Abstract:Code Language Models (codeLMs) and Graph Neural Networks (GNNs) are widely used in code vulnerability detection. However, a critical yet often overlooked issue is that GNNs primarily rely on aggregating information from adjacent nodes, limiting structural information transfer to single-layer updates. In code graphs, nodes and relationships typically require cross-layer information propagation to fully capture complex program logic and potential vulnerability patterns. Furthermore, while some studies utilize codeLMs to supplement GNNs with code semantic information, existing integration methods have not fully explored the potential of their collaborative effects. To address these challenges, we introduce Vul-LMGNNs that integrates pre-trained CodeLMs with GNNs, leveraging knowledge distillation to facilitate cross-layer propagation of both code semantic knowledge and structural information. Specifically, Vul-LMGNNs utilizes Code Property Graphs (CPGs) to incorporate code syntax, control flow, and data dependencies, while employing gated GNNs to extract structural information in the CPG. To achieve cross-layer information transmission, we implement an online knowledge distillation (KD) program that enables a single student GNN to acquire structural information extracted from a simultaneously trained counterpart through an alternating training procedure. Additionally, we leverage pre-trained CodeLMs to extract semantic features from code sequences. Finally, we propose an "implicit-explicit" joint training framework to better leverage the strengths of both CodeLMs and GNNs. In the implicit phase, we utilize CodeLMs to initialize the node embeddings of each student GNN. Through online knowledge distillation, we facilitate the propagation of both code semantics and structural information across layers. In the explicit phase, we perform linear interpolation between the CodeLM and the distilled GNN to learn a late fusion model. The proposed method, evaluated across four real-world vulnerability datasets, demonstrated superior performance compared to 17 state-of-the-art approaches. Our source code can be accessed via GitHub: https: //github.com/Vul-LMGNN/vul-LMGGNN.

COCL: an Intelligent Framework for Enhancing Deep Learning-Based Vulnerability Detection

Function-Level Vulnerability Detection Through Fusing Multi-Modal Knowledge

VDDL: A Deep Learning-Based Vulnerability Detection Model for Smart Contracts.

CD-VulD: Cross-Domain Vulnerability Discovery Based on Deep Domain Adaptation

Boosting the Capability of Intelligent Vulnerability Detection by Training in a Human-Learning Manner

Deep Learning based Vulnerability Detection: Are We There Yet?

Toward Improved Deep Learning-based Vulnerability Detection

A Comparative Study of Deep Learning-Based Vulnerability Detection System

On Security Weaknesses and Vulnerabilities in Deep Learning Systems

DeepCov: Coverage Guided Deep Learning Framework Fuzzing

Towards Making Deep Learning-based Vulnerability Detectors Robust

DiverseVul: A New Vulnerable Source Code Dataset for Deep Learning Based Vulnerability Detection

Dataflow Analysis-Inspired Deep Learning for Efficient Vulnerability Detection

Vul-LMGNNs: Fusing Language Models and Online-Distilled Graph Neural Networks for Code Vulnerability Detection

CoopHance: Cooperative Enhancement for Robustness of Deep Learning Systems

DLAP: A Deep Learning Augmented Large Language Model Prompting Framework for Software Vulnerability Detection

DefectHunter: A Novel LLM-Driven Boosted-Conformer-based Code Vulnerability Detection Mechanism

An Empirical Study of Vulnerability Detection using Federated Learning

Interpreting Deep Learning-based Vulnerability Detector Predictions Based on Heuristic Searching

VulDetectBench: Evaluating the Deep Capability of Vulnerability Detection with Large Language Models