用费舍尔信息筛选关键特征,实现更精准的漏洞检测融合。
Focus on What Matters: Fisher-Guided Adaptive Multimodal Fusion for Vulnerability Detection
- 基于费舍尔信息选择性融合代码与图结构特征,避免冗余噪声。
- 在BigVul等数据集上提升6.3%的F1分数,延迟仅增加3.4%。
- 适合关注模型效率与准确率平衡的漏洞检测研究者。
软件漏洞检测可视为二分类问题,判断代码片段是否含安全缺陷。现有多模态方法通常将预训练模型提取的自然代码序列(NCS)与图神经网络提取的代码属性图(CPG)表示进行融合,隐含假设引入新模态必然带来信息增益。通过实证分析发现,该假设存在局限:预训练模型已隐式编码大量结构信息,导致两模态高度重叠;且图编码器在特征提取上普遍弱于预训练语言模型。因此,简单融合不仅难以获取互补信号,还可能因噪声传播稀释有效判别特征。为此,我们提出一种任务相关的互补融合策略,利用费舍尔信息量化任务相关性,将跨模态交互从全谱匹配转化为任务敏感子空间内的选择性融合。理论分析表明,在各向同性扰动假设下,该策略显著收紧了输出误差的上界。基于此,设计了TaCCS-DFA框架,结合在线低秩费舍尔子空间估计与自适应门控机制,实现高效的任务导向融合。在BigVul、Devign和ReVeal基准上的实验表明,TaCCS-DFA在F1分数上最高提升6.3个百分点,推理延迟仅增加3.4%,同时保持低校准误差。
原文摘要 · Abstract (English)
Software vulnerability detection can be formulated as a binary classification problem that determines whether a given code snippet contains security defects. Existing multimodal methods typically fuse Natural Code Sequence (NCS) representations extracted by pretrained models with Code Property Graph (CPG) representations extracted by graph neural networks, under the implicit assumption that introducing an additional modality necessarily yields information gain. Through empirical analysis, we demonstrate the limitations of this assumption: pretrained models already encode substantial structural information implicitly, leading to strong overlap between the two modalities; moreover, graph encoders are generally less effective than pretrained language models in feature extraction. As a result, naive fusion not only struggles to obtain complementary signals but can also dilute effective discriminative cues due to noise propagation. To address these challenges, we propose a task-conditioned complementary fusion strategy that uses Fisher information to quantify task relevance, transforming cross-modal interaction from full-spectrum matching into selective fusion within a task-sensitive subspace. Our theoretical analysis shows that, under an isotropic perturbation assumption, this strategy significantly tightens the upper bound on the output error. Based on this insight, we design the TaCCS-DFA framework, which combines online low-rank Fisher subspace estimation with an adaptive gating mechanism to enable efficient task-oriented fusion. Experiments on the BigVul, Devign, and ReVeal benchmarks demonstrate that TaCCS-DFA delivers up to a 6.3-point gain in F1 score with only a 3.4% increase in inference latency, while maintaining low calibration error.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。