用问答方式让大模型读懂代码漏洞，解释更清晰。
LLaVul: A Multimodal LLM for Interpretable Vulnerability Reasoning about Source Code
- 将代码与安全问题配对训练，实现上下文感知的漏洞推理。
- 在真实漏洞数据集上，检测准确率超越主流代码大模型。
- 适合安全研究人员和开发人员理解漏洞成因与修复逻辑。
软件系统复杂性提升，对漏洞推理工具的需求日益增长。现有方法多将漏洞分析简化为分类任务，忽视实际场景中的语境依赖性。尽管当前代码大语言模型在代码理解方面表现优异，但普遍缺乏对安全特性的专门推理能力。本文提出 LLaVul，一种面向源代码漏洞解释的多模态大模型，通过问答机制实现细粒度漏洞推理。模型将代码与自然语言安全问题映射至统一空间，增强上下文敏感的漏洞理解。我们构建了一个包含真实漏洞的精选数据集，配套安全导向的问题与答案。实验表明，该模型在问答与漏洞检测任务中均优于现有通用及代码专用大模型。通过定性分析进一步揭示其决策逻辑，展现模型优势与局限。融合代码与问答设计，使漏洞分析过程更具可解释性与安全性。
原文摘要 · Abstract (English)
Increasing complexity in software systems places a growing demand on reasoning tools that unlock vulnerabilities manifest in source code. Many current approaches focus on vulnerability analysis as a classifying task, oversimplifying the nuanced and context-dependent real-world scenarios. Even though current code large language models (LLMs) excel in code understanding, they often pay little attention to security-specific reasoning. We propose LLaVul, a multimodal LLM tailored to provide fine-grained reasoning about code through question-answering (QA). Our model is trained to integrate paired code and natural queries into a unified space, enhancing reasoning and context-dependent insights about code vulnerability. To evaluate our model performance, we construct a curated dataset of real-world vulnerabilities paired with security-focused questions and answers. Our model outperforms state-of-the-art general-purpose and code LLMs in the QA and detection tasks. We further explain decision-making by conducting qualitative analysis to highlight capabilities and limitations. By integrating code and QA, LLaVul enables more interpretable and security-focused code understanding.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。