Behavior Trees offer compact alternative to code trees for spotting vulnerabilities with smaller AI models

Researchers are exploring how to make vulnerability detection work better with smaller, locally-deployed language models by changing how source code is represented to the AI system.

The challenge with current approaches#

When using Large Language Models for spotting security flaws in code, the way you feed the source code into the model matters significantly. Most existing methods feed code as-is, while others convert it into Abstract Syntax Trees (ASTs)—detailed structural representations that capture all the grammatical details. However, ASTs create a problem: they're verbose and consume many tokens, often exceeding the token limits of lightweight models that organizations want to run locally.

A more efficient alternative#

The research proposes Behavior Trees (BTs) as a leaner middle ground. Unlike ASTs, Behavior Trees encode control flow, conditional branches, and executable operations in a more space-efficient way. This makes them a practical fit for quantized versions of smaller language models that have tighter context windows.

Testing and results#

The team tested three approaches on 460 Java code samples from the Juliet Java test suite using Mistral Small 3.2 24B (a quantized local model):

• Raw source code achieved the highest precision
• Behavior Trees showed better recall on shorter code snippets and superior overall performance on longer samples
• ASTs often ran out of context window space on lengthier code

Why it matters#

This work suggests that Behavior Trees can enable organizations to run effective vulnerability detection using smaller, quantized models deployed locally—without needing expensive cloud-based AI infrastructure or sacrificing detection quality on realistic code sizes.