Pith. sign in

REVIEW 4 major objections 5 minor 41 references

Deep Learning Based Concurrency Bug Detection and Localization

T0 review · 4 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that adding synchronization edges and blocking nodes to a code property graph lets a CodeBERT–RGCN model detect concurrency bugs with 86% F1 and localize them to subgraphs, beating eight detection and five localization base

desk verdict Genuinely new dataset and graph representation, but the headline performance gaps are not in the tables. read the letter →

arxiv 2508.20911 v1 pith:6S7YVJYV submitted 2025-08-28 cs.SE

Zuocheng Feng , Kaiwen Zhang , Miaomiao Wang , Yiming Cheng , Yuandao Cai , Xiaofeng Li , Guanjun Liu This is my paper
classification cs.SE
keywords concurrencybugdetectionlocalizationcodepropertygraphneuralnetworkrelationalconvolutionSubgraphXBERTdatarace
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Concurrency bugs are hard to find because the relevant information spans threads, locks, and interleavings that ordinary code representations do not show. This paper tries to make that information explicit by extending the code property graph with synchronization edges and blocking nodes, producing what it calls the Concurrency-Aware Code Property Graph (CCPG). It then trains a heterogeneous graph network on CodeBERT embeddings of CCPG nodes and uses a subgraph-explanation method to localize bugs to source lines. The authors report that Convul, their pipeline, reaches an F1 score of 86% for detection and an Intersection over Union of 15% for localization, outperforming eight detection and five localization baselines. They also assemble 41,317 labeled concurrency bug instances from four existing datasets, which they say is the first dataset built specifically for concurrency bugs.

What carries the argument

CCPG: Concurrency-Aware Code Property Graph, a property graph obtained by taking a code property graph (merged AST, CFG, and PDG) and adding blocking nodes and synchronization edges: thread-create edges from caller to thread entry, join edges from thread exit to caller, and lock-to-unlock edges spanning critical sections. It carries the argument by making thread interactions and critical sections explicit so the RGCN's relation-specific weights can learn them, and by giving SubgraphX a concurrency-weighted prior for search.

What would settle it

Run Convul on a fresh, independently labeled set of C/C++ concurrent programs with ground-truth race and deadlock lines, with the labelers blind to the model's output. If predicted subgraphs overlap ground truth no better than a random subgraph of the same size, or if the original keyword-filtered labels cannot be reproduced by a second independent review, the central claim is undercut.

Watch

Extended reading notes

Core claim

The paper's central claim is that concurrency bugs can be detected and localized by a deep learning pipeline whose graph representation explicitly encodes synchronization. It defines the Concurrency-Aware Code Property Graph (CCPG), which extends the standard code property graph with blocking nodes and synchronization edges for lock/unlock and thread create/join operations. Node embeddings come from CodeBERT, a pretrained code model; a relational graph convolution network (RGCN) classifies each program; and SubgraphX, with a concurrency-weighted search, extracts connected subgraphs whose Shapley values identify the lines involved in the bug. On the DeepRace dataset Convul reaches 85.69 F1 ve

Load-bearing premise

The load-bearing premise is that the 41,317 labels produced by keyword filtering plus manual review are correct; if the labels are noisy or systematically biased, every reported detection and localization number inherits that error.

Editorial extensions

If this is right

  • A representation that encodes lock/unlock and thread create/join structure can replace hand-written race or deadlock heuristics for a learned detector.
  • Detection and localization share one graph representation, so a single pass can return both a verdict and candidate source lines rather than just a binary label.
  • The same CCPG pipeline can consume slice-, function-, or file-level inputs, which removes the function-level restriction that limits several graph baselines.
  • The concurrency-extraction procedure can be rerun on updated CVE/CWE records to expand the dataset as new concurrency bugs are disclosed.
  • Using pretrained code embeddings inside a heterogeneous GNN improves over either component alone, since the two encode complementary semantic and relational information.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The CCPG construction is tied to POSIX primitives (pthread_mutex, pthread_create/join); extending the same idea to Java monitors, std::thread, OpenMP, or async/await is a natural test, but is not implemented here.
  • The reported IoU of 15% means most predicted subgraph nodes are still outside the ground-truth bug nodes; a follow-up could combine subgraph explanations with line-level ranking to make localization usable in practice.
  • The θ term that biases MCTS toward subgraphs with synchronization edges and blocking nodes is a domain prior; ablating α and β would isolate how much of the localization gain comes from this prior versus from generic Shapley scoring.
  • Releasing the filtered 41,317 instances with line-level labels would let others reproduce the metrics and check label quality; the paper currently offers the data 'on reasonable request'.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes Convul, a deep-learning pipeline for concurrency bug detection and line-level localization. The authors build a new dataset of 41,317 concurrency bug instances by filtering and manually reviewing samples from DiverseVul, BigVul, SARD, and DeepRace. They introduce the Concurrency-Aware Code Property Graph (CCPG), which augments a standard CPG with synchronization and blocking nodes/edges, and combine CodeBERT node embeddings with an RGCN classifier. For localization, they adapt SubgraphX using MCTS and Shapley values to identify bug-related subgraphs. Experiments compare Convul with detection baselines on DeepRace (Table 2) and localization baselines on BigVul and SARD (Table 6), reporting a detection F1 of about 86% and localization IoU of 14.50/12.57. The abstract and introduction additionally claim average improvements of 10% in accuracy/precision and 26% in recall over state-of-the-art methods.

Significance. If the results hold, the CCPG representation and the concurrency-specific dataset would be useful contributions: the paper directly addresses a real gap in modeling synchronization semantics and in locating bug lines rather than only classifying functions. The use of SubgraphX for subgraph-level localization is a plausible and relevant design choice. However, at present the headline empirical claims are not traceable to the reported tables, and the dataset—one of the three stated contributions—is neither released nor validated beyond a passing mention of manual review. No code, configuration details, or reproducibility artifacts are provided. The significance is therefore conditional on a substantial revision of the reporting and on making the data/experimental protocol verifiable.

major comments (4)
  1. [Abstract; Experiments, Table 2] The abstract's claim of an average 10% improvement in accuracy and precision and 26% improvement in recall is inconsistent with the paper's own main detection table. In Table 2, Convul w/ CCPG has Precision 78.32, below GraphCodeBERT's 84.89; Accuracy is 75.68 vs. DeepRace's 70.38 (5.30 points, not 10); Recall is 94.60 vs. LineVul's 92.75 (1.85 points) and DeepRace's 76.97 (17.63 points). No detection table reports precision/recall for the merged DiverseVul/BigVul/SARD data, so the aggregate numbers in the abstract are not reproducible. Please either remove the aggregate claim or give an explicit per-table breakdown that justifies each percentage.
  2. [Dataset] The proposed 41,317-instance concurrency dataset is a central contribution, but its construction is not verifiable. The text says records were filtered by keywords and 'manually reviewed,' yet no inter-rater agreement, adjudication protocol, label-error analysis, or release of the filtered instances is provided; the Data Availability section states only that data will be shared 'on reasonable request.' Because every detection and localization metric in Tables 2 and 6 is computed on these labels, systematic label noise or selection bias would invalidate all comparative conclusions. A validation study or public release of the extraction pipeline is needed.
  3. [RQ2, Tables 4 and 5] Table 4 reports that RGCN with GraphCodeBERT embeddings achieves F1=89.91, while RGCN with CodeBERT achieves F1=84.03. The paper does not state the dataset or split used for Tables 4–5, nor does it explain why the final model nonetheless uses CodeBERT when the reported numbers suggest GraphCodeBERT is better. Without this information, the chosen configuration appears not to be the best configuration found, which undermines the main claim and the reproducibility of the results. Please specify the evaluation protocol for RQ2 and justify the final model selection.
  4. [Experiments, RQ4, Table 6] The localization accuracy metric is defined very leniently: a subgraph is counted as accurate if it contains at least one bug node. This, together with the low IoU values (14.50 on Big-Vul, 12.57 on SARD), makes the practical debugging utility difficult to assess. The paper should report stricter metrics, such as exact-match accuracy or top-k line accuracy, and discuss the trade-off between the loose accuracy definition and the reported IoU.
minor comments (5)
  1. [Algorithm 3 / Eqs. (5)–(9)] Algorithm 3 uses SNmax on line 5, but only Nmin is defined in Eq. (5). Also, the hyperparameters α, β, λ, subgraph size limits, RGCN layer count, hidden dimensions, and MCTS iteration count B are never given, so the proposed method cannot be instantiated from the paper.
  2. [Table 6] The VulDeeLocator row contains '\ \' for Big-Vul Accuracy/IoU instead of numeric values. Please report the missing numbers or state explicitly why they are unavailable.
  3. [Dataset, last paragraph] The sentence 'We thoroughly' at the end of the Dataset section appears incomplete; it does not continue into the next subsection.
  4. [Throughout] The term 'accuracy' is used both for detection accuracy and for localization accuracy in Table 6. These are different metrics and should be named distinctly (e.g., 'localization hit-rate') to avoid ambiguity.
  5. [Data Availability] Sharing data only 'on reasonable request' is not sufficient for reproducibility, especially since the construction of the dataset is a core contribution. A public artifact or a detailed release plan should be provided.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the detection/localization pipeline is an empirical supervised system evaluated on external data splits; no fitted parameter is renamed as a prediction and no load-bearing claim reduces to an author self-citation.

full rationale

The derivation chain is self-contained relative to the claimed contributions. The dataset is constructed from external vulnerability datasets (DiverseVul, Big-Vul, SARD, DeepRace) filtered by CVE/CWE keywords and manual review; the model is then trained and tested on standard train/test splits of those instances. CCPG is a graph-construction algorithm that augments CPGs with synchronization nodes and edges; the detection model is CodeBERT-initialized RGCN trained with a supervised objective, and localization is post-hoc SubgraphX explanation of the trained classifier. No equation in the paper defines a predicted quantity as the same expression used to fit a parameter. The abstract's aggregate '10% / 26%' claim is internally inconsistent with Table 2 (Convul precision 78.32 vs GraphCodeBERT 84.89) and would be a correctness/reproducibility issue, not a circularity issue. The authors' self-citations (refs 1-5) are background references for existing static/dynamic analysis and are not used as a uniqueness theorem or to justify the central result. Label quality (manual review without inter-rater agreement, data not released) is a support concern, but there is no quoted evidence that the labels encode the model's output, so it cannot be scored as circular under the hard rules.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central result rests on a manually filtered dataset, an unverified graph extraction pipeline, and several unspecified hyperparameters. These are inputs pulled from the authors' pipeline rather than derived from first principles; none are externally benchmarked.

free parameters (5)
  • alpha (α) and beta (β) in Eq. (6)
    Weights on synchronization-edge count and blocking-node count in the MCTS reward; values are not reported.
  • lambda (λ) in Eq. (9)
    Exploration/exploitation balance in MCTS selection; value not reported.
  • subgraph size limits Nmin and SNmax
    Bounds in Eq. (5) and Algorithm 3 that constrain explanation size; values not reported.
  • RGCN layer count L and hidden dimensions
    Model architecture choices are not specified in the experiments.
  • embedding model choice = CodeBERT
    Table 4 shows RGCN with GraphCodeBERT has F1 89.91, higher than CodeBERT's 84.03, yet the final model reports CodeBERT; this selection affects reported performance.
assumptions (4)
  • domain assumption Joern's CPG extraction is correct and complete for all sampled C/C++ programs
    Algorithm 1 builds CCPG on top of a CPG produced by Joern; if the CPG misses entry/exit nodes or call edges, the added concurrency edges are wrong.
  • domain assumption The synchronization primitive set {lock, unlock, create, join} is sufficient to capture concurrency semantics
    Algorithm 1 only recognizes POSIX-style primitives; the authors state the algorithm only applies to C/C++ multi-threaded programs.
  • domain assumption Manual review and keyword filtering correctly label the 41,317 concurrency bug instances
    The dataset section describes keyword-based CVE/CWE filtering and manual verification but gives no inter-rater agreement or label validation; all downstream metrics depend on these labels.
  • standard math SubgraphX with MCTS finds globally optimal explanatory subgraphs
    The localization module relies on the Shapley value and MCTS approximation as presented in the SubgraphX paper.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Deep Learning Based Concurrency Bug Detection and Localization." pith.science (2026). https://pith.science/paper/6S7YVJYV

@misc{pith2026250820911,
  author       = {Pith},
  title        = {Pith review of: Deep Learning Based Concurrency Bug Detection and Localization},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6S7YVJYV}},
  note         = {Machine review of arXiv:2508.20911}
}
read the original abstract

Concurrency bugs, caused by improper synchronization of shared resources in multi-threaded or distributed systems, are notoriously hard to detect and thus compromise software reliability and security. The existing deep learning methods face three main limitations. First, there is an absence of large and dedicated datasets of diverse concurrency bugs for them. Second, they lack sufficient representation of concurrency semantics. Third, binary classification results fail to provide finer-grained debug information such as precise bug lines. To address these problems, we propose a novel method for effective concurrency bug detection as well as localization. We construct a dedicated concurrency bug dataset to facilitate model training and evaluation. We then integrate a pre-trained model with a heterogeneous graph neural network (GNN), by incorporating a new Concurrency-Aware Code Property Graph (CCPG) that concisely and effectively characterizes concurrency semantics. To further facilitate debugging, we employ SubgraphX, a GNN-based interpretability method, which explores the graphs to precisely localize concurrency bugs, mapping them to specific lines of source code. On average, our method demonstrates an improvement of 10\% in accuracy and precision and 26\% in recall compared to state-of-the-art methods across diverse evaluation settings.

Figures

Figures reproduced from arXiv: 2508.20911 by the authors.

Figure 1
Figure 1. Overview for Concurrency Bug Detection Framework [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. The analysis of the data distribution presented in [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. An Example of CCPG Algorithm 1 Simplified Algorithm for Creating CCPG Input: Code Property Graph CP G = (G, E) Output: Concurrency-Aware Code Property Graph CCP G 1: Define synchronization primitives SP = {lock, unlock} 2: Define thread control functions TCF = {create, join} 3: Initialize function node map F N = f : (start, last) 4: for each function graph g ∈ CP G do 5: Add start and end nodes (gs, gl) of g to F N … view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Detection and Localization Motivating Example graph-based representation. The results show an improvement of at least 8.29% in Acc, Pre, Re and F1 when CCPG is applied. Constructing concurrency relationships on the CPG to form a CCPG is effective for concurrency bug de…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

41 extracted references · 37 canonical work pages

  1. [1]

    Petri net models and collaborativeness for parallel processes with resource sharing and message passing

    Guanjun Liu, Mengchu Zhou, and Changjun Jiang. Petri net models and collaborativeness for parallel processes with resource sharing and message passing. ACM Trans. Embed. Comput. Syst. , 16(4), May 2017

    work page 2017

  2. [2]

    Time-soundness of time petri nets modelling time-critical systems

    Guanjun Liu, Changjun Jiang, and Mengchu Zhou. Time-soundness of time petri nets modelling time-critical systems. ACM Trans. Cyber-Phys. Syst. , 2(2), May 2018

    work page 2018

  3. [3]

    Canary: practical static detection of inter-thread value-flow bugs

    Yuandao Cai, Peisen Yao, and Charles Zhang. Canary: practical static detection of inter-thread value-flow bugs. In Proceedings of the 42nd ACM SIGPLAN International Conference on Programming Language Design and Implementation, PLDI 2021, page 1126–1140, New York, NY, USA, 2021. Association for Computing Machinery

    work page 2021

  4. [4]

    Peahen: fast and precise static deadlock detection via context reduction

    Yuandao Cai, Chengfeng Ye, Qingkai Shi, and Charles Zhang. Peahen: fast and precise static deadlock detection via context reduction. In Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering , ESEC/FSE 2022, page 784–796, New York, NY, USA, 2022. Association for Computing Machinery

    work page 2022

  5. [5]

    Sound and efficient concurrency bug prediction

    Yan Cai, Hao Yun, Jinqiu Wang, Lei Qiao, and Jens Palsberg. Sound and efficient concurrency bug prediction. In Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering , ESEC/FSE 2021, page 255–267, New York, NY, USA, 2021. Association for Computing Machinery

    work page 2021

  6. [6]

    Deeprace: A learning-based data race detector

    Ali TehraniJamsaz, Mohammed Khaleel, Reza Akbari, and Ali Jannesari. Deeprace: A learning-based data race detector. In 2021 IEEE International Conference on Software Testing, Verification and Validation Workshops (ICSTW), pages 226–233. IEEE, 2021

    work page 2021

  7. [7]

    Context-sensitive data race detection for concurrent programs

    Yang Zhang, Huan Liu, and Liu Qiao. Context-sensitive data race detection for concurrent programs. IEEE Access, 9:20861–20867, 2021

    work page 2021

  8. [8]

    A novel approach of data race detection based on cnn- bilstm hybrid neural network

    Yang Zhang, Jiali Yan, Liu Qiao, and Hongbin Gao. A novel approach of data race detection based on cnn- bilstm hybrid neural network. Neural Comput. Appl. , 34(18):15441–15455, September 2022

    work page 2022

Show all 41 references
  1. [9]

    Data race detection using large language models

    Le Chen, Xianzhong Ding, Murali Emani, Tristan Vanderbruggen, Pei-Hung Lin, and Chunhua Liao. Data race detection using large language models. In Proceedings of the SC ’23 Workshops of The International Conference on High Performance Computing, Network, Storage, and Analysis, ...

  2. [10]

    Transformer-based language models for software vulnerability detection

    Chandra Thapa, Seung Ick Jang, Muhammad Ejaz Ahmed, Seyit Camtepe, Josef Pieprzyk, and Surya Nepal. Transformer-based language models for software vulnerability detection. In Proceedings of the 38th Annual Computer Security Applications Conference , ACSAC ’22, page 481–496, Ne...

    2022

  3. [11]

    Yamaguchi, N

    F. Yamaguchi, N. Golde, D. Arp, and K. Rieck. Modeling and discovering vulnerabilities with code property graphs. In 2014 IEEE Symposium on Security and Privacy , pages 590–604, 2014

    2014

  4. [12]

    Devign: effective vulnerability identification by learning comprehensive program semantics via graph neural networks

    Yaqin Zhou, Shangqing Liu, Jingkai Siow, Xiaoning Du, and Yang Liu. Devign: effective vulnerability identification by learning comprehensive program semantics via graph neural networks . Curran Associates Inc., Red Hook, NY, USA, 2019. Concurrency Bug Detection 9

    2019

  5. [13]

    Deepwukong: Statically detecting software vulnerabilities using deep graph neural network

    Xiao Cheng, Haoyu Wang, Jiayi Hua, Guoai Xu, and Yulei Sui. Deepwukong: Statically detecting software vulnerabilities using deep graph neural network. ACM Trans. Softw. Eng. Methodol. , 30(3), April 2021

    2021

  6. [14]

    Regvd: revisiting graph neural networks for vulnerability detection

    Van-Anh Nguyen, Dai Quoc Nguyen, Van Nguyen, Trung Le, Quan Hung Tran, and Dinh Phung. Regvd: revisiting graph neural networks for vulnerability detection. In Proceedings of the ACM/IEEE 44th International Conference on Software Engineering: Companion Proceedings, ICSE ’22, pa...

    2022

  7. [15]

    Vdotr: Vulnerability detection based on tensor representation of comprehensive code graphs

    Yuanhai Fan, Chuanhao Wan, Cai Fu, Lansheng Han, and Hao Xu. Vdotr: Vulnerability detection based on tensor representation of comprehensive code graphs. Comput. Secur., 130(C), July 2023

    2023

  8. [16]

    Modeling relational data with graph convolutional networks

    Michael Schlichtkrull, Thomas N Kipf, Peter Bloem, Rianne Van Den Berg, Ivan Titov, and Max Welling. Modeling relational data with graph convolutional networks. In The semantic web: 15th international conference, ESWC 2018, Heraklion, Crete, Greece, June 3–7, 2018, proceedings...

    2018

  9. [17]

    On explainability of graph neural networks via subgraph explorations

    Hao Yuan, Haiyang Yu, Jie Wang, Kang Li, and Shuiwang Ji. On explainability of graph neural networks via subgraph explorations. In International Conference on Machine Learning, 2021

    2021

  10. [18]

    Codebert: A pre-trained model for programming and natural languages

    Zhangyin Feng, Daya Guo, Duyu Tang, Nan Duan, Xiaocheng Feng, Ming Gong, Linjun Shou, Bing Qin, Ting Liu, Daxin Jiang, and Ming Zhou. Codebert: A pre-trained model for programming and natural languages. Findings of the Association for Computational Linguistics: EMNLP 2020, pag...

    2020

  11. [19]

    Vuldeepecker: A deep learning-based system for vulnerability detection

    Zhen Li, Deqing Zou, Shouhuai Xu, Xinyu Ou, Hai Jin, Sujuan Wang, Zhijun Deng, and Yuyi Zhong. Vuldeepecker: A deep learning-based system for vulnerability detection. In 25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, Febru...

    2018

  12. [20]

    Sysevr: A framework for using deep learning to detect software vulnerabilities

    Zhen Li, Deqing Zou, Shouhuai Xu, Hai Jin, Yawei Zhu, and Zhaoxuan Chen. Sysevr: A framework for using deep learning to detect software vulnerabilities. IEEE Transactions on Dependable and Secure Computing, pages 2244–2258, 2022

    2022

  13. [21]

    Diversevul: A new vulnerable source code dataset for deep learning based vulnerability detection

    Yizheng Chen, Zhoujie Ding, Lamya Alowain, Xinyun Chen, and David Wagner. Diversevul: A new vulnerable source code dataset for deep learning based vulnerability detection. In Proceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses, RAID ...

  14. [22]

    Jiahao Fan, Yi Li, Shaohua Wang, and Tien N. Nguyen. A c/c++ code vulnerability dataset with code changes and cve summaries. In Proceedings of the 17th International Conference on Mining Software Repositories , MSR ’20, page 508–512, New York, NY, USA, 2020. Association for Co...

    2020

  15. [23]

    Association for Computing Machinery

  16. [24]

    D2a: a dataset built for ai-based vulnerability detection methods using differential analysis

    Yunhui Zheng, Saurabh Pujar, Burn Lewis, Luca Buratti, Edward Epstein, Bo Yang, Jim Laredo, Alessandro Morari, and Zhong Su. D2a: a dataset built for ai-based vulnerability detection methods using differential analysis. In Proceedings of the 43rd International Conference on So...

    2021

  17. [25]

    Deep Learning based Vulnerability Detection: Are We There Yet? arXiv e-prints , page arXiv:2009.07235, September 2020

    Saikat Chakraborty, Rahul Krishna, Yangruibo Ding, and Baishakhi Ray. Deep Learning based Vulnerability Detection: Are We There Yet? arXiv e-prints , page arXiv:2009.07235, September 2020

    2009 arXiv

  18. [26]

    CVE-2024-50066

    MITRE CISA, DHS. CVE-2024-50066. Available from MITRE, CVE-ID CVE-2024-50066., December 3 2024

    2024

  19. [27]

    Nist software assurance reference dataset, 2024

    NIST. Nist software assurance reference dataset, 2024

    2024

  20. [28]

    Joern, 2024

    The Bug Hunter’s Workbench. Joern, 2024

    2024

  21. [29]

    CWE-1401, 2024

    ”The Common Weakness Enumeration (CWE) Initiative” MITRE Corporation. CWE-1401, 2024

    2024

  22. [30]

    GNNExplainer: generating explanations for graph neural networks

    Rex Ying, Dylan Bourgeois, Jiaxuan You, Marinka Zitnik, and Jure Leskovec. GNNExplainer: generating explanations for graph neural networks. Curran Associates Inc., Red Hook, NY, USA, 2019

    2019

  23. [31]

    Efficient estimation of word representations in vector space, 2013

    Tomas Mikolov, Kai Chen, Greg Corrado, and Jeffrey Dean. Efficient estimation of word representations in vector space, 2013

    2013

  24. [32]

    Linevul: A transformer-based line-level vulnerability prediction

    Michael Fu and Chakkrit Tantithamthavorn. Linevul: A transformer-based line-level vulnerability prediction. In 2022 IEEE/ACM 19th International Conference on Mining Software Repositories (MSR) , pages 608–620, 2022

    2022

  25. [33]

    H. Wang, G. Ye, Z. Tang, S. H. Tan, S. Huang, D. Fang, Y. Feng, L. Bian, and Z. Wang. Combining graph-based learning with automated data collection for code vulnerability detection. IEEE Transactions on Information Forensics and Security , 16:1943–1958, 2021

    1943

  26. [34]

    Kipf and Max Welling

    Thomas N. Kipf and Max Welling. Semi-Supervised Classification with Graph Convolutional Networks. arXiv e-prints, page arXiv:1609.02907, September 2016

    2016 arXiv

  27. [35]

    Clement, Dawn Drain, Neel Sundaresan, Jian Yin, Daxin Jiang, and Ming Zhou

    Daya Guo, Shuo Ren, Shuai Lu, Zhangyin Feng, Duyu Tang, Shujie Liu, Long Zhou, Nan Duan, Alexey Svyatkovskiy, Shengyu Fu, Michele Tufano, Shao Kun Deng, Colin B. Clement, Dawn Drain, Neel Sundaresan, Jian Yin, Daxin Jiang, and Ming Zhou. Graphcodebert: Pre-training code repres...

    2021

  28. [36]

    Distributed representations of sentences and documents

    Quoc Le and Tomas Mikolov. Distributed representations of sentences and documents. In Proceedings of the 31st International Conference on International Conference on Machine Learning - Volume 32 , ICML’14, page II–1188–II–1196. JMLR.org, 2014

    2014

  29. [37]

    Graph Attention Networks

    Petar Veliˇ ckovi´ c, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Li` o, and Yoshua Bengio. Graph Attention Networks. International Conference on Learning Representations, 2018

    2018

  30. [38]

    VulChecker: Graph-based vulnerability localization in source code

    Yisroel Mirsky, George Macon, Michael Brown, Carter Yagemann, Matthew Pruett, Evan Downing, Sukarno Mertoguno, and Wenke Lee. VulChecker: Graph-based vulnerability localization in source code. In 32nd USENIX Security Symposium (USENIX Security 23) , pages 6557– 6574, Anaheim, ...

    2023

  31. [39]

    VulDeeLocator: A Deep Learning-Based Fine-Grained Vulnerability Detector

    Zhen Li, Deqing Zou, Shouhuai Xu, Zhaoxuan Chen, Yawei Zhu, and Hai Jin. VulDeeLocator: A Deep Learning-Based Fine-Grained Vulnerability Detector . IEEE Transactions on Dependable and Secure Computing , 19(04):2821–2837, July 2022

    2022

  32. [40]

    Yi Li, Shaohua Wang, and Tien N. Nguyen. Vulnerability detection with fine-grained interpretations. In Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering , ESEC/FSE 2021, page 292–303, ...

    2021

  33. [41]

    Llvm: A compilation framework for lifelong program analysis & transformation

    Chris Lattner and Vikram Adve. Llvm: A compilation framework for lifelong program analysis & transformation. In Proceedings of the International Symposium on Code Generation and Optimization: Feedback-Directed and Runtime Optimization , CGO ’04, page 75, USA, 2004. 10 Zuocheng...

    2004

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.