance gaps under GDPR/AI Act—in the AI software supply chain. No existing tool integrates evidence from heterogeneous sources (repositories, CVE databases, documentation, regulatory frameworks) with LLM reasoning in a reproducible, governance-aligned pipeline.

Method

LibVulnWatch implements a DAG-based agentic workflow (built on LangGraph/Open Deep Research) with the following stages:

  1. Planning: An Assessment Planner agent generates a structured plan and initial queries for the five risk domains.
  2. Parallel Iterative Evidence Gathering (per domain): Each domain runs independently through a loop: query generation → evidence retrieval (Google Search API, repository metadata, CVE databases) → draft findings → quality check (QC). If QC fails and depth limit \(k\) is not reached, the loop re-queries with refined prompts.
  3. Synthesis: A final agent consolidates domain drafts into a unified report with executive summary, risk dashboard, emergency issues, and mitigation strategies.
  4. Benchmark Validation: The target library's GitHub repository is identified, OpenSSF Scorecard is run, and an LLM compares Scorecard output against the agent report to compute Baseline Alignment (%) and Novelty Yield (#).
  5. Public Reporting: Validated reports are programmatically published to a Gradio/Hugging Face Spaces leaderboard, dynamically ranking libraries by composite Trust Score.

Risk scoring uses a 1–5 scale per domain. The composite Trust Score is: $\(\text{Trust}(l) = \frac{1}{5}\sum_{d \in \{\text{Li, Se, Ma, De, Re}\}} d(l)\)$

All experiments used gpt-4.1-mini at ~$0.10 per library.

Key Contributions

  • A DAG-orchestrated, five-domain multi-agent assessment framework for open-source AI library risk, with iterative evidence retrieval and QC loops per domain.
  • Formal metrics for evaluating agentic assessment: Baseline Alignment (overlap with OpenSSF Scorecard) and Novelty Yield (unique contextual findings beyond the baseline).
  • Evaluation of 20 AI libraries (ML frameworks, LLM inference engines, agent orchestration tools) with reproducible, governance-aligned Trust Scores.
  • A public leaderboard (Hugging Face Spaces) enabling continuous ecosystem monitoring and transparent library comparison.
  • Demonstration that LLM-driven contextual reasoning surfaces qualitatively distinct risks (RCEs, undocumented telemetry, regulatory gaps, patent risks) that rule-based scanners miss.

Results

  • Baseline Alignment: 55–88% coverage of applicable OpenSSF Scorecard checks across libraries; category averages: Core ML/DL 77.1%, LLM Inference & Orchestration 73.7%, AI Agent Frameworks 76.2%.
  • Novelty Yield: 5–19 unique findings per library beyond the Scorecard; category averages: Core ML/DL 6.8, LLM Inference & Orchestration 7.8, AI Agent Frameworks 9.1.
  • LangChain had the highest Novelty Yield (19); PyTorch and Browser Use had the highest Baseline Alignment (88.2%); MetaGPT had the lowest alignment (57.1%).
  • Trust Scores (1–5 composite): Core ML/DL frameworks generally scored higher (e.g., PyTorch 13/25) than newer agent frameworks (e.g., MetaGPT 9/25, SmolAgents 9/25).
  • Dependency Management was universally weak: all 20 libraries scored 1/5 on the De domain, indicating near-universal SBOM absence.
  • Agent frameworks showed worse regulatory scores than mature ML frameworks.

Limitations

  • The agent did not consistently match all OpenSSF Scorecard checks (e.g., missed formal contributor declarations, CI testing evidence, binary artifact identification, explicit security testing policies).
  • Reliance on gpt-4.1-mini and Google Search API introduces potential for hallucination and retrieval gaps; no formal false-positive rate is reported.
  • Coverage is bounded by search depth \(k\) and the availability of public documentation; private or opaque repositories may yield incomplete assessments.
  • The system was evaluated on only 20 libraries; generalization to the broader ecosystem is unquantified.
  • Responsible disclosure workflow for novel non-public vulnerabilities is mentioned but not formally described.

Relevance to Harnesses / Meta-Harnesses

LibVulnWatch is a textbook domain-specific meta-harness: it composes a planning agent, parallel domain-specialist sub-agents with iterative retrieval-and-QC loops, a synthesis agent, and a validation agent into a reproducible DAG pipeline—exactly the structure that harness/meta-harness research formalizes. The explicit separation of orchestration logic (DAG, QC loops, depth limits) from domain prompts makes it a concrete instantiation of the "specialized agent + controller" pattern. Its Baseline Alignment / Novelty Yield metrics offer a methodology for benchmarking agentic harnesses against established static tools—a reusable evaluation template for meta-harness research. The cost-per-run transparency ($0.10/library) and public leaderboard publication also model how production meta-harnesses can be made accountable and continuously operating.