Search papers, labs, and topics across Lattice.
VulStyle, a multi-modal vulnerability detection model, is introduced to jointly encode source code, non-terminal AST structure, and code stylometry features. By focusing on non-terminal AST nodes and integrating syntactic/lexical code stylometry, VulStyle captures stylistic cues indicative of vulnerabilities while reducing computational overhead. Pre-trained on 4.9M functions and fine-tuned on five benchmark datasets, VulStyle achieves state-of-the-art performance on BigVul and VulDeePecker, demonstrating the effectiveness of multi-modal representation learning for vulnerability detection.
Code stylometry, often overlooked, can significantly boost vulnerability detection, improving F1 scores by up to 48% on key benchmarks.
We present VulStyle, a multi-modal software vulnerability detection model that jointly encodes function-level source code, non-terminal Abstract Syntax Tree (AST) structure, and code stylometry (CStyle) features. Prior work in code representation primarily leverages token-level models or full AST trees, often missing stylistic cues indicative of risky programming practices, or incurring high structural overhead. Our approach selects only non-terminal AST nodes, reducing input complexity while preserving semantic hierarchy, and integrates syntactic and lexical CStyle features as auxiliary vulnerability signals. VulStyle is pre-trained using masked language modeling on 4.9M functions across seven programming languages, and fine-tuned across five benchmark datasets: Devign, BigVul, DiverseVul, REVEAL, and VulDeePecker. VulStyle achieves state-of-the-art performance on BigVul and VulDeePecker, improving F1 by 4-48% over strong transformer baselines, and attains competitive or best-average performance across all benchmarks. We contribute an ablation study isolating the effect of CStyle and AST structure, error case analysis, and a threat model situating the detection task in attacker-realistic scenarios.
