This paper presents a system combining symbolic execution (KLEE) with a 4-agent multi-LLM architecture for detecting memory vulnerabilities in Rust unsafe code. A central challenge we address is the incomplete-code problem: CVE database entries provide only isolated code snippets that lack struct definitions, imports, and Cargo manifests, causing all existing formal verification tools to fail at compilation with zero output. Our system resolves this through four specialized agents -- an Oracle/Validator for strategic planning, a Safety Checker for vulnerability analysis, a Code Specialist for FFI wrapper generation, and a Fast Filter for execution optimization -- that collaboratively synthesize KLEE-compatible harnesses from otherwise uncompilable fragments. KLEE's output is then ingested by graph_klee.py, which constructs a Graph Database linking CVE files, CWE categories, error types, and symbolic execution paths as typed nodes and labelled edges, enabling structured cross-CVE vulnerability queries. We evaluated our system on 31 real-world Rust CVEs spanning 11 CWE categories, achieving 90.3% wrapper compilation success where all state-of-the-art formal verification tools achieve 0%. Our system detected 1,206 critical errors across 26 files (83.9% detection rate), compared to 14 warnings across 11 files for Clippy (35.5%) and generic labels for Miri. The 4-agent architecture reduced wrapper compilation failures from 42% (single-agent baseline) to 9.7% and increased detected errors from 487 to 1,206, confirming that role specialization and structured context passing produce measurably better results than a single general-purpose model. Our replication package is publicly available at https://github.com/Zeyad-Ab/Symbolic-Execution-with-Multi-LLM-Architecture-for-Rust-Security

翻译：本文提出了一种结合符号执行（KLEE）与四智能体多LLM架构的系统，用于检测Rust不安全代码中的内存漏洞。我们解决的核心挑战是不完整代码问题：CVE数据库条目仅提供孤立代码片段，缺乏结构体定义、导入声明和Cargo清单，导致所有现有形式化验证工具在编译时失败且无任何输出。我们的系统通过四个专业化智能体解决这一问题——Oracle/验证器负责战略规划、安全检查器负责漏洞分析、代码专家负责FFI包装器生成、快速过滤器负责执行优化——它们协同合成为原本不可编译的代码片段合成KLEE兼容的测试夹具。KLEE的输出随后由graph_klee.py处理，该脚本构建一个图形数据库，将CVE文件、CWE类别、错误类型和符号执行路径作为类型化节点和带标签边进行关联，从而实现跨CVE的结构化漏洞查询。我们在涵盖11个CWE类别的31个真实世界Rust CVE上评估了本系统，实现了90.3%的包装器编译成功率，而所有最先进的形式化验证工具均达到0%的成功率。本系统在26个文件中检测到1,206个关键错误（检测率83.9%），相比之下Clippy在11个文件中生成14个警告（检测率35.5%），Miri仅提供通用标签。四智能体架构将包装器编译失败率从42%（单智能体基线）降至9.7%，并将检测到的错误从487个增加到1,206个，证实了角色专业化与结构化上下文传递比单个通用模型能产生更显著的优势。我们的可复现包已公开于https://github.com/Zeyad-Ab/Symbolic-Execution-with-Multi-LLM-Architecture-for-Rust-Security