DCVD is a vulnerability detection framework that jointly predicts whether a function is vulnerable (function-level detection) and pinpoints the specific vulnerable lines (statement-level localization). Most existing methods rely on a single information source (sequential, structural, or semantic) and treat localization as a byproduct of detection without explicit line-level supervision. DCVD extracts control-dependency and semantic features through two parallel branches, aligns them via contrastive learning and bidirectional cross-attention, and introduces explicit supervision at both function and statement levels for joint optimization. On a large-scale real-world benchmark it outperforms state-of-the-art methods on both tasks.
Main takeaways:
- Vulnerability detection needs both function-level classification (is it vulnerable?) and statement-level localization (which lines are the problem?).
- Existing methods use only one modality (sequential, structural, or semantic) and lack explicit line-level supervision.
- DCVD runs two parallel branches (control-dependency and semantic features), aligns them with contrastive learning and bidirectional cross-attention, and supervises both function and statement levels jointly.
- Outperforms state-of-the-art on both function-level detection and statement-level localization on a large-scale real-world vulnerability benchmark.
- Code available at https://github.com/vinsontang1/DCVD.