arXiv:2506.07390cs.AIcs.SE2025-06ACL被引 16

用合成推理数据提升大模型漏洞检测能力,效果显著优于现有方法。

Boosting Vulnerability Detection of LLMs via Curriculum Preference Optimization with Synthetic Reasoning Data

  • 通过正反向推理生成高质量漏洞分析数据
  • 在两个数据集上准确率提升12.24%至22.77%
  • 适合安全研究者和漏洞检测工具开发者

大型语言模型在编程任务中表现优异,但在漏洞检测方面仍受限。主要原因在于缺乏漏洞相关推理数据,且模型更关注语义表征而非深层原因,难以识别语义相似的漏洞样本。此外,专用漏洞检测模型的训练因高质量数据稀缺而困难。本文提出新框架ReVD,通过合成漏洞推理数据并进行针对性偏好优化,构建前后向推理链与对应代码,实现高质量数据生成;结合三元组监督微调与课程式在线偏好优化,增强模型对漏洞模式的理解。在PrimeVul和SVEN数据集上的实验表明,ReVD达到当前最优性能,准确率提升12.24%至22.77%。代码与数据已开源。

原文摘要 · Abstract (English)

Large language models (LLMs) demonstrate considerable proficiency in numerous coding-related tasks; however, their capabilities in detecting software vulnerabilities remain limited. This limitation primarily stems from two factors: (1) the absence of reasoning data related to vulnerabilities, which hinders the models' ability to capture underlying vulnerability patterns; and (2) their focus on learning semantic representations rather than the reason behind them, thus failing to recognize semantically similar vulnerability samples. Furthermore, the development of LLMs specialized in vulnerability detection is challenging, particularly in environments characterized by the scarcity of high-quality datasets. In this paper, we propose a novel framework ReVD that excels at mining vulnerability patterns through reasoning data synthesizing and vulnerability-specific preference optimization. Specifically, we construct forward and backward reasoning processes for vulnerability and corresponding fixed code, ensuring the synthesis of high-quality reasoning data. Moreover, we design the triplet supervised fine-tuning followed by curriculum online preference optimization for enabling ReVD to better understand vulnerability patterns. The extensive experiments conducted on PrimeVul and SVEN datasets demonstrate that ReVD sets new state-of-the-art for LLM-based software vulnerability detection, e.g., 12.24\%-22.77\% improvement in the accuracy. The source code and data are available at https://github.com/Xin-Cheng-Wen/PO4Vul.

漏洞检测大模型推理生成偏好优化

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。