Pith. sign in

REVIEW 5 major objections 5 minor 60 references

Improving vulnerability type prediction and line-level detection via adversarial training-based data augmentation and multi-task learning

T0 review · 5 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read EDAT-MTL: a single training pipeline with adversarial identifier-embedding perturbation and multi-task learning beats separate state-of-the-art models on both vulnerability type prediction and line-level detection.

desk verdict A plausible applied ML combination with a real evaluation flaw: the random function-level split of Big-Vul likely leaks same-CVE code into test, so the headline gains are not yet credible. read the letter →

arxiv 2506.23534 v1 pith:X3SN7MEK submitted 2025-06-30 cs.SE

Siyu Chen , Jiongyi Yang , Xiang Chen , Menglin Zheng , Minnan Wei , Xiaolin Ju This is my paper
classification cs.SE
keywords vulnerabilitytypepredictionline-leveldetectionadversarialtrainingmulti-tasklearningidentifierembeddingBig-VuldatasetCWEclassificationcodepre-trainedmodels
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that vulnerability type prediction and line-level vulnerability detection should be solved jointly, not separately, and that adversarially perturbing identifier embeddings is a safer data-augmentation strategy than token- or character-level edits. It proposes a framework, EDAT-MTL, that injects semantic-importance-weighted adversarial noise into identifier embeddings under AST and PDG constraints, and trains a shared encoder for both tasks with an uncertainty-aware loss balance. On the Big-Vul dataset, the framework claims large gains over the previous state of the art in both tasks, including a 33.2 percent F1 improvement over LIVABLE on type prediction and a 157.4 percent Top-5 accuracy improvement over LineVD on line-level detection. The authors see this as evidence that task correlation and semantic-preserving augmentation jointly mitigate data scarcity and class imbalance.

What carries the argument

The load-bearing mechanism is identifier-embedding perturbation under structural constraints, combined with a shared-encoder multi-task head. EDAT (Embedding-Layer Driven Adversarial Training) perturbs token embeddings of variables and function names using multi-step projected gradient descent, with noise scaled by attention scores and constrained so that AST and PDG structures, and therefore control and data dependencies, are preserved. MLT (Multi-task Learning) joins the two prediction heads with a shared encoder, injecting each task's prediction as an attention bias for the other and weighting the two losses by an uncertainty measure. Together they let the model learn renaming- and formatting-invariant semantics while exploiting the mutual information between a vulnerability's type and its line-level location.

What would settle it

Re-run the VTP and LVD comparisons on a Big-Vul split where no two functions originate from the same CVE and no pair of functions has more than, say, 80 percent normalized token overlap across the train/test boundary; if EDAT-MTL's F1 and Top-5 accuracy advantages over LIVABLE, VulExplainer, LineVD, and LineVul largely disappear, the central generalization claim would be refuted.

Watch

Extended reading notes

Core claim

The central claim is that a single training pipeline can outperform specialized single-task models on both vulnerability-type classification and vulnerable-line localization, because the two tasks share underlying structural semantics. EDAT works by adding gradient-guided perturbations only to the embeddings of identifiers (variables and functions), with perturbation magnitude scaled by the identifier's attention-based importance and vetted against abstract-syntax-tree and program-dependency-graph constraints, so that augmented samples remain functionally valid. The MTL module ties the tasks together through a shared encoder, PDG-based masking, cross-task attention fusion, and an adaptive loss weight derived from prediction entropy and variance. The paper's ablation studies attribute the gains to both modules, with EDAT most useful for rare and long-tail CWE types and MTL most useful for reducing inspection effort in line localization.

Load-bearing premise

The evaluation rests on a random 8:1:1 stratified split of Big-Vul functions with no reported deduplication by CVE or code similarity, so if similar or same-CVE code appears in both training and test sets, the reported improvements could overstate generalization to unseen vulnerabilities.

Editorial extensions

If this is right

  • Vulnerability type prediction and line-level detection can be trained in one network without hurting either task, so future detectors can treat them as complementary objectives instead of separate pipelines.
  • Perturbing identifiers at the embedding layer, rather than rewriting tokens, yields adversarial examples that preserve program validity, which should apply to other code-understanding tasks where syntax must be retained.
  • The reported reductions in Initial False Alarm (for example, from 12.46 to 2.79 on CodeBERT) mean a developer inspecting a flagged function sees a true vulnerable line much sooner, lowering manual audit cost.
  • Because gains appear on CodeBERT, GraphCodeBERT, and CodeT5, the design is not tied to a specific pretrained encoder and could be layered on newer code models.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's split does not appear to deduplicate by CVE or by code similarity, so part of the reported margin may come from near-identical functions sitting in both training and test; a deduplicated or cross-repository split would give a clearer estimate of real-world generalization.
  • Identifier-renaming robustness is exactly what EDAT induces in embedding space, so the same augmentation may help tasks like clone detection or code search, where identifier variation is a known nuisance.
  • The uncertainty-based loss weighting between type and line tasks is a reusable recipe for any two correlated code-analysis tasks, such as defect prediction plus repair suggestion.
  • A direct test of EDAT's semantic-preservation claim would be to feed the augmented samples to a compiler or interpreter: if perturbed embeddings correspond to renamed identifiers that compile and execute equivalently, the AST/PDG constraints are doing their job.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes EDAT-MTL, a framework that combines embedding-layer adversarial training (EDAT) with multi-task learning (MTL) for two tasks: vulnerability type prediction (VTP) and line-level vulnerability detection (LVD). EDAT perturbs identifier embeddings with attention-weighted Gaussian noise refined by multi-step PGD, claiming AST/PDG-based semantic preservation; MTL shares an encoder across VTP and LVD with uncertainty-based loss weighting. Experiments on Big-Vul using CodeBERT, GraphCodeBERT, and CodeT5 report consistent improvements over LIVABLE and VulExplainer for VTP and over LineVD and LineVul for LVD, with ablations separating the EDAT and MTL contributions. The GitHub repository provides dataset, scripts, and results.

Significance. If the reported improvements are valid, the contribution is practically useful: a single training pipeline improves both coarse-grained vulnerability type classification and fine-grained line localization, and the public artifact supports reproducibility. Strengths include evaluation across three pre-trained code models, a broad set of VTP and LVD metrics, and explicit ablation studies for both proposed modules. However, the central empirical claim currently rests on a single random split and single training runs, and several load-bearing details (the AST/PDG preservation mechanism, the inconsistency in the perturbation bound, and the choice of baselines) are not yet resolved. The work is potentially suitable for Information and Software Technology after a major revision that addresses the evaluation-validity concerns.

major comments (5)
  1. [Section 4.6] The dataset is partitioned by random stratified function-level sampling, and no deduplication by CVE ID, repository, or code similarity is described. Big-Vul contains 3,754 CVEs and 11,823 vulnerable functions (Table 1), so the same CVE or repository frequently contributes multiple similar vulnerable functions; a random function-level split is therefore highly likely to place near-duplicate functions in both training and test sets. This violates the independence needed for the test set and could materially inflate the F1-score of 0.7281 and Top-5 accuracy of 0.6047 in Tables 3 and 4. A leak-free split (e.g., grouping by CVE or repository) or a demonstration that no same-CVE/same-repository overlap occurs is required before the claim that EDAT-MLT consistently outperforms all baselines is established.
  2. [Sections 4.6, 5.2.1, 5.2.2, and Table 8] The main experimental settings state epsilon = 0.02 for the PGD perturbation bound (Section 4.6), but the EDAT ablation in Sections 5.2.1 and 5.2.2 repeatedly reports using epsilon = 0.03, while the sensitivity analysis in Table 8 returns to 0.02 as optimal. Since EDAT is the paper's core novelty, the ablation that isolates EDAT should use the same hyperparameter configuration as the main comparison, or the discrepancy must be explicitly justified. As written, the reader cannot tell whether the ablation numbers reflect a different method variant than the headline results.
  3. [Section 3.2.2 and Algorithm 1] The AST/PDG semantic-preservation mechanism is asserted but never operationalized. In the text, Step 4 says perturbations violating AST/PDG constraints are discarded, but Algorithm 1 contains no such check; the pseudocode only performs Gaussian initialization and PGD updates on embedding positions. In addition, Eq. (1) uses an attention-based importance score alpha_i without specifying how alpha_i is computed or from which model it comes, and Algorithm 1 references two models Ma and Mc that are not defined. Because the paper's stated advantage over prior data augmentation is semantic preservation, the absence of a precise, reproducible specification of this mechanism is load-bearing and must be fixed.
  4. [Section 4.4 and Section 7] The baseline comparison omits the closest prior multi-task vulnerability detection work. Section 7 cites COMPDIRECT, JIT-Smart, and SIFT as existing multi-task frameworks for defect prediction or vulnerability detection, yet Section 4.4 only compares against single-task baselines (VulExplainer, LIVABLE, LineVD, LineVul). The claim that EDAT-MTL consistently outperforms state-of-the-art baselines is thereby weaker than stated: the comparison does not establish that the multi-task component itself is superior to existing multi-task designs. At a minimum, the paper should directly compare with or discuss one or more multi-task vulnerability detection baselines, or clearly restrict the claim to the single-task baselines evaluated.
  5. [Section 5, Tables 3-7] All central results are based on a single data split and single training runs, with no standard deviation, confidence intervals, or statistical significance tests. Given the class imbalance in Big-Vul and the use of noisy ranking-based metrics (e.g., IFA), the reported improvements over baselines and the ablation differences could be sensitive to random seed and split. Reporting multiple seeds with appropriate significance tests is necessary to support the paper's consistently-outperforms claim. This is a load-bearing methodological point, not a presentation preference.
minor comments (5)
  1. [Section 1, paragraph 6] The abbreviation 'MLT' is introduced for the Multi-task Learning module, but the standard abbreviation used everywhere else is 'MTL'; please make the terminology consistent.
  2. [Answer to RQ2-2, Section 5.2.2] The answer states that CodeT5 benefits the most from EDAT for LVD, but Table 6 shows that GraphCodeBERT has a larger absolute improvement in R@20% LOC (from 0.5906 to 0.7031) and in Top-10 accuracy (from 0.6522 to 0.7742); the text should be corrected to match the table.
  3. [Section 4.3.2, Eq. (9)] The definition of Top-k accuracy is ambiguous because the symbol l is used both for a specific line and for a ranked prediction, and the indicator notation does not clearly express that the top-k predicted lines should intersect the set V of ground-truth vulnerable lines; please clarify the notation.
  4. [References [44] and [46]] References [44] and [46] contain placeholder DOIs (10.1145/1234567.1234568 and 10.1234/jcs.2023.0001) that do not correspond to real publications; these references must be corrected or removed.
  5. [Section 5.2.1] The ablation sections state that adversarial perturbations are scheduled 'progressively over the first two training epochs,' but no details are given for the scheduling function; please provide the exact schedule used.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: EDAT-MTL's claims rest on external Big-Vul labels and external baselines, so no reported metric reduces to a fit or to a self-citation chain.

full rationale

The paper's derivation is empirical rather than definitional. EDAT perturbs identifier embeddings (Eq. 1) and MTL combines task losses (Eq. 3), and the reported VTP F1 (0.7281) and LVD Top-5 Accuracy (0.6047) are measured against external Big-Vul ground truth and compared with external baselines (VulExplainer, LIVABLE, LineVD, LineVul) under the same split. No equation defines a target metric as a function of a fitted parameter, and no reported number is an input renamed as a prediction. Eq. (1)'s use of attention scores α_i from the model being trained is a training-time self-referential weighting, not a reduction of the evaluation outcome to that attention. The same-group citations [48]–[53] supporting that Big-Vul is 'widely adopted' are non-load-bearing because Big-Vul's provenance is the external dataset paper [36]. The random function-level split in Section 4.6 may cause same-CVE/repository leakage, and Section 6.2 notes only the C++-only limitation; these are experimental-validity threats, not circularity, since the test labels are external and baselines share the same split. No circular step can be exhibited, hence score 0.

Assumptions & free parameters 10 free parameters · 6 assumptions · 0 invented entities

The central claim rests on a long list of tuning choices: epsilon, PGD steps, learning rate, dropout, truncation lengths, and unspecified noise and attention scales. It also assumes Big-Vul labels and the split are trustworthy, and that embedding-space noise preserves semantics. No new physical or conceptual entities are introduced.

free parameters (10)
  • PGD perturbation bound epsilon = 0.02 (main), 0.03 (ablation)
    Grid-searched on validation; the main configuration uses 0.02 while the EDAT ablation states 0.03, so the two sets of results are not tied to one perturbation budget.
  • PGD ascent steps K = 3
    The ablation fixes n steps at 3, but no sensitivity analysis is reported for the number of ascent steps.
  • Adversarial learning rate mu = Not reported
    Equation (2) uses mu for the PGD update, but the paper never reports its value.
  • Gaussian noise scale sigma and attention importance alpha_i = Not reported
    Equation (1) initializes perturbation strength with sigma squared times alpha_i, but neither the noise scale nor the attention-importance computation is specified.
  • Input truncation lengths Lc, Nl, Nt = 512 / 256 / 64
    Fixed to cover at least 95 percent of samples; this truncates long functions and can affect both classification and line-level metrics.
  • Learning rate = 5e-6
    Selected by automated grid search on validation performance before reporting test results.
  • Dropout rate = 0.2
    Selected by grid search on validation performance.
  • Batch size and training epochs = 32 for 100 epochs
    Batch size 32 for 100 epochs is fixed following prior practice; no sensitivity analysis is reported.
  • Dynamic loss weighting lambda function = 1/(1+exp(-Var - Entropy))
    The logistic function in Eq. (4) is hand-designed to blend classification and localization losses; it is not learned or ablated.
  • Focal loss focusing parameter gamma = Not reported
    Focal loss is used for line-level detection, but the focusing parameter gamma is never specified.
assumptions (6)
  • domain assumption Big-Vul CWE and line-level annotations are accurate enough to serve as ground truth.
    All metrics are computed against these labels, and the paper does not audit label noise, missing annotations, or disagreement between CWE labels and vulnerable lines.
  • domain assumption The function-level 8:1:1 stratified split prevents leakage between training and test.
    Section 4.6 partitions functions randomly with no deduplication by CVE, repository, or code similarity; Big-Vul is known to contain repeated and closely related code, so this assumption is load-bearing.
  • standard math Backpropagation through multi-step PGD on embeddings yields usable gradients.
    The method relies on the differentiability of the PGD loop in Eq. (2); this is standard but not formally justified.
  • ad hoc to paper Embedding-space adversarial noise preserves vulnerability semantics after AST and PDG filtering.
    Step 4 claims semantic preservation, but no concrete enforcement procedure or direct measurement is provided.
  • domain assumption A shared encoder produces positive transfer between vulnerability type prediction and line-level detection.
    The multi-task module assumes the two tasks reinforce each other; the ablation shows gains on Big-Vul, but there is no analysis of task conflict or negative transfer.
  • ad hoc to paper The hand-designed loss weights in Eq. (3) and Eq. (4) train stably across backbones.
    The dynamic lambda is introduced without sensitivity analysis or comparison to learned weighting schemes.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Improving vulnerability type prediction and line-level detection via adversarial training-based data augmentation and multi-task learning." pith.science (2026). https://pith.science/paper/X3SN7MEK

@misc{pith2026250623534,
  author       = {Pith},
  title        = {Pith review of: Improving vulnerability type prediction and line-level detection via adversarial training-based data augmentation and multi-task learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/X3SN7MEK}},
  note         = {Machine review of arXiv:2506.23534}
}
read the original abstract

Context: Software vulnerabilities pose a significant threat to modern software systems, as evidenced by the growing number of reported vulnerabilities and cyberattacks. These escalating trends underscore the urgent need for effective approaches that can automatically detect and understand software vulnerabilities. Objective: However, the scarcity of labeled samples and the class imbalance issue in vulnerability datasets present significant challenges for both Vulnerability Type Prediction (VTP) and Line-level Vulnerability Detection (LVD), especially for rare yet critical vulnerability types. Moreover, most existing studies treat VTP and LVD as independent tasks, overlooking their inherent correlation, which limits the potential to leverage shared semantic patterns across tasks. Methods: To address these limitations, we propose a unified approach that integrates Embedding-Layer Driven Adversarial Training (EDAT) with Multi-task Learning (MTL). Specifically, EDAT enhances model robustness by introducing adversarial perturbations to identifier embeddings, guided by semantic importance. Meanwhile, MTL improves overall performance by leveraging shared representations and inter-task correlations between VTP and LVD. Results: Extensive experiments demonstrate that our proposed approach outperforms state-of-the-art baselines on both VTP and LVD tasks. For VTP, it yields notable improvements in accuracy, precision, recall, and F1-score, particularly in identifying rare vulnerability types. Similarly, for LVD, our approach enhances line-level detection accuracy while significantly reducing false positives. Conclusion: Our study demonstrates that combining EDAT with MTL provides a unified solution that improves performance on both tasks and warrants further investigation.

Figures

Figures reproduced from arXiv: 2506.23534 by the authors.

Figure 1
Figure 1. An overview of our proposed approach EDAT-MLT [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

60 extracted references · 52 canonical work pages

  1. [52]

    L. Wang, G. Lu, X. Chen, X. Dai, J. Qiu, Sift: enhance the performance of vulnerability detection by incorporating structural knowledge and multi- task learning, Automated Software Engineering 32 (2) (2025) 38

    work page 2025

  2. [1]

    Alfasi, T

    D. Alfasi, T. Shapira, A. Bremler-Barr, Vulnscopper: Unveiling hidden links between unseen security entities, in: Proceedings of the 3rd GNNet Workshop on Graph Neural Networking Workshop, 2024, pp. 33–40

    work page 2024

  3. [2]

    National Vulnerability Database (NVD), NVD Program An- nouncement, https://nvd.nist.gov/general/news/ nvd-program-transition-announcement , accessed: 2025-06- 04 (2024)

    work page 2024

  4. [3]

    Jiarpakdee, C

    J. Jiarpakdee, C. K. Tantithamthavorn, H. K. Dam, J. Grundy, An em- pirical study of model-agnostic techniques for defect prediction models, IEEE Transactions on Software Engineering 48 (1) (2020) 166–185

    work page 2020

  5. [4]

    D. Hin, A. Kan, H. Chen, M. A. Babar, Linevd: Statement-level vulnera- bility detection using graph neural networks, in: Proceedings of the 19th international conference on mining software repositories, 2022, pp. 596– 607

    work page 2022

  6. [5]

    A. M. Rahman, W. Yin, G. Wang, Data augmentation for text classifi- cation with ease, in: Proceedings of the 6th International Conference on Natural Language and Speech Processing (ICNLSP 2023), 2023, pp. 324– 332

    work page 2023

  7. [6]

    Q. Xie, Z. Dai, E. Hovy, T. Luong, Q. Le, Unsupervised data augmenta- tion for consistency training, Advances in neural information processing systems 33 (2020) 6256–6268

    2020

  8. [7]

    Menzies, A

    T. Menzies, A. Butcher, A. Marcus, T. Zimmermann, D. Cok, Local vs. global models for e ffort estimation and defect prediction, in: 2011 26th IEEE/ACM International Conference on Automated Software Engineer- ing (ASE 2011), IEEE, 2011, pp. 343–351

    work page 2011

Show all 60 references
  1. [8]

    J. Nam, S. J. Pan, S. Kim, Transfer defect learning, in: 2013 35th in- ternational conference on software engineering (ICSE), IEEE, 2013, pp. 382–391

    2013

  2. [9]

    X.-C. Wen, C. Gao, F. Luo, H. Wang, G. Li, Q. Liao, Livable: exploring long-tailed classification of software vulnerability types, IEEE Transac- tions on Software Engineering (2024)

    2024

  3. [10]

    M. Fu, V . Nguyen, C. K. Tantithamthavorn, T. Le, D. Phung, Vulex- plainer: A transformer-based hierarchical distillation for explaining vul- nerability types, IEEE Transactions on Software Engineering 49 (10) (2023) 4550–4565

    2023

  4. [11]

    M. Fu, C. Tantithamthavorn, Linevul: A transformer-based line-level vul- nerability prediction, in: Proceedings of the 19th International Confer- ence on Mining Software Repositories, 2022, pp. 608–620

    2022

  5. [12]

    J. Cito, S. Chandra, C. Tantithamthavorn, H. Hemmati, Expert perspec- tives on explainability, IEEE Software 40 (3) (2023) 84–88

    2023

  6. [13]

    Jiarpakdee, C

    J. Jiarpakdee, C. K. Tantithamthavorn, J. Grundy, Practitioners’ percep- tions of the goals and visual explanations of defect prediction models, in: 2021 IEEE /ACM 18th International Conference on Mining Software Repositories (MSR), IEEE, 2021, pp. 432–443

    2021

  7. [14]

    Khanan, W

    C. Khanan, W. Luewichana, K. Pruktharathikoon, J. Jiarpakdee, C. Tan- tithamthavorn, M. Choetkiertikul, C. Ragkhitwetsagul, T. Sunetnanta, Jit- bot: an explainable just-in-time defect prediction bot, in: Proceedings of the 35th IEEE /ACM international conference on automated s...

    2020

  8. [15]

    Y . Liu, C. Tantithamthavorn, L. Li, Y . Liu, Explainable ai for android malware detection: Towards understanding why the models perform so well?, in: 2022 IEEE 33rd International Symposium on Software Relia- bility Engineering (ISSRE), IEEE, 2022, pp. 169–180

    2022

  9. [16]

    Pornprasit, C

    C. Pornprasit, C. Tantithamthavorn, J. Jiarpakdee, M. Fu, P. Thongta- nunam, Pyexplainer: Explaining the predictions of just-in-time defect models, in: 2021 36th IEEE /ACM International Conference on Auto- mated Software Engineering (ASE), IEEE, 2021, pp. 407–418

    2021

  10. [17]

    Rajapaksha, C

    D. Rajapaksha, C. Tantithamthavorn, J. Jiarpakdee, C. Bergmeir, J. Grundy, W. Buntine, Sqaplanner: Generating data-informed software quality improvement plans, IEEE Transactions on Software Engineering 48 (8) (2021) 2814–2835

    2021

  11. [18]

    Tantithamthavorn, J

    C. Tantithamthavorn, J. Cito, H. Hemmati, S. Chandra, Explainable ai for se: Challenges and future directions, IEEE Software 40 (3) (2023) 29–33

    2023

  12. [19]

    Tantithamthavorn, J

    C. Tantithamthavorn, J. Jiarpakdee, J. Grundy, Actionable analytics: Stop telling me what it is; please tell me what to do, IEEE Software 38 (4) (2021) 115–120

    2021

  13. [21]

    Nguyen, T

    V . Nguyen, T. Le, O. De Vel, P. Montague, J. Grundy, D. Phung, Information-theoretic source code vulnerability highlighting, in: 2021 In- ternational Joint Conference on Neural Networks (IJCNN), IEEE, 2021, pp. 1–8

    2021

  14. [22]

    H. He, B. Yan, K. Xu, L. Yu, Telecontext-enhanced recursive interactive attention fusion method for line-level defect prediction., Computers, Ma- terials & Continua 82 (2) (2025)

    2025

  15. [23]

    Wattanakriengkrai, P

    S. Wattanakriengkrai, P. Thongtanunam, C. Tantithamthavorn, H. Hata, K. Matsumoto, Predicting defective lines using a model-agnostic tech- nique, IEEE Transactions on Software Engineering 48 (5) (2020) 1480– 14 1496

    2020

  16. [24]

    I. J. Goodfellow, J. Shlens, C. Szegedy, Explaining and harnessing adver- sarial examples, arXiv preprint arXiv:1412.6572 (2014)

    2014 arXiv

  17. [25]

    Y . Li, J. Ye, Learning adversarial networks for semi-supervised text clas- sification via policy gradient, in: Proceedings of the 24th acm sigkdd international conference on knowledge discovery & data mining, 2018, pp. 1715–1723

    2018

  18. [26]

    R. Dey, A. Debnath, S. K. Dutta, K. Ghosh, A. Mitra, A. R. Chowdhury, J. Sen, Semantic stealth: Adversarial text attacks on nlp using several methods, arXiv preprint arXiv:2404.05159 (2024)

    2024 arXiv

  19. [27]

    Z. Yang, J. Shi, J. He, D. Lo, Natural attack for pre-trained models of code, in: Proceedings of the 44th International Conference on Software Engineering, 2022, pp. 1482–1493

    2022

  20. [28]

    Zhang, Z

    H. Zhang, Z. Fu, G. Li, L. Ma, Z. Zhao, H. Yang, Y . Sun, Y . Liu, Z. Jin, Towards robustness of deep program processing models—detection, es- timation, and enhancement, ACM Transactions on Software Engineering and Methodology (TOSEM) 31 (3) (2022) 1–40

    2022

  21. [29]

    C. Ni, X. Chen, X. Xia, Q. Gu, Y . Zhao, Multitask defect prediction, Journal of Software: Evolution and Process 31 (12) (2019) e2203

    2019

  22. [30]

    Huang, Z

    Q. Huang, Z. Li, Q. Gu, Multi-task deep neural networks for just-in-time software defect prediction on mobile apps, Concurrency and Computa- tion: Practice and Experience 36 (10) (2024) e7664

    2024

  23. [31]

    M. Yang, S. Yang, W. E. Wong, Multi-objective software defect prediction via multi-source uncertain information fusion and multi-task multi-view learning, IEEE Transactions on Software Engineering (2024)

    2024

  24. [32]

    C. Ni, K. Yang, Y . Zhu, X. Chen, X. Yang, Unifying defect prediction, categorization, and repair by multi-task deep learning, in: 2023 38th IEEE/ACM International Conference on Automated Software Engineer- ing (ASE), IEEE, 2023, pp. 1980–1992

    2023

  25. [33]

    Y . Chen, R. Wang, L. Zhang, Jit-smart: Joint defect prediction and localization with semantic-aware transformers, in: Proceedings of the 31st IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER), IEEE, 2024

    2024

  26. [34]

    Turhan, T

    B. Turhan, T. Menzies, A. B. Bener, J. Di Stefano, On the relative value of cross-company and within-company data for defect prediction, Empirical Software Engineering 14 (2009) 540–578

    2009

  27. [35]

    Y . Zhou, Y . Yang, H. Lu, L. Chen, Y . Li, Y . Zhao, J. Qian, B. Xu, How far we have progressed in the journey? an examination of cross-project de- fect prediction, ACM Transactions on Software Engineering and Method- ology (TOSEM) 27 (1) (2018) 1–51

    2018

  28. [36]

    J. Fan, Y . Li, S. Wang, T. N. Nguyen, Ac/c++ code vulnerability dataset with code changes and cve summaries, in: Proceedings of the 17th inter- national conference on mining software repositories, 2020, pp. 508–512

    2020

  29. [37]

    Z. Feng, D. Guo, D. Tang, N. Duan, X. Feng, M. Gong, L. Shou, B. Qin, T. Liu, D. Jiang, et al., Codebert: A pre-trained model for programming and natural languages, arXiv preprint arXiv:2002.08155 (2020)

    2020 arXiv

  30. [38]

    D. Guo, S. Ren, S. Lu, Z. Feng, D. Tang, S. Liu, L. Zhou, N. Duan, A. Svyatkovskiy, S. Fu, et al., Graphcodebert: Pre-training code repre- sentations with data flow, arXiv preprint arXiv:2009.08366 (2020)

    2020 arXiv

  31. [39]

    Y . Wang, W. Wang, S. Joty, S. C. Hoi, Codet5: Identifier-aware unified pre-trained encoder-decoder models for code understanding and genera- tion, arXiv preprint arXiv:2109.00859 (2021)

    2021 arXiv

  32. [40]

    X. Chen, W. Pei, S. Yang, Y . Zhou, Z. Zhang, J. Pei, Automatic title completion for stack overflow posts and github issues, Empirical Software Engineering 29 (5) (2024) 120

    2024

  33. [41]

    S. Yang, X. Chen, K. Liu, G. Yang, C. Yu, Automatic bi-modal ques- tion title generation for stack overflow with prompt learning, Empirical Software Engineering 29 (3) (2024) 63

    2024

  34. [42]

    K. Liu, X. Chen, C. Chen, X. Xie, Z. Cui, Automated question title refor- mulation by mining modification logs from stack overflow, IEEE Trans- actions on Software Engineering 49 (9) (2023) 4390–4410

    2023

  35. [43]

    G. Yang, Y . Zhou, W. Yang, T. Yue, X. Chen, T. Chen, How important are good method names in neural code generation? a model robustness per- spective, ACM Transactions on Software Engineering and Methodology 33 (3) (2024) 1–35

    2024

  36. [44]

    X. Li, Q. Wei, Z. Wu, W. Guo, A comprehensive survey of vulnera- bility detection methods towards linux-based iot devices, in: Proceed- ings of the 2023 International Conference on Computer Network and Communication Technology (CNCIT), ACM, 2023, pp. 35–41. doi: 10.1145/123456...

    2023

  37. [45]

    Y . Zhu, H. Wang, Y . Liu, X. Zhang, Y . Chen, Z. Yang, Discovering vul- nerabilities in source code using graph neural networks: A survey, ACM Computing Surveys 55 (7) (2022) 1–36. doi:10.1145/3545003

    2022 doi

  38. [46]

    D. Zhou, Y . Ji, Y . Hu, Q. Liu, Z. Zheng, A survey on automated software vulnerability detection using machine learning and deep learning, Journal of Cybersecurity 1 (1) (2023) 47–58. doi:10.1234/jcs.2023.0001

    2023

  39. [47]

    Herbold, D

    S. Herbold, D. Trautsch, J. Grabowski, A. E. Hassan, T. Zimmermann, J. M ¨unch, A comparative study to benchmark cross-project defect pre- diction approaches, IEEE Transactions on Software Engineering 44 (1) (2017) 37–58

    2017

  40. [48]

    G. Lu, X. Ju, X. Chen, S. Yang, L. Chen, H. Shen, Assessing the e ffec- tiveness of vulnerability detection via prompt tuning: An empirical study, in: 2023 30th Asia-Pacific Software Engineering Conference (APSEC), IEEE, 2023, pp. 415–424

    2023

  41. [49]

    Z. Ren, X. Ju, X. Chen, Y . Qu, Improving distributed learning-based vul- nerability detection via multi-modal prompt tuning, Journal of Systems and Software 226 (2025) 112442

    2025

  42. [50]

    C. Liu, X. Chen, X. Li, Y . Xue, Making vulnerability prediction more practical: Prediction, categorization, and localization, Information and Software Technology 171 (2024) 107458

    2024

  43. [51]

    Z. Ren, X. Ju, X. Chen, H. Shen, Prorlearn: boosting prompt tuning-based vulnerability detection by reinforcement learning, Automated Software Engineering 31 (2) (2024) 38

    2024

  44. [53]

    G. Lu, X. Ju, X. Chen, W. Pei, Z. Cai, Grace: Empowering llm-based soft- ware vulnerability detection with graph structure and in-context learning, Journal of Systems and Software 212 (2024) 112031

    2024

  45. [54]

    Chakraborty, R

    S. Chakraborty, R. Krishna, Y . Ding, B. Ray, Deep learning based vul- nerability detection: Are we there yet?, IEEE Transactions on Software Engineering 48 (9) (2021) 3280–3296

    2021

  46. [55]

    Bilgin, M

    Z. Bilgin, M. A. Ersoy, E. U. Soykan, E. Tomur, P. C ¸ omak, L. Karac ¸ay, Vulnerability prediction from source code using machine learning, IEEE Access 8 (2020) 150672–150684

    2020

  47. [56]

    Szab ´o, V

    Z. Szab ´o, V . Bilicki, A new approach to web application security: Uti- lizing gpt language models for source code inspection, Future Internet 15 (10) (2023) 326

    2023

  48. [57]

    W. Sun, C. Fang, Y . Miao, Y . You, M. Yuan, Y . Chen, Q. Zhang, A. Guo, X. Chen, Y . Liu, et al., Abstract syntax tree for programming lan- guage understanding and representation: How far are we?, arXiv preprint arXiv:2312.00413 (2023)

    2023 arXiv

  49. [58]

    G. K. Conrado, A. K. Goharshady, C. K. Lam, The bounded pathwidth of control-flow graphs, Proceedings of the ACM on Programming Lan- guages 7 (OOPSLA2) (2023) 292–317

    2023

  50. [59]

    F. Qiu, Z. Liu, X. Hu, X. Xia, G. Chen, X. Wang, Vulnerability detec- tion via multiple-graph-based code representation, IEEE Transactions on Software Engineering (2024)

    2024

  51. [60]

    Y . Li, S. Wang, T. N. Nguyen, Vulnerability detection with fine-grained interpretations, in: Proceedings of the 29th ACM Joint Meeting on Euro- pean Software Engineering Conference and Symposium on the Founda- tions of Software Engineering, 2021, pp. 292–303. Siyu Chen is cur...

    2021

  52. [2023]

    More information can be found at: https://xchencs.github.io/index.html

    He is the editorial board member of Information and Software Technology. More information can be found at: https://xchencs.github.io/index.html. Menglin Zheng is currently pursuing a Bachelor’s degree in Software Engineering at the School of Artificial Intelligence and Compute...

    1976

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.