DCVD: Dual-Channel Cross-Modal Fusion for Joint Vulnerability Detection and Localization

Technical Summary: DCVD – Dual-Channel Cross-Modal Fusion for Joint Vulnerability Detection and Localization

Problem Statement
Software vulnerability detection is critical for system security, yet real-world auditing requires two distinct capabilities: determining if a function is vulnerable (function-level detection) and pinpointing the specific lines responsible (statement-level localization). Existing approaches suffer from three primary limitations:

1. Single-Source Dependency: Most methods rely on only one information source—sequential (tokens), structural (graphs), or semantic (LLMs)—failing to exploit the complementary strengths of these modalities. Sequence-based methods miss structural control flow; graph-based methods lack high-level semantic intent; and LLM-based methods often miss control flow anomalies.
2. Representation Gap: Structural features (graphs) and semantic features (embeddings) exist in different data formats and subspaces. Naive fusion strategies (e.g., concatenation) fail to align these heterogeneous representations effectively.
3. Supervision Asymmetry: Current frameworks often treat statement-level localization as a byproduct of function-level detection (e.g., via attention weights) rather than using explicit line-level supervision. This lack of direct supervision limits localization precision and fails to leverage the synergistic relationship between the two granularities.

Methodology
The authors propose DCVD (Dual-Channel Cross-Modal Vulnerability Detection), a unified framework designed to jointly optimize function-level detection and statement-level localization. The architecture consists of three core components:

1. Dual-Channel Encoder:

   • Structure Branch: Utilizes Graph Attention Networks (GATs) to process two graph representations derived from static analysis: the Abstract Syntax Tree (AST) for syntactic hierarchy and the Control Flow Graph (CFG) for execution flow. This branch adaptively weights control nodes (e.g., boundary checks, conditional branches) relevant to vulnerabilities.
   • Semantic Branch: Leverages a Large Language Model (LLM) to generate natural language explanations of the code's functionality and potential security behaviors. These explanations are combined with the source code embeddings via a shared layer to capture functional intent and API semantics that structural analysis might miss.

2. Cross-Modal Fusion:

   • Contrastive Alignment: Before fusion, the framework aligns the structural and semantic representations into a shared high-dimensional space using contrastive learning. This reduces the distribution gap between the two modalities.
   • Bidirectional Cross-Attention: The aligned features undergo deep interaction via bidirectional cross-attention. The structural representation queries the semantic features and vice versa, allowing each modality to selectively attend to the most informative elements of the other. The resulting fused representation is further processed by a multi-layer Transformer (GraphCodeBERT) to capture long-range dependencies and cross-line context.

3. Multi-Granularity Supervisor:

   • This module performs joint training with explicit supervision at two levels:
     • Function-Level: A classification branch predicts whether a function is vulnerable.
     • Statement-Level: A localization branch predicts vulnerability scores for specific lines, aggregating token-level scores to the line level.
   • The total loss function combines the function-level loss, statement-level loss, and contrastive alignment loss, allowing the two tasks to collaboratively optimize one another.

Key Contributions

• Dual-Channel Encoder: A parallel architecture combining GAT-based control dependency extraction with LLM-enhanced semantic extraction, capturing multi-dimensional vulnerability information.
• Cross-Modal Fusion Module: A novel mechanism using contrastive alignment and bidirectional cross-attention to bridge the gap between graph-structural and textual-semantic features, enabling deep complementary fusion.
• Multi-Granularity Supervisor: A training framework that incorporates explicit statement-level supervision alongside function-level supervision, moving beyond indirect attention-based attribution to achieve collaborative optimization.
• Empirical Superiority: The framework demonstrates consistent outperformance over state-of-the-art methods on both detection and localization tasks.

Experimental Results
Experiments were conducted on BigVul, a large-scale real-world C/C++ vulnerability dataset containing both function-level labels and statement-level annotations.

• Function-Level Detection: DCVD achieved an F1-score of 94.84% and Recall of 92.32%, outperforming the strongest baseline (MatsVD) by +1.03 and +1.95 respectively.
• Statement-Level Localization: Under both Two-Phase and One-Phase protocols, DCVD improved F1-scores by approximately 1.25% to 2.15% over baselines.
• Localization Ranking: DCVD significantly improved ranking metrics, achieving a Top-1 accuracy of 93.80% (vs. 92.77 for MatsVD) and reducing the Mean First Rank (MFR) from 2.46 to 1.77, indicating a higher precision in ranking vulnerable lines at the top.
• Ablation Studies: Removing any component (Structure, Semantic, Fusion, or Multi-Task supervision) resulted in performance degradation, confirming that the explicit statement-level supervision not only aids localization but also reinforces function-level detection.

Significance and Claims
The paper claims that DCVD addresses the fundamental limitations of single-source modeling and indirect localization strategies. By effectively bridging the cross-modal representation gap and introducing explicit multi-granularity supervision, DCVD enables a collaborative optimization of detection and localization. The authors assert that this unified approach provides a more robust solution for real-world security auditing, where identifying the specific lines of code responsible for vulnerabilities is as critical as detecting the presence of the vulnerability itself. The code is made available to facilitate further research.