## 3 Methodology
### Prompting Strategies  
Prompt engineering is a critical component in effectively leveraging LLMs for software vulnerability detection. A well-crafted prompt not only helps guide the model toward accurate and interpretable results but also ensures fairness when comparing models with different architectural characteristics. Although the selected LLMs vary significantly in their reasoning abilities, ranging from non-reasoning models like GPT-4o-Mini, Claude 3.5, and DeepSeek-V3 to reasoning models such as O3-Mini and DeepSeek-R1, a unified prompting strategy is adopted during inference. This approach ensures a fair and consistent evaluation protocol across all models. To accommodate the diverse capabilities of these models, the unified prompt is carefully designed to serve dual purposes. The main actions are presented as a function _DesignUnifiedPromptStrategy()_ using Algorithm 2 in pseudocode form for the Prompt Strategy stage. Algorithm 2 creates a single unified prompt applicable to all models, integrating elements for both reasoning and non-reasoning capabilities based on the prior prompting engineering research. In Line 1 and Line 2, it is essential to reduce ambiguity and provide precise, role-based instructions for non-reasoning models to direct their focus. Building on prior research [39; 40] in prompt engineering, a role-assignment strategy is designed, where the LLM is asked to assume the role of a highly experienced expert in code vulnerability analysis. This role is concatenated with a clearly defined task instruction in Line 3, for example, _\"You are given a C/C++ source code file. Your task is to determine whether it contains any vulnerabilities\"_. For reasoning models, minimal high-level guidance is often sufficient, as these models tend to internally generate a structured thought process before responding. This concept is supported by [PERSON]'s research [49] on Chain-Of-Thought (COT) prompting, which demonstrates that LLMs can effectively perform multi-step reasoning when provided with minimal prompts. COT prompting improves logical consistency and performance on complex decision-making tasks. In Line 4, simple phrases like _\"Please provide your analysis step by step\"_ are included to help the model break down the vulnerability detection process into logical stages. For reasoning models (e.g., O3-Mini, DeepSeek-R1), this guidance encourages step-by-step reasoning for models capable of it. For non-reasoning models (e.g., Claude-3.5-Haiku, GPT-4o-Mini, DeepSeek-V3), this guidance is treated as optional, allowing them to skip structured analysis with constrained reasoning abilities. ```
Function DesignUnifiedPromptStrategy(0 Output:  UnifiedPrompt--Unified prompting strategy for all models begin  1. // Role assignment strategy based on [39; 40] _RoleDescription_\(\leftarrow\) DefineRoleAssignment()  2. _TaskInstruction_\(\leftarrow\) DefineTask()  3. _BasePrompt_ = _RoleDescription_ + _TaskInstruction_  4. // COT prompting strategy based on [49] _ReasoningGuidance_\(\leftarrow\) AddSimpleStepGuidance()  5. // Standardized output requirement _OutputFormat_\(\leftarrow\) StandardizeOutput()  6. // Merge all components into a unified prompt (same for all models)  UnifiedPrompt \(\leftarrow\) Concatenate(BasePrompt, ReasoningGuidance, OutputFormat) returnUnifiedPrompt end
```  
**Algorithm 2**Pseudocode for Prompt Strategy Stage Algorithm  
Moreover, in Line 5, the prompt enforces a standardized output format by requesting a probabilistic estimation of the code's vulnerability status. This enables a quantitative evaluation across different models and supports downstream statistical analysis. Instructions such as \"_Additionally, provide a total probability estimate of the code containing vulnerabilities. If no vulnerabilities are found, the probability should be 0. The probability is a floating-point value between 0 and 1_\". The final unified prompt, concatenated in Line 6 for all inference tasks, is as follows:  
\"_Assume you are a highly experienced expert in code vulnerability analysis.