融合代码与注释的多模态模型，显著提升漏洞检测泛化能力
Learning Generalizable Multimodal Representations for Software Vulnerability Detection
- 通过双相似性学习与一致性正则化对齐代码与注释表征
- 在4个LLM上实现最高27.07%的F1提升，优于单模态方法
- 适合需要高泛化性的软件安全检测场景
源代码与其注释是互补且自然对齐的模态——代码体现结构逻辑，注释反映开发意图。然而现有漏洞检测方法多依赖单一模态代码表示，忽视了注释中的互补语义信息，从而限制了在复杂代码结构和逻辑关系上的泛化能力。为此，我们提出MultiVul，一种基于双相似性学习与一致性正则化的多模态对比框架，并引入多样化的代码-文本对以增强鲁棒性。在广泛使用的DiverseVul和Devign数据集上，针对四个大语言模型（DeepSeek-Coder-6.7B、Qwen2.5-Coder-7B、StarCoder2-7B、CodeLlama-7B）的实验表明，MultiVul相较提示工程方法最高提升27.07% F1，相较仅使用代码微调提升13.37%，同时保持相当的推理效率。
原文摘要 · Abstract (English)
Source code and its accompanying comments are complementary yet naturally aligned modalities-code encodes structural logic while comments capture developer intent. However, existing vulnerability detection methods mostly rely on single-modality code representations, overlooking the complementary semantic information embedded in comments and thus limiting their generalization across complex code structures and logical relationships. To address this, we propose MultiVul, a multimodal contrastive framework that aligns code and comment representations through dual similarity learning and consistency regularization, augmented with diverse code-text pairs to improve robustness. Experiments on widely adopted DiverseVul and Devign datasets across four large language models (LLMs) (i.e., DeepSeek-Coder-6.7B, Qwen2.5-Coder-7B, StarCoder2-7B, and CodeLlama-7B) show that MultiVul achieves up to 27.07% F1 improvement over prompting-based methods and 13.37% over code-only Fine-Tuning, while maintaining comparable inference efficiency.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。