The increasing adoption of Large Language Models (LLMs) in software engineering has sparked interest in their use for software vulnerability detection. However, the rapid development of this field has resulted in a fragmented research landscape, with diverse studies that are difficult to compare due to differences in, e.g., system designs and dataset usage. This fragmentation makes it difficult to obtain a clear overview of the state-of-the-art or compare and categorize studies meaningfully. In this work, we present a comprehensive systematic literature review (SLR) of LLM-based software vulnerability detection. We analyze 227 studies published between January 2020 and June 2025, categorizing them by task formulation, input representation, system architecture, and adaptation techniques. Further, we analyze the datasets used, including their characteristics, vulnerability coverage, and diversity. We present a fine-grained taxonomy of vulnerability detection approaches, identify key limitations, and outline actionable future research opportunities. By providing a structured overview of the field, this review improves transparency and serves as a practical guide for researchers and practitioners aiming to conduct more comparable and reproducible research. We publicly release all artifacts and maintain a living repository of LLM-based software vulnerability detection studies.

To identify relevant studies, we conducted a systematic literature search across three major databases: IEEE Xplore, ACM Digital Library, and arXiv. We selected IEEE Xplore and the ACM Digital Library as they host peer-reviewed publications from conferences and journals. We further include arXiv for preprints to capture ongoing research that is still in the submission process, given the rapidly evolving nature of this field. We manually identified a set of relevant primary studies in our prior publication [13], which we used to derive keywords for an initial search string. We refined this search string using keywords from related surveys [19, 36]. We searched the selected databases for studies whose titles or abstracts matched this search string. Before the cutoff date in July, the database search yielded a total of 552 studies from IEEE Xplore, 344 studies from ACM, and 2287 studies from arXiv. For reproducibility, the final search string is as follows:

Following the initial retrieval, we applied a selection process to filter irrelevant studies. We reviewed the title and abstract of each study and screened it to assess its relevance based on predefined inclusion (✓) and exclusion (✗) criteria:

• ✓ Studies that use and evaluate LLMs for software vulnerability detection, introducing novel methods or systems.
• ✗ Studies that do not use LLMs to actively detect vulnerabilities but solely to work on outputs produced by other (static analysis) tools.
• ✗ Studies that mention LLMs only in passing or use them merely as baselines.
• ✗ Studies that focus on domains outside source code vulnerability detection, such as binary code, smart contracts, network analysis, or malware detection.
• ✗ Studies not written in English.
• ✗ Studies not accessible in full text.
• ✗ Studies identified as duplicates or minor variations of multi- or extended-version papers from the same authors.
• ✗ Studies classified as reviews, surveys, theses, abstracts, posters, demonstrations, or tutorials.

Given the inclusion of preprints from arXiv, we conducted a manual quality check to determine study eligibility. We assessed whether the studies provided a clear contribution, adequately described the proposed workflow and implementation, outlined the evaluation setup (including datasets, baselines, and metrics), and presented coherent findings that support their central claims.

Finally, we performed backward and forward snowballing. We manually reviewed the reference lists of the selected studies (backward snowballing) and used citation tracking via Google Scholar to identify and evaluate additional papers citing the included studies (forward snowballing).

Following the selection process, we identified 227 papers that met our selection criteria. The earliest included study dates back to 2020. The vast majority of publications (106 studies, 46.7%) were published in 2024, followed by 54 studies in 2025, underscoring the rapidly growing interest in and significance of LLM-based vulnerability detection. Notably, 83 (36.6%) of the selected studies were sourced from arXiv, reflecting both the fast-paced development of this field and the prevalence of recent works still undergoing peer review.

During the full-text review, we extracted key data points, recording how the vulnerability detection task was defined, which LLMs were used, and what adaptation techniques were employed. Additionally, we extracted information on input representation formats, datasets used for fine-tuning and evaluation, targeted vulnerability types (e.g., specific CWEs), and evaluation metrics. This structured analysis enabled us to derive a comprehensive taxonomy of LLM-based software vulnerability detection approaches, address the research questions, and develop a deeper understanding of current trends, open challenges, and emerging directions in LLM-based software vulnerability detection.

LLM-based vulnerability detection can be framed in multiple ways, depending on how the task is formulated and what objectives are prioritized beyond detection. This section outlines and discusses the most common formulations, particularly as classification tasks, and additional objectives.

4.1.1 Task Formulation

4.1.2 Additional Objectives

In the context of LLM-based vulnerability detection, the way source code and related information are represented as input plays a crucial role in model performance. Beyond plain software code, inputs may include natural language vulnerability descriptions or structured abstractions of code. These representations influence the model’s ability to capture both syntax and deeper semantic relationships relevant to vulnerability patterns. Building on the taxonomy introduced for vulnerability repair by Zhang et al. [36], we adapt it for the vulnerability detection task, categorizing input representations as raw, structure-aware, prompt, and conversation-style.

4.2.1 Raw

4.2.2 Structure-Aware

4.2.3 Prompt

Vulnerability detection systems using LLMs differ significantly in how the models are integrated into the overall architecture. Broadly, we categorize existing approaches into two groups: LLM-centric systems, where the LLM serves as the core analytical component, and hybrid systems, where the LLM is used in conjunction with other models.

4.3.1 LLM-Centric

4.3.2 Hybrid

LLMs are adapted to the vulnerability detection task through various state-of-the-art techniques, which differ in how they modify the model’s parameters. The primary adaptation techniques are prompt engineering, fine-tuning, and pre-training. Each strategy reflects different trade-offs between computational cost, model adaptation, and task-specific performance. In the following, we discuss the adaptation techniques as observed in the surveyed studies in detail.

4.4.1 Prompt Engineering

4.4.2 Training

4.4.3 Learning Paradigms

Beyond supervised learning, several advanced learning paradigms have been employed to enhance the performance and generalization capabilities of vulnerability detection models: contrastive learning, causal learning, multi-task learning, knowledge distillation, and continual learning.

4.4.3.1 Contrastive Learning

Contrastive learning aims to learn more discriminative representations by encouraging the model to pull semantically similar instances closer and push dissimilar ones apart in the representation space, thereby improving the model’s ability to distinguish between structurally similar but semantically different code, such as secure versus vulnerable code. Several studies adapt contrastive learning techniques to the vulnerability detection domain [111, 207, 210, 129, 128, 144]. Notably, Du et al. [129] propose mutual nearest neighbor contrastive learning to align the source and target domains. For multi-class classification, Ding et al. [128] introduce class-aware contrastive learning, which minimizes similarity only between samples with different class labels to improve type-specific discrimination. Ji et al. [144] present a hierarchical contrastive learning framework to bring vector representations of related CWEs closer together, combining supervised and self-supervised contrastive losses to promote geometric spread and better inter-class separation.

4.4.3.2 Causal Learning

Causal learning guides models to focus on genuine cause-and-effect relationships rather than relying on spurious correlations in the data, e.g., variable or API names that are not actual causes of vulnerabilities. Rahman et al. [163] identify such spurious features via semantic-preserving perturbations (e.g., variable renaming or dead-code injection) and then systematically remove their influence using causal inference techniques. Specifically, they simulate interventions, i.e., asking how the model would behave if certain spurious features were actively changed, and block non-causal paths by conditioning on known spurious factors. This strategy allows the model to rely on invariant, causally-relevant features and thereby improve robustness and generalization to unseen or perturbed code scenarios, such as different projects or naming conventions.

4.4.3.3 Multi-Task Learning

Multi-task learning has emerged as an effective paradigm for improving generalization by jointly training on related tasks, thereby reducing overfitting and enhancing model robustness across a range of tasks. Several studies adopt multi-task learning to enhance vulnerability analysis. Fu et al. [75] fine-tune CodeBERT under the multi-task setting for predicting CWE-ID and CWE-type, while Chen et al. [94] combine CWE-ID classification with line-level vulnerability detection. Curto et al. [72] perform binary vulnerability detection alongside multi-class vulnerability categorization. Similarly, Steenhoek et al. [84] fine-tune CodeBERT for simultaneous binary classification, multi-class vulnerability type prediction, and localization. Du et al. [74] apply multi-task instruction-tuning for vulnerability detection, localization, and interpretation of root causes. Russo et al. [166] leverage shared information between self-admitted technical debt (SATD) and vulnerabilities to jointly detect both issues. Ding et al. [239] use multi-task pre-training to jointly learn static and dynamic code properties.

4.4.3.4 Knowledge Distillation

Knowledge distillation is a model compression strategy in which a smaller model, i.e., the student, is trained to replicate the behavior of a larger model, i.e., the teacher. By learning from the teacher’s output distributions, the student achieves comparable performance while significantly reducing computational cost, making it suitable for resource-constrained settings. Some studies directly adopt pre-trained distilled models such as DistilBERT for vulnerability detection [126, 223], while other studies apply knowledge distillation explicitly, using teacher and student models from the BERT family [231, 205]. Nguyen et al. [160] adopt a multi-teacher setup with CNN and GNN models to distill knowledge into a student LLM backbone. A more advanced approach is presented by Fu et al. [132], which introduce a hierarchical knowledge distillation framework. The CWE label space is split into multiple sub-distributions based on semantic similarity, and individual CNN teacher models are trained on each subset. A student language model then learns to generalize across the teacher outputs, improving its ability to handle multi-class vulnerability detection tasks. Weyssow et al. [118] distill structured reasoning capabilities from a teacher LLM into smaller student LLMs using reinforcement learning from AI feedback (RLAIF). Panichella [204] combines metamorphic testing with many-objective optimization for distillation of LLMs for code, measuring model robustness across semantically equivalent code variants. Ibanez-Lissen et al. [198] use linear classifier probes (LPs) to identify valuable layers in pre-trained LLMs before fine-tuning, guiding selective compression and adaptation based on task-specific relevance.

4.4.3.5 Continual Learning

Retraining a model on all known vulnerabilities each time a new vulnerability is disclosed would demand considerable computational resources and time. Continual learning enables models to incrementally learn new knowledge over time, such as new programming languages or up-to-date vulnerability data, without forgetting what has already been learned (Catastrophic Forgetting). Gao et al. [133] propose an adaptive regularization strategy that preserves the most representative (i.e., informative and diverse) samples in each dataset for model retraining under project-level, language-level, and time-level continual learning settings. Similarly, Zhang et al. [189] present an incremental learning approach that allows the model to incorporate new programming languages without degrading performance on those it has already learned. Tian et al. [58] introduce a training-free parameter fusion method that merges independent classification heads fine-tuned on different vulnerability types, allowing the fused model to adapt to new categories while preserving multi-class classification capabilities.

Other data-centric learning techniques have been explored in the surveyed studies to improve model performance, i.e., Positive and Unlabeled (PU) learning, active learning, and adversarial training. PU learning tackles the issue of limited and noisy labels by training models using only positively (vulnerable) labeled and unlabeled data [201, 147]. Active learning aims to reduce labeling costs by strategically selecting the most informative samples for annotation. For example, Lan et al. [203] combine dataset maps with active learning to prioritize valuable samples while filtering out those that may harm performance. Adversarial training enhances model robustness by introducing crafted perturbed code examples during training, improving resilience to noise and attacks [214, 94, 246].

Figure 2 maps the relationships between system architecture, input representation, adaptation techniques, and task formulation across the 227 surveyed studies. Each node is annotated with the absolute number of studies assigned to that category, providing a quantitative overview of the landscape. The diagram enables a holistic view of how LLMs are combined with the different input representations and adaptation strategies. The rightmost part of the diagram visualizes how these techniques correlate with task formulations, highlighting the dominance of binary classification. The diagram further reveals underexplored combinations, such as the use of structure-aware inputs with PEFT and prompting methods for vulnerability-specific classification. This overview serves as a compact visual summary of the field and offers starting points for researchers to explore novel system designs or revisit rarely studied combinations.

We categorize vulnerability datasets according to type, granularity, source, and labelling, as shown in Figure 3, to capture their quality and realistic nature. Similar to related surveys [22, 17, 24, 27, 29, 31], we provide a comprehensive overview of commonly used datasets in the surveyed studies as well as selected, more recent datasets suited to address open challenges of LLM-based methods, refer to Table 3. We briefly introduce these datasets along with the taxonomy and discuss the resulting practical challenges and biases in dataset construction. In addition, we compare the selected datasets based on further characteristics such as their programming languages covered, as well as quantitative characteristics, i.e., dataset size, the share of samples representing vulnerabilities, and the number of distinct CWEs covered, cf. Table 4, as a proxy for label diversity and comprehensiveness.

5.1.1 Dataset Type

5.1.2 Dataset Granularity

5.1.3 Dataset Source

5.1.4 Dataset Labeling

5.1.5 Dataset Programming Language

5.1.6 Dataset Size and Share of Vulnerable Samples

The size of a dataset is strongly influenced by the dataset source and its labeling method. Smaller datasets typically involve manual curation, enabling high label quality but limited scalability. SecurityEval, for example, focuses on evaluating secure code generation in Python. It consists of 121 manually curated prompt-based samples across 75 CWE types, resulting in a dataset with 100% vulnerable samples. Similarly, SVEN focuses on evaluating secure code generation, offering improved label reliability with a 50% share of vulnerable samples, but is limited in scope due to its focus on a fixed subset of CWEs. In contrast, larger datasets rely on automated pipelines for scalability. DiverseVul [124] scales up the volume and variety of functions compared to earlier VFC-based datasets such as Devign, ReVeal [324], Big-Vul, CrossVul, and CVEfixes, with a share of 5% vulnerable samples.

The dataset type and the labeling method used in dataset construction influence both the quality and realism, cf. Figure 4. Synthetic datasets, such as Juliet or FormAI, offer high label accuracy due to controlled injection of known vulnerability patterns but often lack the structural complexity and semantic diversity found in real-world code. In contrast, datasets derived from real-world sources provide greater realism, better reflecting practical vulnerability scenarios. However, they often suffer from label noise due to assumptions inherent in VFC-based labeling. These datasets also vary in the proportion of vulnerable samples. Highly imbalanced datasets, i.e., where vulnerabilities are underrepresented, reflect the natural rarity of vulnerabilities in real code. While realistic, such an imbalance poses challenges for training models, which may become biased towards predicting the majority class. To mitigate this challenge, preprocessing techniques are often required to ensure effective training, e.g., resampling: oversampling the minority (vulnerable) class or undersampling the majority (non-vulnerable) class to achieve a more balanced class distribution. Figure 4 visualizes this trade-off between labeling accuracy and realism, providing a practical framework for selecting datasets for different research objectives.

5.1.7 Dataset Multi-Class Labeling

Vulnerability detection is often framed as a binary classification task, i.e., distinguishing between vulnerable and non-vulnerable code. The ReVeal dataset provides security-related patches collected from bug tracking systems, offering paired vulnerable and fixed code samples labeled in binary form.

Many datasets go beyond binary classification by providing labels for specific vulnerability types, enabling multi-class classification. CVEfixes is a comprehensive and automatically curated dataset collected from CVE entries in the NVD. It identifies linked open-source projects and extracts function-level vulnerable and fixed code samples from VFCs. The latest release at the time of writing (v1.0.8) includes all CVEs published up to July 23, 2024, covering 272 distinct CWEs. The PairVul dataset [100] takes a more controlled approach by focusing on pairs of vulnerable and non-vulnerable code with high lexical similarity. These pairs are extracted from Linux kernel CVEs, labeled using VFCs, and filtered to ensure that the associated fixes are not reverted or modified in subsequent commits. While the dataset offers high-quality and balanced samples, its scope is currently limited to selected Linux kernel vulnerabilities.

A common limitation across vulnerability datasets is the lack of coverage of recently disclosed vulnerabilities. Static datasets may quickly become outdated, reducing their relevance for real-time or forward-looking research. This highlights the need for continuously maintained and automatically extensible datasets, such as CVEfixes, which is supported by an automated pipeline.

Beyond classification, datasets such as Big-Vul, CrossVul, CVEfixes, and ReposVul offer rich metadata, including CWE descriptions and severity scores. Such metadata supports more advanced tasks such as severity estimation, root-cause reasoning, and context-aware vulnerability analysis, broadening their use beyond binary classification.

To assess the real-world applicability and limitations of LLM-based vulnerability detection approaches, it is crucial to use datasets that capture a diverse range of vulnerability types. Such diversity enables more realistic evaluations, as it reflects the variety and complexity of vulnerabilities encountered in practical software development. As shown in Table 4, the number and variety of vulnerability types (i.e., number of CWE classes) represented vary considerably across the selected datasets. Some datasets focus narrowly on specific vulnerability types and CWE classes, while others aim for broader CWE diversity. To assess the diversity and composition of CWEs, we analyze selected real-world and mixed datasets providing multi-class labels (cf. Table 3) in more depth, focusing on their CWE coverage and distribution. Specifically, we analyze VulDeePecker, Draper, Big-Vul, CVEfixes, CrossVul, SecurityEval, DiverseVul, SVEN, ReposVul, PrimeVul, PairVul, and MegaVul. D2A and FormAI are excluded from this analysis. D2A is not considered, as it provides only static analyzer outputs without CWE annotations. Similarly, FormAI, while performing manual CWE mapping, does not include these mappings as part of the dataset but only error types provided by the formal verification tool.

As discussed in prior works [127, 142, 318], real-world vulnerability datasets exhibit a characteristic long-tail distribution: A small number of CWE types are heavily represented, while the majority of CWE types appear only rarely, often with just one or two examples. This characteristic is visualized in Figure 5, which shows the count of CWEs for the 15 most and least represented CWE classes for selected datasets. For example, while CVEfixes covers 272 distinct CWE types, the majority are sparsely represented. A similar pattern is observed for DiverseVul, which covers 150 CWEs. Such skewed distributions lead to biased learning, where models disproportionately focus on a small subset of vulnerability types. MegaVul and SecurityEval represent efforts to encourage a more balanced representation. SecurityEval, in particular, provides one to six manually curated examples for 69 CWEs. These efforts represent a step towards reducing long-tail effects and developing more generalizable vulnerability detection models.

For a more structured comparison of the CWE distributions across the datasets, we adopt the CWE-1000 Research View [349]. This view provides a hierarchical grouping of CWEs intended for research and analysis. It groups CWEs into broad research concepts to help identify inter-dependencies, shared characteristics, and root causes of vulnerabilities. The CWE-1000 view spans multiple levels of abstraction: At the highest level are pillars and categories, which provide high-level groupings but are not intended for direct vulnerability mapping. Beneath these are the class, base, and variant levels, with variant representing the most specific level, i.e., language- or technology-specific weaknesses. By design, the CWE-1000 view organizes every weakness in the CWE catalog into one of ten pillars, cf. Table 5.

We consider the mapping of CWE-1000 to cluster the CWEs represented in the individual datasets. This clustering enables a structured comparison beyond CWE counts by highlighting which vulnerability types are emphasized or underrepresented, assessing the thematic diversity and coverage of vulnerability datasets. Notably, many datasets were built using the NVD, which also includes deprecated or discouraged CWE entries not mapped by CWE-1000, as well as general categories such as CWE-OTHER or CWE-NOINFO, used when insufficient information is available. To account for these cases, we introduce an additional group labeled not mapped, capturing all CWE entries that fall outside the scope of the CWE-1000 view. For each dataset, we compute the relative share of each CWE based on the vulnerable functions (or files, depending on the granularity provided). A special case is the CVEfixes dataset, where VFCs are associated with CVE identifiers, and each CVE may be linked to one or more CWEs. Some commits address multiple CVEs, and the associated CWE mappings may span different levels of specificity. To normalize the distributions and ensure a consistent comparison, we compute the share of each CWE based on the total number of CWE labels assigned to all vulnerable samples, rather than the number of vulnerable functions.

Figure 6 visualizes the distribution of the top 25 CWE types covered by vulnerable samples across the selected datasets. Among the mixed datasets and those with a CWE-specific focus, VulDeePecker, Draper, and SVEN include only a small number of CWEs, i.e., two, four, and nine, respectively. SecurityEval features the widest variety of CWEs among mixed datasets, with a similar distribution across its covered types. The CWEs represented in the top 25 across all datasets account for only around 20% of its total CWE labels. In comparison, the real-world datasets exhibit a more pronounced long-tail distribution: the top 25 CWEs typically account for around 80% of all vulnerability labels. This highlights a strong skew towards a small set of frequently occurring vulnerability types.

The most widely represented CWEs across datasets are those associated with the pillar Improper Control of a Resource Through its Lifetime, which includes memory and resource management vulnerabilities that are commonly found in C/C 0.1ex ++ , the most dominant language across the studied datasets. This pillar is also the largest in terms of CWE count (cf. Table 5), followed by Improper Neutralization, encompassing issues related to input validation and sanitization. Other pillars are underrepresented in comparison to their relative size in the CWE view. These pillars include Improper Adherence to Coding Standards and Improper Access Control. Notably, some pillars, such as Improper Interaction Between Multiple Correctly-Behaving Entities, Protection Mechanism Failure, and Incorrect Comparison, are not represented at all among the top 25 CWEs, and are less represented in the overall CWEs covered, cf. Figure 7. These categories are inherently more difficult to capture in real-world datasets, particularly at the function level, as they often involve complex inter-component dependencies, system-level interactions, or contextual analysis that is not easily observable from isolated code snippets.

A considerable share of CWEs in the analyzed datasets fall into the not mapped category. This is often the result of outdated or abstract vulnerability labels sourced from the NVD. For instance, VulDeePecker covers two high-level CWEs, i.e., the class CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer [350] and the category CWE-399 Resource Management Errors [351], flattening the existing CWE hierarchy and obscuring more specific vulnerability types. Importantly, the use of abstract categories such as classes for mapping has been discouraged since 2019, as they are frequently misapplied in low-information vulnerability reports where more specific child CWEs would be more appropriate [350]. The use of categories for vulnerability mapping is explicitly prohibited [351]. Several other CWEs commonly found in the selected datasets are also discouraged for use in vulnerability mappings, e.g., CWE-20 Improper Input Validation, CWE-200 Exposure of Sensitive Information to an Unauthorized Actor, and CWE-400 Uncontrolled Resource Consumption. In addition, pillars such as CWE-284 Improper Access Control and CWE-703 Improper Check or Handling of Exceptional Conditions are often used as placeholders in vulnerability reports lacking detailed analysis, leading to imprecise dataset annotations.

Some CWEs are marked as allowed with review, meaning they can be used in vulnerability mapping but should be applied carefully and only when more specific alternatives are not available. For example, CWE-120 Buffer Copy without Checking Size of Input is frequently selected based on keyword presence (’Classic Buffer Overflow’), but is only appropriate when the vulnerability involves unchecked buffer copy operations [352]. Similar caution applies to CWEs such as CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (’Race Condition’) and CWE-94 Improper Control of Generation of Code (’Code Injection’).

The use of general or deprecated CWE labels presents challenges to dataset quality and limits the effectiveness of CWE-based classification and reasoning. Notably, there are 555 CWEs in the CWE-1000 view that are allowed for vulnerability mapping but are not represented as vulnerable samples in any of the analyzed datasets. This indicates that current datasets cover only a subset of CWE types, leaving many mappable software weaknesses absent from training and benchmarking. As a result, tools trained on these datasets may lack generalization capabilities when faced with previously unseen vulnerabilities. Further, evaluation results appear artificially strong, as they are often biased towards commonly occurring CWEs while excluding rare and long-tail vulnerability types. To address these limitations, more effort is needed to incorporate the CWE hierarchy into training and evaluation protocols, moving beyond binary labels to consider hierarchically related CWEs. For example, Tamberg and Bahsi [86] follow an evaluation method in which both parent and child CWEs are considered valid classifications using MITRE’s Research Concepts view.

Understanding how vulnerability datasets are used over time provides insight into community practices, widely used benchmark datasets, and emerging research directions. Analyzing temporal trends also reveals how quickly new datasets are adopted, how long benchmark datasets remain influential, and where gaps or biases may persist in evaluation setups. Such an analysis is particularly important in this rapidly evolving field to guide future dataset development and advance performance through more representative and robust evaluations.

Figure 8 visualizes the temporal usage and usage frequency of the selected vulnerability datasets from 2020 to mid-2025 by the surveyed studies. Red markers indicate the publication dates of the datasets. The figure shows that even today, early deep learning datasets such as Devign remain in widespread use, serving as a foundational dataset for graph-based and learning-based vulnerability detection models. The introduction of Big-Vul in September 2020 further enhanced dataset diversity and volume; Big-Vul also continues to be widely adopted. The persistent use of Devign and Big-Vul is partly due to their role in enabling comparability across studies. Classic test suites such as SARD and Juliet are also frequently used, cf. Figure 8, useful for controlled evaluations due to their synthetic nature. However, these earlier datasets often lack current CWE coverage and may reinforce outdated vulnerability mappings.

Figure 8 also shows that since 2021, there has been a clear trend towards real-world vulnerability datasets, e.g., CVEfixes, CrossVul, and DiverseVul. Several more recent datasets, such as FormAI, PrimeVul, PairVul, and CleanVul, are explicitly designed for evaluating LLM-based vulnerability detection approaches. For these datasets, adoption lags of approximately one to six months can be observed between a dataset’s release and adoption in published research. This lag reflects the time needed for several practical steps, including dataset validation, integration into existing toolchains and model pipelines, and broader community uptake. In many cases, adoption may also depend on the availability of documentation and preprocessing scripts. Further, early adopters often play a key role in demonstrating a dataset’s utility, which can influence its acceptance and reuse.

Another notable trend is the increasing use of newly created or custom datasets, see row "Custom" in Figure 8. A total of 71 studies either use or introduce custom datasets, often to address perceived limitations in existing datasets. Common motivations include correcting unrealistic data distributions, expanding project and vulnerability diversity, including more recent disclosures, or improving overall dataset quality (e.g., fixing incomplete or incorrectly merged functions) [318]. This trend is also driven by domain-specific or task-aligned needs. While such efforts encourage innovation and enable tailored evaluations, they also complicate comparability and may introduce implicit biases tied to individual evaluation design choices and construction assumptions.

The choice of suitable vulnerability datasets reflects a combination of common benchmark datasets, task alignment, and system design. In total, 158 distinct datasets are used across the surveyed studies, illustrating a high degree of fragmentation. Most studies either use or introduce custom datasets, with 126 datasets appearing only once. Only eight datasets are reused in more than ten studies, highlighting the lack of a standardized suite of benchmark datasets and consistency in dataset selection. Many studies use more than one dataset, often combining datasets to increase training data diversity or to evaluate model generalization, e.g., vulnerability types and programming languages. Figure 9 highlights the most frequently used dataset pairs across all surveyed studies. Among these, the most common combinations are ReVeal and Devign, Big-Vul and Devign, as well as Big-Vul and ReVeal. These pairings often complement each other in terms of data characteristics, such as vulnerable percentage or combining datasets with broad versus narrow CWE coverage.

The use of many different datasets and combinations, however, hampers direct comparability of evaluation results, particularly when studies apply different splits for training, validation, and testing, or pre-process the same datasets differently. Figure 10 offers insight into overlaps and divergences in dataset usage across specific use cases. When fine-tuning LLMs for vulnerability detection, e.g., using LoRA (Low-Rank Decomposition, 17 studies), researchers often resort to large and diverse datasets, most commonly DiverseVul, Devign, Big-Vul, and ReVeal. However, many studies make use of additional, lesser-used datasets. This practice reduces comparability and makes it difficult to replicate results or isolate model performance. RAG studies (17 studies) most commonly use Devign and Big-Vul, appearing in four studies. Big-Vul, in particular, is often used for knowledge base construction of CWE entries due to the provided metadata, e.g., CWE descriptions. Five RAG studies introduce custom datasets, which hinders comparison, especially concerning the semantics of the retrieved context. Agentic approaches (8 studies) show even greater fragmentation, with only two studies aligning on PrimeVul. GNN-based hybrid approaches most frequently rely on Devign, followed by custom datasets, ReVeal, and Big-Vul. Devign is particularly suited for GNNs due to its composite code representation, encoding program control and data dependencies as heterogeneous edges within a unified graph structure. The absence of shared benchmarks within the discussed use cases highlights the need for controlled and standardized evaluation protocols.

The limitations identified in this review emerge from recurring issues observed across the surveyed studies and span key aspects such as dataset realism and representativeness, vulnerability diversity, methodological rigor, and evaluation practices. We structure these findings into seven themes L1-L7 that outline the most pressing limitations.

6.1.1 L1 Dataset and Detection Granularity

6.1.2 L2 Dataset Labeling and Quality

6.1.3 L3 Study Evaluation and Comparability

6.1.4 L4 Up-to-Date Vulnerability Knowledge

6.1.5 L5 Code and Vulnerability Representation

6.1.6 L6 Model Interpretability and Explainability

6.1.7 L7 Integration into Pipelines and Workflows

Building on the identified limitations, each theme reflects core challenges in current research and highlights open questions that future work must address to enable more robust, generalizable, and reproducible progress in LLM-based software vulnerability detection. In this section, we provide interpretations or promising research directions, offering actionable insights to guide future work towards addressing these challenges.

6.2.1 L1 Dataset and Detection Granularity

6.2.2 L2 Dataset Labeling and Quality

6.2.3 L3 Study Evaluation and Comparability

6.2.4 L4 Up-to-Date Vulnerability Knowledge

6.2.5 L5 Code and Vulnerability Representation

6.2.6 L6 Model Interpretability and Explainability

6.2.7 L7 Integration into Pipelines and Workflows

[1] CVE CVE – Common Vulnerabilities and Exposures 2025

[2] CVE CVE Metrics 2025

[3] MITRE CWE - Common Weakness Enumeration 2025

[4] Roland Croft and M. Ali Babar and M. Mehdi Kholoosi Data Quality for Software Vulnerability Datasets International Conference on Software Engineering (ICSE) 2023 121-133 IEEE/ACM 10.1109/ICSE48619.2023.00022

[5] Yu Zhao and Lina Gong and Zhiqiu Huang and Yongwei Wang and Mingqiang Wei and Fei Wu Coding-PTMs: How to Find Optimal Code Pre-trained Models for Code Embedding in Vulnerability Detection? International Conference on Automated Software Engineering (ASE) 2024 1732–1744 IEEE/ACM 10.1145/3691620.3695539

[6] Jacob Devlin and Ming-Wei Chang and Kenton Lee and Kristina Toutanova Bert: Pre-training of Deep Bidirectional Transformers for Language Understanding Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL HLT) 2019 4171–4186 ACL

[7] Ashish Vaswani and Noam Shazeer and Niki Parmar and Jakob Uszkoreit and Llion Jones and Aidan N Gomez and \L ukasz Kaiser and Illia Polosukhin Attention is All you Need Advances in Neural Information Processing Systems (NeurIPS) 2017 30 5998-6008 Curran Associates, Inc.

[8] Dario Amodei CEO Speaker Series With Dario Amodei of Anthropic 2025 Interview by Michael Froman

[9] Hammond Pearce and Baleegh Ahmad and Benjamin Tan and Brendan Dolan-Gavitt and Ramesh Karri Asleep at the Keyboard? Assessing the Security of GitHub Copilot’s Code Contributions Communications of the ACM 2025 68 2 96–105 10.1145/3610721

[10] Zhijie Liu and Yutian Tang and Xiapu Luo and Yuming Zhou and Liang Feng Zhang No Need to Lift a Finger Anymore? Assessing the Quality of Code Generation by ChatGPT IEEE Transactions on Software Engineering (TSE) 2024 50 6 1548-1584 10.1109/TSE.2024.3392499

[11] 2024. Exploring and Evaluating Hallucinations in LLM-Powered Code Generation. https://arxiv.org/abs/2404.00971

[12] 2025. Security Weaknesses of Copilot-Generated Code in GitHub Projects: An Empirical Study. https://arxiv.org/abs/2310.02059

[13] Sabrina Kaniewski and Dieter Holstein and Fabian Schmidt and Tobias Heer Vulnerability Handling of AI-Generated Code - Existing Solutions and Open Challenges Conference on AI, Science, Engineering, and Technology (AIxSET) 2024 145-148 IEEE 10.1109/AIxSET62544.2024.00026

[14] Sabrina Kaniewski and Fabian Schmidt and Markus Enzweiler and Michael Menth and Tobias Heer Artifacts - Awesome-LLM4SVD 2025

[15] 2025. Large Language Models for Cyber Security: A Systematic Literature Review. https://arxiv.org/abs/2405.04760

[16] Jie Zhang and Haoyu Bu and Hui Wen and Yongji Liu and Haiqiang Fei and Rongrong Xi and Lun Li and Yun Yang and Hongsong Zhu and Dan Meng When LLMs Meet Cybersecurity: A Systematic Literature Review Cybersecurity 2025 8 1 55

[17] Mohamed Amine Ferrag and Fatima Alwahedi and Ammar Battah and Bilel Cherif and Abdechakour Mechri and Norbert Tihanyi and Tamas Bisztray and Merouane Debbah Generative AI in Cybersecurity: A Comprehensive Review of LLM Applications and Vulnerabilities Internet of Things and Cyber-Physical Systems (IOTCPS) 2025 5 1–46 10.1016/j.iotcps.2025.01.001

[18] 2024. A Survey on Large Language Models for Software Engineering. https://arxiv.org/abs/2312.15223

[19] Xinyi Hou and Yanjie Zhao and Yue Liu and Zhou Yang and Kailong Wang and Li Li and Xiapu Luo and David Lo and John Grundy and Haoyu Wang Large Language Models for Software Engineering: A Systematic Literature Review ACM Transactions on Software Engineering and Methodology (TOSEM) 2024 33 8 10.1145/3695988

[20] 2025. Assessing and Advancing Benchmarks for Evaluating Large Language Models in Software Engineering Tasks. https://arxiv.org/abs/2505.08903

[21] Nima Shiri Harzevili and Alvine Boaye Belle and Junjie Wang and Song Wang and Zhen Ming (Jack) Jiang and Nachiappan Nagappan A Systematic Literature Review on Automated Software Vulnerability Detection Using Machine Learning ACM Computing Surveys 2024 57 3 10.1145/3699711

[22] 2024. SoK: On Closing the Applicability Gap in Automated Vulnerability Detection. https://arxiv.org/abs/2412.11194

[23] 2025. AI-Based Software Vulnerability Detection: A Systematic Literature Review. https://arxiv.org/abs/2506.10280

[24] Seyed Mohammad Taghavi Far and Farid Feyzi Large Language Models for Software Vulnerability Detection: A Guide for Researchers on Models, Methods, Techniques, Datasets, and Metrics International Journal of Information Security (IJIS) 2025 24 2 78 10.1007/s10207-025-00992-7

[25] 2025. From Vulnerabilities to Remediation: A Systematic Literature Review of LLMs in Code Security. https://arxiv.org/abs/2412.15004

[26] Xin Zhou and Sicong Cao and Xiaobing Sun and David Lo Large Language Model for Vulnerability Detection and Repair: Literature Review and the Road Ahead ACM Transactions on Software Engineering and Methodology (TOSEM) 2025 34 5 10.1145/3708522

[27] 2025. LLMs in Software Security: A Survey of Vulnerability Detection Techniques and Insights. https://arxiv.org/abs/2502.07049

[28] Yuhao Lin and Ying Li and Mianxue Gu and Hongyu Sun and Qiuling Yue and Jinglu Hu and Chunjie Cao and Yuqing Zhang Vulnerability Dataset Construction Methods Applied To Vulnerability Detection: A Survey International Conference on Dependable Systems and Networks Workshops (DSN-W) 2022 141-146 IEEE 10.1109/DSN-W54100.2022.00032

[29] Yuejun Guo and Seifeddine Bettaieb and Fran Casino A Comprehensive Analysis on Software Vulnerability Detection Datasets: Trends, Challenges, and Road Ahead International Journal of Information Security 2024 23 5 3311–3327 10.1007/s10207-024-00888-y

[30] Ridhi Jain and Nicole Gervasoni and Mthandazo Ndhlovu and Sanjay Rawat A Code Centric Evaluation of C/C++ Vulnerability Datasets for Deep Learning Based Vulnerability Detection Techniques Innovations in Software Engineering Conference (ISEC) 2023 ACM 10.1145/3578527.3578530

[31] Yuejun Guo and Seifeddine Bettaieb An Investigation of Quality Issues in Vulnerability Detection Datasets European Symposium on Security and Privacy Workshops (EuroS&PW) 2023 29-33 IEEE 10.1109/EuroSPW59978.2023.00008

[32] Niklas Risse and Jing Liu and Marcel Böhme Top Score on the Wrong Exam: On Benchmarking in Machine Learning for Vulnerability Detection Proceedings of the ACM on Software Engineering (ASE) 2025 2 ISSTA 10.1145/3728887

[33] Anurag Swarnim Yadav and Joseph N. Wilson R+R: Security Vulnerability Dataset Quality Is Critical Annual Computer Security Applications Conference (ACSAC) 2024 1047-1061 IEEE 10.1109/ACSAC63791.2024.00086

[34] Barbara Kitchenham and Stuart Charters Guidelines for Performing Systematic Literature Reviews in Software Engineering Keele University 2007

[35] Kai Petersen and Sairam Vakkalanka and Ludwik Kuzniarz Guidelines for Conducting Systematic Mapping Studies in Software Engineering: An Update Information and Software Technology (INFSOF) 2015 64 1–18 10.1016/j.infsof.2015.03.007

[36] 2024. A Systematic Literature Review on Large Language Models for Automated Program Repair. https://arxiv.org/abs/2405.01466

[37] 2024. From Generalist to Specialist: Exploring CWE-Specific Vulnerability Detection. https://arxiv.org/abs/2408.02329

[38] Jaehyeon Bae and Seoryeong Kwon and Seunghwan Myeong Enhancing Software Code Vulnerability Detection Using GPT-4o and Claude-3.5 Sonnet: A Study on Prompt Engineering Techniques Electronics 2024 13 13 2657 10.3390/electronics13132657

[39] 2024. RealVul: Can We Detect Vulnerabilities in Web Applications with LLM? https://arxiv.org/abs/2410.07573

[40] 2025. Can LLM Prompting Serve as a Proxy for Static Analysis in Vulnerability Detection. https://arxiv.org/abs/2412.12039

[41] 2025. Helping LLMs Improve Code Generation Using Feedback from Testing and Static Analysis. https://arxiv.org/abs/2412.14841

[42] 2025. How Well Do Large Language Models Serve as End-to-End Secure Code Agents for Python? https://arxiv.org/abs/2408.10495

[43] 2025. RepoAudit: An Autonomous LLM-Agent for Repository-Level Code Auditing. https://arxiv.org/abs/2501.18160

[44] Avishree Khare and Saikat Dutta and Ziyang Li and Alaia Solko-Breslin and Rajeev Alur and Mayur Naik Understanding the Effectiveness of Large Language Models in Detecting Security Vulnerabilities Conference on Software Testing, Verification and Validation (ICST) 2025 103-114 IEEE 10.1109/ICST62969.2025.10988968

[45] 2025. IRIS: LLM-Assisted Static Analysis for Detecting Security Vulnerabilities. https://arxiv.org/abs/2405.17238

[46] 2025. Towards Explainable Vulnerability Detection with Large Language Models. https://arxiv.org/abs/2406.09701

[47] Mohammad Mahdi Mohajer and Reem Aleithan and Nima Shiri Harzevili and Moshi Wei and Alvine Boaye Belle and Hung Viet Pham and Song Wang Effectiveness of ChatGPT for Static Analysis: How Far Are We? International Conference on AI-Powered Software (AIware) 2024 151–160 ACM 10.1145/3664646.3664777

[48] 2024. Chain-of-Thought Prompting of Large Language Models for Discovering and Fixing Software Vulnerabilities. https://arxiv.org/abs/2402.17230

[49] Zoltán Szabó and Vilmos Bilicki A New Approach to Web Application Security: Utilizing GPT Language Models for Source Code Inspection Future Internet 2023 15 10 326

[50] Saad Ullah and Mingji Han and Saurabh Pujar and Hammond Pearce and Ayse Coskun and Gianluca Stringhini LLMs Cannot Reliably Identify and Reason About Security Vulnerabilities (Yet?): A Comprehensive Evaluation, Framework, and Benchmarks Symposium on Security and Privacy (SP) 2024 862-880 IEEE 10.1109/SP54263.2024.00210

[51] 2025. One-for-All Does Not Work! Enhancing Vulnerability Detection by Mixture-of-Experts (MoE). https://arxiv.org/abs/2501.16454

[52] 2024. VulnLLMEval: A Framework for Evaluating Large Language Models in Software Vulnerability Detection and Patching. https://arxiv.org/abs/2409.10756

[53] Yansong Li and Paula Branco and Alexander M. Hoole and Manish Marwah and Hari Manassery Koduvely and Guy-Vincent Jourdan and Stephan Jou SV-TrustEval-C: Evaluating Structure and Semantic Reasoning in Large Language Models for Source Code Vulnerability Analysis Symposium on Security and Privacy (SP) 2025 3014-3032 IEEE 10.1109/SP61157.2025.00191

[54] 2025. Trace Gadgets: Minimizing Code Context for Machine Learning-Based Vulnerability Prediction. https://arxiv.org/abs/2504.13676

[55] 2025. Can You Really Trust Code Copilots? Evaluating Large Language Models from a Code Security Perspective. https://arxiv.org/abs/2505.10494

[56] Amy Munson and Juanita Gomez and Álvaro A. Cárdenas ♪ With a Little Help from My (LLM) Friends: Enhancing Static Analysis with LLMs to Detect Software Vulnerabilities International Workshop on Large Language Models for Code (LLM4Code) 2025 25-32 IEEE/ACM 10.1109/LLM4Code66737.2025.00008

[57] 2025. AutoPatch: Multi-Agent Framework for Patching Real-World CVE Vulnerabilities. https://arxiv.org/abs/2505.04195

[58] 2025. You Only Train Once: A Flexible Training Framework for Code Vulnerability Detection Driven by Vul-Vector. https://arxiv.org/abs/2506.10988

[59] 2025. Leveraging Large Language Models for Command Injection Vulnerability Analysis in Python: An Empirical Study on Popular Open-Source Projects. https://arxiv.org/abs/2505.15088

[60] Yingying Zhang and Zhengdan Jiang and Xingkai Cheng and Han Wu and Zonghang Tian and Shuting Lou A Method of SQL Injection Attack Detection Based on Large Language Models International Conference on Computer Network Technology and Electronic and Information Engineering (CNTEIE) 2024 154-158 IEEE 10.1109/CNTEIE66268.2024.00035

[61] Yuan Zhou and Enze Wang and Shuoyoucheng Ma SSRFSeek: An LLM-based Static Analysis Framework for Detecting SSRF Vulnerabilities in PHP Applications International Seminar on Artificial Intelligence, Networking and Information Technology (AINIT) 2025 939-944 IEEE 10.1109/AINIT65432.2025.11035424

[62] Huanting Wang and Dejice Jacob and David Kelly and Yehia Elkhatib and Jeremy Singer and Zheng Wang SecureMind: A Framework for Benchmarking Large Language Models in Memory Bug Detection and Repair International Symposium on Memory Management (ISMM) 2025 27–40 ACM 10.1145/3735950.3735954

[63] 2025. SafeGenBench: A Benchmark Framework for Security Vulnerability Detection in LLM-Generated Code. https://arxiv.org/abs/2506.05692

[64] Sri Haritha Ambati and Norah Ridley and Enrico Branca and Natalia Stakhanova Navigating (In)Security of AI-Generated Code International Conference on Cyber Security and Resilience (CSR) 2024 1-8 IEEE 10.1109/CSR61664.2024.10679468

[65] 2025. A Comprehensive Study of LLM Secure Code Generation. https://arxiv.org/abs/2503.15554

[66] 2024. From Solitary Directives to Interactive Encouragement! LLM Secure Code Generation by Natural Language Prompting. https://arxiv.org/abs/2410.14321

[67] 2024. AutoSafeCoder: A Multi-Agent Framework for Securing LLM Code Generation through Static Analysis and Fuzz Testing. https://arxiv.org/abs/2409.10737

[68] 2023. Enhancing Large Language Models for Secure Code Generation: A Dataset-driven Study on Vulnerability Mitigation. https://arxiv.org/abs/2310.16263

[69] Xiao Yu and Lei Liu and Xing Hu and Jacky Wai Keung and Jin Liu and Xin Xia Fight Fire With Fire: How Much Can We Trust ChatGPT on Source Code-Related Tasks? IEEE Transactions on Software Engineering (TSE) 2024 50 12 3435-3453 10.1109/TSE.2024.3492204

[70] Ahmed Bahaa and Aya El-Rahman Kamal and Hanan Fahmy and Amr S. Ghoneim DB-CBIL: A DistilBert-Based Transformer Hybrid Model Using CNN and BiLSTM for Software Vulnerability Detection IEEE Access 2024 12 64446-64460 10.1109/ACCESS.2024.3396410

[71] 2023. Using ChatGPT as a Static Application Security Testing Tool. https://arxiv.org/abs/2308.14434

[72] Claudio Curto and Daniela Giordano and Simone Palazzo and D Indelicato MultiVD: A Transformer-based Multitask Approach for Software Vulnerability Detection International Conference on Security and Cryptography (SECRYPT) 2024 416–423 SCITEPRESS

[73] Yue Ding and Qian Wu and Yinzhu Li and Dongdong Wang and Jiaxin Huang Leveraging Deep Learning Models for Cross-function Null Pointer Risks Detection International Conference On Artificial Intelligence Testing (AITest) 2023 107-113 IEEE 10.1109/AITest58265.2023.00025

[74] 2024. Generalization-Enhanced Code Vulnerability Detection via Multi-Task Instruction Fine-Tuning. https://arxiv.org/abs/2406.03718

[75] Michael Fu and Chakkrit Tantithamthavorn and Trung Le and Yuki Kume and Van Nguyen and Dinh Phung and John Grundy AIBugHunter: A Practical Tool for Predicting, Classifying and Repairing Software Vulnerabilities Empirical Software Engineering (EMSE) 2024 29 1 4

[76] Michael Fu and Chakkrit Tantithamthavorn LineVul: A Transformer-based Line-level Vulnerability Prediction International Conference on Mining Software Repositories (MSR) 2022 608–620 ACM 10.1145/3524842.3528452

[77] 2024. Unintentional Security Flaws in Code: Automated Defense via Root Cause Analysis. https://arxiv.org/abs/2409.00199

[78] Triet Huynh Minh Le and M. Ali Babar and Tung Hoang Thai Software Vulnerability Prediction in Low-Resource Languages: An Empirical Study of CodeBERT and ChatGPT International Conference on Evaluation and Assessment in Software Engineering (EASE) 2024 679–685 ACM 10.1145/3661167.3661281

[79] Haonan Li and Yu Hao and Yizhuo Zhai and Zhiyun Qian Enhancing Static Analysis for Practical Bug Detection: An LLM-Integrated Approach Proceedings of the ACM on Programming Languages (PACMPL) 2024 8 OOPSLA1 10.1145/3649828

[80] 2024. VulDetectBench: Evaluating the Deep Capability of Vulnerability Detection with Large Language Models. https://arxiv.org/abs/2406.07595

[81] 2024. Automated Software Vulnerability Static Code Analysis Using Generative Pre-Trained Transformer Models. https://arxiv.org/abs/2408.00197

[82] 2024. A Preliminary Study on Using Large Language Models in Software Pentesting. https://arxiv.org/abs/2401.17459

[83] Francesco Sovrano and Adam Bauer and Alberto Bacchelli Large Language Models for In-File Vulnerability Localization Can Be ""Lost in the End"" Proceedings of the ACM on Software Engineering (PACMSE) 2025 2 FSE 10.1145/3715758

[84] Benjamin Steenhoek and Kalpathy Sivaraman and Renata Saldivar Gonzalez and Yevhen Mohylevskyy and Roshanak Zilouchian Moghaddam and Wei Le Closing the Gap: A User Study on the Real-world Usefulness of AI-powered Vulnerability Detection & Repair in the IDE International Conference on Software Engineering (ICSE) 2025 1-13 IEEE/ACM 10.1109/ICSE55347.2025.00126

[85] 2025. To Err is Machine: Vulnerability Detection Challenges LLM Reasoning. https://arxiv.org/abs/2403.17218

[86] Karl Tamberg and Hayretdin Bahsi Harnessing Large Language Models for Software Vulnerability Detection: A Comprehensive Benchmarking Study IEEE Access 2025 13 29698-29717 10.1109/ACCESS.2025.3541146

[87] 2024. Beyond ChatGPT: Enhancing Software Quality Assurance Tasks with Diverse LLMs and Validation Techniques. https://arxiv.org/abs/2409.01001

[88] Xin Yin and Chao Ni and Shaohua Wang Multitask-Based Evaluation of Open-Source LLM on Software Vulnerability IEEE Transactions on Software Engineering (TSE) 2024 50 11 3071-3087 10.1109/TSE.2024.3470333

[89] 2025. An Insight into Security Code Review with LLMs: Capabilities, Obstacles, and Influential Factors. https://arxiv.org/abs/2401.16310

[90] 2025. SecVulEval: Benchmarking LLMs for Real-World C/C++ Vulnerability Detection. https://arxiv.org/abs/2505.19828

[91] 2025. FuncVul: An Effective Function Level Vulnerability Detection Model using LLM and Code Chunk. https://arxiv.org/abs/2506.19453

[92] Tao Peng and Shixu Chen and Fei Zhu and Junwei Tang and Junping Liu and Xinrong Hu PTLVD:Program Slicing and Transformer-based Line-level Vulnerability Detection System International Working Conference on Source Code Analysis and Manipulation (SCAM) 2023 162-173 IEEE 10.1109/SCAM59687.2023.00026

[93] 2025. Boosting Vulnerability Detection of LLMs via Curriculum Preference Optimization with Synthetic Reasoning Data. https://arxiv.org/abs/2506.07390

[94] 2025. Improving Vulnerability Type Prediction and Line-Level Detection via Adversarial Training-based Data Augmentation and Multi-Task Learning. https://arxiv.org/abs/2506.23534

[95] Michael Fu and Chakkrit Kla Tantithamthavorn and Van Nguyen and Trung Le ChatGPT for Vulnerability Detection, Classification, and Repair: How Far Are We? Asia-Pacific Software Engineering Conference (APSEC) 2023 632-636 IEEE 10.1109/APSEC60848.2023.00085

[96] 2025. Streamlining Security Vulnerability Triage with Large Language Models. https://arxiv.org/abs/2501.18908

[97] 2025. VADER: A Human-Evaluated Benchmark for Vulnerability Assessment, Detection, Explanation, and Remediation. https://arxiv.org/abs/2505.19395

[98] Adiba Mahmud and Yasmeen Rawajfih and Fan Wu An Ensemble Transformer Approach with Cross-Attention for Automated Code Security Vulnerability Detection and Documentation International Symposium on Digital Forensics and Security (ISDFS) 2025 1-6 IEEE 10.1109/ISDFS65363.2025.11012039

[99] 2025. Let the Trial Begin: A Mock-Court Approach to Vulnerability Detection using LLM-Based Agents. https://arxiv.org/abs/2505.10961

[100] 2025. Vul-RAG: Enhancing LLM-based Vulnerability Detection via Knowledge-level RAG. https://arxiv.org/abs/2406.11147

[101] Tiago Espinha Gasiba and Andrei-Cristian Iosif and Ibrahim Kessba and Sathwik Amburi and Ulrike Lechner and Maria Pinto-Albuquerque May the Source Be with You: On ChatGPT, Cybersecurity, and Secure Coding Information 2024 15 9 572 10.3390/info15090572

[102] Onyeka Ezenwoye and Eduard Pinconschi and Earl Roberts Exploring AI for Vulnerability Detection and Repair Cyber Awareness and Research Symposium (CARS) 2024 1-9 IEEE 10.1109/CARS61786.2024.10778769

[103] 2024. Enhancing Source Code Security with LLMs: Demystifying The Challenges and Generating Reliable Repairs. https://arxiv.org/abs/2409.00571

[104] Arshiya Khan and Guannan Liu and Xing Gao Code Vulnerability Repair with Large Language Model Using Context-Aware Prompt Tuning Security and Privacy Workshops (SPW) 2025 283-287 IEEE 10.1109/SPW67851.2025.00040

[105] Vasileios Kouliaridis and Georgios Karopoulos and Georgios Kambourakis Assessing the Effectiveness of LLMs in Android Application Vulnerability Analysis International Conference on Attacks and Defenses for Internet-of-Things (ADIoT) 2024 139–154 Springer 10.1007/978-3-031-85593-1_9

[106] 2023. Can Large Language Models Find And Fix Vulnerable Software? https://arxiv.org/abs/2308.10345

[107] 2023. Exploring the Limits of ChatGPT in Software Security Applications. https://arxiv.org/abs/2312.05275

[108] 2024. Security Vulnerability Detection with Multitask Self-Instructed Fine-Tuning of Large Language Models. https://arxiv.org/abs/2406.05892

[109] Daniele Cipollone and Changjie Wang and Mariano Scazzariello and Simone Ferlin and Maliheh Izadi and Dejan Kostić and Marco Chiesa Automating the Detection of Code Vulnerabilities by Analyzing GitHub Issues International Workshop on Large Language Models for Code (LLM4Code) 2025 41-48 IEEE/ACM 10.1109/LLM4Code66737.2025.00010

[110] Rasmus Ingemann Tuffveson Jensen and Vali Tawosi and Salwa Alamir Software Vulnerability and Functionality Assessment using Large Language Models International Workshop on NL-Based Software Engineering (NLBSE) 2024 25–28 ACM/IEEE 10.1145/3643787.3648036

[111] Chao Ni and Xin Yin and Kaiwen Yang and Dehai Zhao and Zhenchang Xing and Xin Xia Distinguishing Look-Alike Innocent and Vulnerable Code by Subtle Semantic Representation Learning and Explanation Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) 2023 1611–1622 ACM 10.1145/3611643.3616358

[112] 2025. LLM4Vuln: A Unified Evaluation Framework for Decoupling and Enhancing LLMs' Vulnerability Reasoning. https://arxiv.org/abs/2401.16185

[113] Yanjing Yang and Xin Zhou and Runfeng Mao and Jinwei Xu and Lanxin Yang and Yu Zhang and Haifeng Shen and He Zhang DLAP: A Deep Learning Augmented Large Language Model Prompting Framework for Software Vulnerability Detection Journal of Systems and Software (JSS) 2025 219 112234 10.1016/j.jss.2024.112234

[114] 2025. Benchmarking LLMs and LLM-based Agents in Practical Vulnerability Detection for Code Repositories. https://arxiv.org/abs/2503.03586

[115] 2025. Reasoning with LLMs for Zero-Shot Vulnerability Detection. https://arxiv.org/abs/2503.17885

[116] 2025. Everything You Wanted to Know About LLM-based Vulnerability Detection But Were Afraid to Ask. https://arxiv.org/abs/2504.13474

[117] 2025. SAVANT: Vulnerability Detection in Application Dependencies through Semantic-Guided Reachability Analysis. https://arxiv.org/abs/2506.17798

[118] 2025. R2Vul: Learning to Reason about Software Vulnerabilities with Reinforcement Learning and Structured Reasoning Distillation. https://arxiv.org/abs/2504.04699

[119] WU Ahmad and S Chakraborty and B Ray and KW Chang Unified Pre-training for Program Understanding and Generation Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL HLT) 2021 2655–2668 ACL 10.18653/v1/2021.naacl-main.211

[120] 2024. Vulnerability Detection in Popular Programming Languages with Language Models. https://arxiv.org/abs/2412.15905

[121] 2020. Exploring Software Naturalness through Neural Language Models. https://arxiv.org/abs/2006.12641

[122] 2023. Transformer-based Vulnerability Detection in Code at EditTime: Zero-shot, Few-shot, or Fine-tuning? https://arxiv.org/abs/2306.01754

[123] Yujia Chen and Cuiyun Gao and Zezhou Yang and Hongyu Zhang and Qing Liao Bridge and Hint: Extending Pre-trained Language Models for Long-Range Code International Symposium on Software Testing and Analysis (ISSTA) 2024 274–286 ACM 10.1145/3650212.3652127

[124] Yizheng Chen and Zhoujie Ding and Lamya Alowain and Xinyun Chen and David Wagner DiverseVul: A New Vulnerable Source Code Dataset for Deep Learning Based Vulnerability Detection International Symposium on Research in Attacks, Intrusions and Defenses (RAID) 2023 654–668 IEEE 10.1145/3607199.3607242

[125] Claudio Curto and Daniela Giordano and Daniel Gustav Indelicato and Vladimiro Patatu Can a Llama Be a Watchdog? Exploring Llama 3 and Code Llama for Static Application Security Testing International Conference on Cyber Security and Resilience (CSR) 2024 395-400 IEEE 10.1109/CSR61664.2024.10679444

[126] Giordano d'Aloisio and Luca Traini and Federica Sarro and Antinisca Di Marco On the Compression of Language Models for Code: An Empirical Study on CodeBERT International Conference on Software Analysis, Evolution and Reengineering (SANER) 2025 12-23 IEEE 10.1109/SANER64311.2025.00010

[127] Xiao Deng and Fuyao Duan and Rui Xie and Wei Ye and Shikun Zhang Improving Long-Tail Vulnerability Detection Through Data Augmentation Based on Large Language Models International Conference on Software Maintenance and Evolution (ICSME) 2024 262-274 IEEE 10.1109/ICSME58944.2024.00033

[128] Yangruibo Ding and Yanjun Fu and Omniyyah Ibrahim and Chawin Sitawarin and Xinyun Chen and Basel Alomair and David Wagner and Baishakhi Ray and Yizheng Chen Vulnerability Detection with Code Language Models: How Far are We? International Conference on Software Engineering (ICSE) 2025 1729-1741 IEEE/ACM 10.1109/ICSE55347.2025.00038

[129] Qianjin Du and Shiji Zhou and Xiaohui Kuang and Gang Zhao and Jidong Zhai Joint Geometrical and Statistical Domain Adaptation for Cross-domain Code Vulnerability Detection Conference on Empirical Methods in Natural Language Processing (EMNLP) 2023 12791–12800 ACL

[130] Melanie Ehrenberg and Shahram Sarkani and Thomas A Mazzuchi Python Source Code Vulnerability Detection with Named Entity Recognition Computers & Security (COSE) 2024 140 103802 10.1016/j.cose.2024.103802

[131] Mohamed Amine Ferrag and Ammar Battah and Norbert Tihanyi and Ridhi Jain and Diana Maimuţ and Fatima Alwahedi and Thierry Lestable and Narinderjit Singh Thandi and Abdechakour Mechri and Merouane Debbah and Lucas C. Cordeiro SecureFalcon: Are We There Yet in Automated Software Vulnerability Detection With LLMs? Transactions on Software Engineering (TSE) 2025 51 4 1248-1265 10.1109/TSE.2025.3548168

[132] Michael Fu and Van Nguyen and Chakkrit Kla Tantithamthavorn and Trung Le and Dinh Phung VulExplainer: A Transformer-Based Hierarchical Distillation for Explaining Vulnerability Types IEEE Transactions on Software Engineering (TSE) 2023 49 10 4550–4565

[133] Shuzheng Gao and Hongyu Zhang and Cuiyun Gao and Chaozheng Wang Keeping Pace with Ever-Increasing Data: Towards Continual Learning of Code Intelligence Models International Conference on Software Engineering (ICSE) 2023 30-42 IEEE/ACM 10.1109/ICSE48619.2023.00015

[134] José Gonçalves and Miguel Silva and Bernardo Cabral and Tiago Dias and Eva Maia and Isabel Praça and Ricardo Severino and Luís Lino Ferreira Evaluating LLaMA 3.2 for Software Vulnerability Detection European Interdisciplinary Cybersecurity Conference (EICC) 2025 38–51 Springer

[135] Anastasiia Grishina and Max Hort and Leon Moonen The EarlyBIRD Catches the Bug: On Exploiting Early Layers of Encoder Models for More Efficient Code Classification Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) 2023 895–907 ACM 10.1145/3611643.3616304

[136] GS Prabith and Rohit Narayanan and A Arya and PK Binu and others BiT5: A Bidirectional NLP Approach for Advanced Vulnerability Detection in Codebase Procedia Computer Science 2024 233 812–821

[137] Shantanu Sudhir Gujar DetectBERT: Code Vulnerability Detection Global Conference on Communications and Information Technologies (GCCIT) 2024 1-21 IEEE 10.1109/GCCIT63234.2024.10862235

[138] Yuejun Guo and Constantinos Patsakis and Qiang Hu and Qiang Tang and Fran Casino Outside the Comfort Zone: Analysing LLM Capabilities in Software Vulnerability Detection European Symposium on Research in Computer Security (ESORICS) 2024 271–289 Springer 10.1007/978-3-031-70879-4_14

[139] Hazim Hanif and Sergio Maffeis VulBERTa: Simplified Source Code Pre-Training for Vulnerability Detection International Joint Conference on Neural Networks (IJCNN) 2022 1-8 IEEE 10.1109/IJCNN55064.2022.9892280

[140] Rida Ghafoor Hussain and Kin-Choong Yow and Marco Gori Leveraging an Enhanced CodeBERT-Based Model for Multiclass Software Defect Prediction via Defect Classification IEEE Access 2025 13 24383-24397 10.1109/ACCESS.2024.3525069

[141] Zhonghao Jiang and Weifeng Sun and Xiaoyan Gu and Jiaxin Wu and Tao Wen and Haibo Hu and Meng Yan DFEPT: Data Flow Embedding for Enhancing Pre-Trained Model Based Vulnerability Detection Asia-Pacific Symposium on Internetware (Internetware) 2024 95–104 ACM 10.1145/3671016.3671388

[142] 2025. Investigating Large Language Models for Code Vulnerability Detection: An Experimental Study. https://arxiv.org/abs/2412.18260

[143] Yuan Jiang and Yujian Zhang and Xiaohong Su and Christoph Treude and Tiantian Wang StagedVulBERT: Multigranular Vulnerability Detection With a Novel Pretrained Code Model IEEE Transactions on Software Engineering (TSE) 2024 50 12 3454-3471 10.1109/TSE.2024.3493245

[144] Chen Ji and Su Yang and Hongyu Sun and Yuqing Zhang Applying Contrastive Learning to Code Vulnerability Type Classification Conference on Empirical Methods in Natural Language Processing (EMNLP) 2024 11942–11952 ACL

[145] Ilias Kalouptsoglou and Miltiadis Siavvas and Apostolos Ampatzoglou and Dionysios Kehagias and Alexander Chatzigeorgiou Vulnerability Classification on Source Code Using Text Mining and Deep Learning Techniques International Conference on Software Quality, Reliability, and Security Companion (QRS-C) 2024 47-56 IEEE 10.1109/QRS-C63300.2024.00017

[146] Ilias Kalouptsoglou and Miltiadis Siavvas and Apostolos Ampatzoglou and Dionysios Kehagias and Alexander Chatzigeorgiou Vulnerability Prediction using Pre-trained Models: An Empirical Evaluation International Conference on Modeling, Analysis and Simulation of Computer and Telecommunication Systems (MASCOTS) 2024 1-6 IEEE 10.1109/MASCOTS64422.2024.10786510

[147] Zihan Kong and Yong Piao and Tianran Li A Source Code Vulnerability Detection Method Based on Positive-Unlabeled Learning International Conference on Robotics, Intelligent Control and Artificial Intelligence (RICAI) 2024 551-556 IEEE 10.1109/RICAI64321.2024.10911761

[148] Thi-Thu-Huong Le and Andro Aprila Adiputra and YeonJeong Hwang and JunYoung Son and Howon Kim Fine-Tuning Transformer LLMs for Detecting SQL Injection and XSS Vulnerabilities International Conference on Artificial Intelligence in Information and Communication (ICAIIC) 2025 0946-0951 IEEE 10.1109/ICAIIC64266.2025.10920868

[149] 2025. CleanVul: Automatic Function-Level Vulnerability Detection in Code Commits Using LLM Heuristics. https://arxiv.org/abs/2411.17274

[150] Guanjun Lin and Heming Jia and Di Wu Distilled and Contextualized Neural Models Benchmarked for Vulnerable Function Detection Mathematics 2022 10 23 4482 10.3390/math10234482

[151] Jiayuan Li and Lei Cui and Jie Zhang and Haiqiang Fei and Yu Chen and Hongsong Zhu Steering Large Language Models for Vulnerability Detection International Conference on Acoustics, Speech and Signal Processing (ICASSP) 2025 1-5 IEEE 10.1109/ICASSP49660.2025.10887736

[152] Zhongxin Liu and Zhijie Tang and Junwei Zhang and Xin Xia and Xiaohu Yang Pre-training by Predicting Program Dependencies for Vulnerability Analysis Tasks International Conference on Software Engineering (ICSE) 2024 1863-1875 IEEE/ACM 10.1145/3597503.3639142

[153] Guilong Lu and Xiaolin Ju and Xiang Chen and Shaoyu Yang and Liang Chen and Hao Shen Assessing the Effectiveness of Vulnerability Detection via Prompt Tuning: An Empirical Study Asia-Pacific Software Engineering Conference (APSEC) 2023 415-424 IEEE 10.1109/APSEC60848.2023.00052

[154] Yu Luo and Weifeng Xu and Dianxiang Xu Detecting Integer Overflow Errors in Java Source Code via Machine Learning International Conference on Tools with Artificial Intelligence (ICTAI) 2021 724-728 IEEE 10.1109/ICTAI52525.2021.00115

[155] 2025. HALURust: Exploiting Hallucinations of Large Language Models to Detect Vulnerabilities in Rust. https://arxiv.org/abs/2503.10793

[156] Cláudia Mamede and Eduard Pinconschi and Rui Abreu and José Campos Exploring Transformers for Multi-Label Classification of Java Vulnerabilities International Conference on Software Quality, Reliability and Security (QRS) 2022 43-52 IEEE 10.1109/QRS57517.2022.00015

[157] 2024. Enhancing Reverse Engineering: Investigating and Benchmarking Large Language Models for Vulnerability Analysis in Decompiled Binaries. https://arxiv.org/abs/2411.04981

[158] Abdechakour Mechri and Mohamed Amine Ferrag and Merouane Debbah SecureQwen: Leveraging LLMs for Vulnerability Detection in Python Codebases Computers & Security (COSE) 2025 148 104151 10.1016/j.cose.2024.104151

[159] Huan Mei and Guanjun Lin and Da Fang and Jun Zhang Detecting Vulnerabilities in IoT Software: New Hybrid Model and Comprehensive Data Analysis Journal of Information Security and Applications (JISA) 2023 74 103467 10.1016/j.jisa.2023.103467

[160] 2024. SAFE: Advancing Large Language Models in Leveraging Semantic and Syntactic Relationships for Software Vulnerability Detection. https://arxiv.org/abs/2409.00882

[161] Cong Pan and Minyan Lu and Biao Xu An Empirical Study on Software Defect Prediction Using CodeBERT Model Applied Sciences 2021 11 11 4793

[162] 2024. Enhancing Pre-Trained Language Models for Vulnerability Detection via Semantic-Preserving Data Augmentation. https://arxiv.org/abs/2410.00249

[163] Md Mahbubur Rahman and Ira Ceka and Chengzhi Mao and Saikat Chakraborty and Baishakhi Ray and Wei Le Towards Causal Deep Learning for Vulnerability Detection International Conference on Software Engineering (ICSE) 2024 IEEE/ACM 10.1145/3597503.3639170

[164] Shahriyar Zaman Ridoy and Md. Shazzad Hossain Shaon and Alfredo Cuzzocrea and Mst Shapna Akter EnStack: An Ensemble Stacking Framework of Large Language Models for Enhanced Vulnerability Detection in Source Code International Conference on Big Data (BigData) 2024 6356-6364 IEEE 10.1109/BigData62323.2024.10825609

[165] Niklas Risse and Marcel B\"öhme Uncovering the Limits of Machine Learning for Automatic Vulnerability Detection USENIX Security Symposium (USENIX Security) 2024 4247–4264 USENIX

[166] Barbara Russo and Jorge Melegati and Moritz Mock Leveraging Multi-Task Learning to Improve the Detection of SATD and Vulnerability International Conference on Program Comprehension (ICPC) 2025 1-12 IEEE/ACM 10.1109/ICPC66645.2025.00017

[167] Rijha Safdar and M. Umer Ashfaq and Danyail Mateen Deep Learning-Based Framework for Automated Vulnerability Detection in Android Applications International Bhurban Conference on Applied Sciences and Technology (IBCAST) 2023 1-5 IEEE 10.1109/IBCAST59916.2023.10713017

[168] Aleksei Shestov and Rodion Levichev and Ravil Mussabayev and Evgeny Maslov and Pavel Zadorozhny and Anton Cheshkov and Rustam Mussabayev and Alymzhan Toleu and Gulmira Tolegen and Alexander Krassovitskiy Finetuning Large Language Models for Vulnerability Detection IEEE Access 2025 13 38889-38900 10.1109/ACCESS.2025.3546700

[169] Samiha Shimmi and Ashiqur Rahman and Mohan Gadde and Hamed Okhravi and Mona Rahimi VulSim: Leveraging Similarity of Multi-Dimensional Neighbor Embeddings for Vulnerability Detection USENIX Security Symposium (USENIX Security) 2024 1777–1794 USENIX

[170] Kanchan Singh and Sakshi S Grover and Ranjini Kishen Kumar Cyber Security Vulnerability Detection Using Natural Language Processing World AI IoT Congress (AIIoT) 2022 174-178 IEEE 10.1109/AIIoT54504.2022.9817336

[171] 2023. Do Language Models Learn Semantics of Code? A Case Study in Vulnerability Detection. https://arxiv.org/abs/2311.04109

[172] 2024. Code Vulnerability Detection: A Comparative Analysis of Emerging Large Language Models. https://arxiv.org/abs/2409.10490

[173] 2024. Enhanced LLM-Based Framework for Predicting Null Pointer Dereference in Source Code. https://arxiv.org/abs/2412.00216

[174] Jingyi Su and Yan Wu Optimizing Pre-trained Language Models for Efficient Vulnerability Detection in Code Snippets International Conference on Computer and Communications (ICCC) 2023 2139-2143 IEEE 10.1109/ICCC59590.2023.10507456

[175] Zonghang Tian and Shuting Lou and Yingying Zhang and Zhengdan Jiang and Xingkai Cheng SQL Injection Vulnerability Detection Based on Pissa-Tuned Llama 3 Large Language Model International Conference on Frontier Technologies of Information and Computer (ICFTIC) 2024 255-259 IEEE 10.1109/ICFTIC64248.2024.10912886

[176] Md Nasir Uddin and Bixin Li and Zafar Ali and Pavlos Kefalas and Inayat Khan and Islam Zada Software Defect Prediction Employing BiLSTM and BERT-based Semantic Feature Soft Computing 2022 26 16 7877–7891

[177] 2025. ANVIL: Anomaly-based Vulnerability Identification without Labelled Training Data. https://arxiv.org/abs/2408.16028

[178] 2024. Line-level Semantic Structure Learning for Code Vulnerability Detection. https://arxiv.org/abs/2407.18877

[179] 2024. M2CVD: Enhancing Vulnerability Semantic through Multi-Model Collaboration for Code Vulnerability Detection. https://arxiv.org/abs/2406.05940

[180] Xuanye Wang and Lu Lu and Zhanyu Yang and Qingyan Tian and Haisha Lin Parameter-efficient Multi-classification Software Defect Detection Method based on Pre-trained LLMs International Journal of Computational Intelligence Systems (IJCIS) 2024 17 1 152 10.1007/s44196-024-00551-3

[181] Chaozheng Wang and Yuanhang Yang and Cuiyun Gao and Yun Peng and Hongyu Zhang and Michael R. Lyu Prompt Tuning in Code Intelligence: An Experimental Evaluation IEEE Transactions on Software Engineering (TSE) 2023 49 11 4869-4885 10.1109/TSE.2023.3313881

[182] 2024. VulEval: Towards Repository-Level Evaluation of Software Vulnerability Detection. https://arxiv.org/abs/2404.15596

[183] Zhe Xiong and Weiyu Dong VulD-CodeBERT: CodeBERT-Based Vulnerability Detection Model for C/C++ Code International Conference on Communications, Information System and Computer Engineering (CISCE) 2024 914-919 IEEE 10.1109/CISCE62493.2024.10653337

[184] Wenlin Xu and Tong Li and Jinsong Wang and Haibo Duan and Yahui Tang Software Vulnerabilities Detection Based on a Pre-trained Language Model International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) 2023 904-911 IEEE 10.1109/TrustCom60117.2023.00129

[185] Xue Yuan and Guanjun Lin and Yonghang Tai and Jun Zhang Deep Neural Embedding for Software Vulnerability Discovery: Comparison and Optimization Security and Communication Networks 2022 2022 1 5203217 10.1155/2022/5203217

[186] 2024. Your Instructions Are Not Always Helpful: Assessing the Efficacy of Instruction Fine-tuning for Software Vulnerability Detection. https://arxiv.org/abs/2401.07466

[187] Peng Zeng and Guanjun Lin and Jun Zhang and Ying Zhang Intelligent Detection of Vulnerable Functions in Software through Neural Embedding-based Code Analysis International Journal of Network Management (IJNM) 2023 33 3 e2198 10.1002/nem.2198

[188] 2025. Benchmarking Large Language Models for Multi-Language Software Vulnerability Detection. https://arxiv.org/abs/2503.01449

[189] 2024. MVD: A Multi-Lingual Software Vulnerability Detection Framework. https://arxiv.org/abs/2412.06166

[190] Kunpeng Zhao and Shuya Duan and Ge Qiu and Jinyuan Zhai and Mingze Li and Long Liu Python Source Code Vulnerability Detection Based on CodeBERT Language Model International Conference on Algorithms, Computing and Artificial Intelligence (ACAI) 2024 1-6 IEEE 10.1109/ACAI63924.2024.10899694

[191] 2024. Comparison of Static Application Security Testing Tools and Large Language Models for Repo-level Vulnerability Detection. https://arxiv.org/abs/2407.16235

[192] Xin Zhou and Ting Zhang and David Lo Large Language Model for Vulnerability Detection: Emerging Results and Future Directions International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER) 2024 47–51 ACM/IEEE 10.1145/3639476.3639762

[193] Jin Zhu and Hui Ge and Yun Zhou and Xiao Jin and Rui Luo and Yanchen Sun Detecting Source Code Vulnerabilities Using Fine-Tuned Pre-Trained LLMs International Conference on Signal Processing (ICSP) 2024 238-242 IEEE 10.1109/ICSP62129.2024.10846595

[194] Noah Ziems and Shaoen Wu Security Vulnerability Detection Using Deep Learning Natural Language Processing Conference on Computer Communications Workshops (INFOCOM WKSHPS) 2021 1-6 IEEE 10.1109/INFOCOMWKSHPS51825.2021.9484500

[195] Amal Akli and Maxime Cordy and Mike Papadakis and Yves Le Traon AutoAdapt: On the Application of AutoML for Parameter-Efficient Fine-Tuning of Pre-Trained Code Models ACM Transactions on Software Engineering and Methodology (TOSEM) 2025 Just Accepted Just Accepted 10.1145/3734867

[196] 2025. Case Study: Fine-tuning Small Language Models for Accurate and Private CWE Detection in Python Code. https://arxiv.org/abs/2504.16584

[197] David Hin and Andrey Kan and Huaming Chen and M. Ali Babar LineVD: Statement-level Vulnerability Detection using Graph Neural Networks International Conference on Mining Software Repositories (MSR) 2022 596–607 ACM 10.1145/3524842.3527949

[198] Luis Ibanez-Lissen and Lorena Gonzalez-Manzano and Jose Maria de Fuentes and Nicolas Anciaux LPASS: Linear Probes as Stepping Stones for Vulnerability Detection using Compressed LLMs Journal of Information Security and Applications (JISA) 2025 93 104125 10.1016/j.jisa.2025.104125

[199] Emran Kaanan and Tasmin Karim and Md. Shazzad Hossain Shaon and Md. Fahim Sultan and Alfredo Cuzzocrea and Mst Shapna Akter LLM-Based Approach for Buffer Overflow Detection in Source Code International Conference on Computer and Information Technology (ICCIT) 2024 1898-1902 IEEE 10.1109/ICCIT64611.2024.11021816

[200] 2025. Are Sparse Autoencoders Useful for Java Function Bug Detection? https://arxiv.org/abs/2505.10375

[201] Xin-Cheng Wen and Xinchen Wang and Cuiyun Gao and Shaohua Wang and Yang Liu and Zhaoquan Gu When Less is Enough: Positive and Unlabeled Learning Model for Vulnerability Detection International Conference on Automated Software Engineering (ASE) 2023 345-357 IEEE/ACM 10.1109/ASE56229.2023.00144

[202] 2025. Learning to Focus: Context Extraction for Efficient Code Vulnerability Detection with Language Models. https://arxiv.org/abs/2505.17460

[203] 2025. Smart Cuts: Enhance Active Learning for Vulnerability Detection by Pruning Bad Seeds. https://arxiv.org/abs/2506.20444

[204] Annibale Panichella Metamorphic-Based Many-Objective Distillation of LLMs for Code-Related Tasks International Conference on Software Engineering (ICSE) 2025 1001-1013 IEEE/ACM 10.1109/ICSE55347.2025.00230

[205] Jieke Shi and Zhou Yang and Hong Jin Kang and Bowen Xu and Junda He and David Lo Greening Large Language Models of Code International Conference on Software Engineering: Software Engineering in Society (ICSE-SEIS) 2024 142–153 ACM 10.1145/3639475.3640097

[206] Ye JianJie and Wei Le Code Defect Detection Method Based on BERT and Ensemble International Conference on Computer and Communications (ICCC) 2023 2130-2138 IEEE 10.1109/ICCC59590.2023.10507306

[207] Sadia Sahar and Muhammad Younas and Muhammad Murad Khan and Muhammad Umer Sarwar DP-CCL: A Supervised Contrastive Learning Approach Using CodeBERT Model in Software Defect Prediction IEEE Access 2024 12 22582-22594 10.1109/ACCESS.2024.3362896

[208] Guilong Lu and Xiaolin Ju and Xiang Chen and Wenlong Pei and Zhilong Cai GRACE: Empowering LLM-based Software Vulnerability Detection with Graph Structure and In-Context Learning Journal of Systems and Software (JSS) 2024 212 112031

[209] Xin-Cheng Wen and Cuiyun Gao and Shuzheng Gao and Yang Xiao and Michael R. Lyu SCALE: Constructing Structured Natural Language Comment Trees for Software Vulnerability Detection International Symposium on Software Testing and Analysis (ISSTA) 2024 235–247 ACM 10.1145/3650212.3652124

[210] Rongcun Wang and Senlei Xu and Yuan Tian and Xingyu Ji and Xiaobing Sun and Shujuang Jiang SCL-CVD: Supervised Contrastive Learning for Code Vulnerability Detection via GraphCodeBERT Computers & Security (COSE) 2024 145 103994 10.1016/j.cose.2024.103994

[211] Shiying Xue and Lin Li and Tao Li and Haodong Chen and Jiapan Li and Yangqing Qin AIDetectVul: Software Vulnerability Detection Method Based on Feature Fusion of Pre-trained Models International Conference on Consumer Electronics and Computer Engineering (ICCECE) 2025 258-263 IEEE 10.1109/ICCECE65250.2025.10985370

[212] Junwei Zhang and Zhongxin Liu and Xing Hu and Xin Xia and Shanping Li Vulnerability Detection by Learning From Syntax-Based Execution Paths of Code IEEE Transactions on Software Engineering (TSE) 2023 49 8 4196-4212 10.1109/TSE.2023.3286586

[213] Zhequ Sun and Ke Liu and Yu Yang Enhancing Source Code Vulnerability Detection Using Flattened Code Graph Structures International Conference on Frontier Technologies of Information and Computer (ICFTIC) 2024 209-213 IEEE 10.1109/ICFTIC64248.2024.10913325

[214] Weiye Yu and Guang Kou and Qihe Liu and Haoyu Zhang and Qiang Wang PATVD: Vulnerability Detection Based on Pre-training Techniques and Adversarial Training Smartworld, Ubiquitous Intelligence & Computing, Scalable Computing & Communications, Digital Twin, Privacy Computing, Metaverse, Autonomous & Trusted Vehicles (SmartWorld/UIC/ScalCom/DigitalTwin/PriComp/Meta) 2022 1774-1781 IEEE 10.1109/SmartWorld-UIC-ATC-ScalCom-DigitalTwin-PriComp-Metaverse56740.2022.00253

[215] Zhihong Liu and Zezhou Yang and Qing Liao Exploration On Prompting LLM With Code-Specific Information For Vulnerability Detection International Conference on Software Services Engineering (SSE) 2024 273-281 IEEE 10.1109/SSE62657.2024.00049

[216] Ruitong Liu and Yanbin Wang and Haitao Xu and Jianguo Sun and Fan Zhang and Peiyue Li and Zhenhao Guo Vul-LMGNNs: Fusing Language Models and Online-distilled Graph Neural Networks for Code Vulnerability Detection Information Fusion 2025 115 102748 10.1016/j.inffus.2024.102748

[217] 2025. CGP-Tuning: Structure-Aware Soft Prompt Tuning for Code Vulnerability Detection. https://arxiv.org/abs/2501.04510

[218] 2025. Context-Enhanced Vulnerability Detection Based on Large Language Model. https://arxiv.org/abs/2504.16877

[219] Deekshith Sagar Rangapuram and Nalini Ratha GraphCodeBERT-Augmented Graph Attention Networks for Code Vulnerability Detection Conference on Artificial Intelligence (CAI) 2025 912-917 IEEE 10.1109/CAI64502.2025.00161

[220] 2023. DefectHunter: A Novel LLM-Driven Boosted-Conformer-based Code Vulnerability Detection Mechanism. https://arxiv.org/abs/2309.15324

[221] Nafis Tanveer Islam and Gonzalo De La Torre Parra and Dylan Manuel and Elias Bou-Harb and Peyman Najafirad An Unbiased Transformer Source Code Learning with Semantic Vulnerability Graph European Symposium on Security and Privacy (EuroS&P) 2023 144-159 IEEE 10.1109/EuroSP57164.2023.00018

[222] Weining Zheng and Xiaohong Su and Hongwei Wei and Wenxin Tao SVulDetector: Vulnerability Detection based on Similarity using Tree-based Attention and Weighted Graph Embedding Mechanisms Computers & Security (COSE) 2024 144 103930 10.1016/j.cose.2024.103930

[223] Jianing Liu and Guanjun Lin and Huan Mei and Fan Yang and Yonghang Tai Enhancing Vulnerability Detection Efficiency: An Exploration of Light-weight LLMs with Hybrid Code Features Journal of Information Security and Applications (JISA) 2025 88 103925 10.1016/j.jisa.2024.103925

[224] Yuting Zhang and Jiahao Zhu and Yixin Yang and Ming Wen and Hai Jin Comparing the Performance of Different Code Representations for Learning-based Vulnerability Detection Asia-Pacific Symposium on Internetware (Internetware) 2023 174–184 ACM 10.1145/3609437.3609464

[225] Chao Ni and Xinrong Guo and Yan Zhu and Xiaodan Xu and Xiaohu Yang Function-Level Vulnerability Detection Through Fusing Multi-Modal Knowledge International Conference on Automated Software Engineering (ASE) 2023 1911-1918 IEEE/ACM 10.1109/ASE56229.2023.00084

[226] Chenguang Zhu and Gewangzi Du and Tongshuai Wu and Ningning Cui and Liwei Chen and Gang Shi BERT-Based Vulnerability Type Identification with Effective Program Representation International Conference on Wireless Algorithms, Systems, and Applications (WASA) 2022 271–282 Springer 10.1007/978-3-031-19208-1_23

[227] Weichang Huang and Shuyuan Lin and Li Chen BBVD: A BERT-based Method for Vulnerability Detection International Journal of Advanced Computer Science and Applications (IJACSA) 2022 13 12 10.14569/IJACSA.2022.01312103

[228] Hao Sun and Yongji Liu and Zhenquan Ding and Yang Xiao and Zhiyu Hao and Hongsong Zhu An Enhanced Vulnerability Detection in Software Using a Heterogeneous Encoding Ensemble Symposium on Computers and Communications (ISCC) 2023 1214-1220 IEEE 10.1109/ISCC58397.2023.10217978

[229] Soolin Kim and Jusop Choi and Muhammad Ejaz Ahmed and Surya Nepal and Hyoungshick Kim VulDeBERT: A Vulnerability Detection System Using BERT International Symposium on Software Reliability Engineering Workshops (ISSREW) 2022 69-74 IEEE 10.1109/ISSREW55968.2022.00042

[230] Chandra Thapa and Seung Ick Jang and Muhammad Ejaz Ahmed and Seyit Camtepe and Josef Pieprzyk and Surya Nepal Transformer-Based Language Models for Software Vulnerability Detection Annual Computer Security Applications Conference (ACSAC) 2022 481–496 ACM 10.1145/3564625.3567985

[231] Marwan Omar VulDefend: A Novel Technique based on Pattern-exploiting Training for Detecting Software Vulnerabilities Using Language Models Jordan International Joint Conference on Electrical Engineering and Information Technology (JEEIT) 2023 287-293 IEEE 10.1109/JEEIT58638.2023.10185860

[232] Marwan Omar and Stavros Shiaeles VulDetect: A novel technique for detecting software vulnerabilities using Language Models International Conference on Cyber Security and Resilience (CSR) 2023 105-110 IEEE 10.1109/CSR57506.2023.10224924

[233] Remzi G\"ürfidan VULREM: Fine-Tuned BERT-Based Source-Code Potential Vulnerability Scanning System to Mitigate Attacks in Web Applications Applied Sciences 2024 14 21 9697 10.3390/app14219697

[234] Na Li and Haoyu Zhang and Zhihui Hu and Guang Kou and Huadong Dai Automated Software Vulnerability Detection via Pre-trained Context Encoder and Self Attention International Conference on Digital Forensics and Cyber Crime (ICDF2C) 2021 248–264 Springer

[235] Moumita Das Purba and Arpita Ghosh and Benjamin J. Radford and Bill Chu Software Vulnerability Detection using Large Language Models International Symposium on Software Reliability Engineering Workshops (ISSREW) 2023 112-119 IEEE 10.1109/ISSREW60843.2023.00058

[236] Vu Le Anh Quan and Chau Thuan Phat and Kiet Van Nguyen and Phan The Duy and Van-Hau Pham XGV-BERT: Leveraging Contextualized Language Model and Graph Neural Network for Efficient Software Vulnerability Detection The Journal of Supercomputing 2025 81 6 750 10.1007/s11227-025-07198-7

[237] Ying Zhao and Xin Guan Adversarial Training for Robustness Enhancement in LLM-Based Code Vulnerability Detection International Conference on Communications, Information System and Computer Engineering (CISCE) 2025 1147-1152 IEEE 10.1109/CISCE65916.2025.11065803

[238] Zhen Li and Deqing Zou and Shouhuai Xu and Xinyu Ou and Hai Jin and Sujuan Wang and Zhijun Deng and Yuyi Zhong VulDeePecker: A Deep Learning-Based System for Vulnerability Detection Network and Distributed Systems Security Symposium (NDSS) 2018 1-15 The Internet Society 10.14722/ndss.2018.23158

[239] Yangruibo Ding and Benjamin Steenhoek and Kexin Pei and Gail Kaiser and Wei Le and Baishakhi Ray TRACED: Execution-aware Pre-training for Source Code International Conference on Software Engineering (ICSE) 2024 IEEE/ACM 10.1145/3597503.3608140

[240] Daipeng Cao and W. Jun LLM-CloudSec: Large Language Model Empowered Automatic and Deep Vulnerability Analysis for Intelligent Clouds International Conference on Computer Communications Workshops (INFOCOM WKSHPS) 2024 1-6 IEEE 10.1109/INFOCOMWKSHPS61880.2024.10620804

[241] Ze Sheng and Fenghua Wu and Xiangwu Zuo and Chao Li and Yuxin Qiao and Hang Lei Research on the LLM-Driven Vulnerability Detection System Using LProtector International Conference on Data Science and Computer Application (ICDSCA) 2024 192-196 IEEE 10.1109/ICDSCA63855.2024.10859408

[242] Samiha Shimmi and Yash Saini and Mark Schaefer and Hamed Okhravi and Mona Rahimi Software Vulnerability Detection Using LLM: Does Additional Information Help? Annual Computer Security Applications Conference Workshops (ACSAC Workshops) 2024 216-223 IEEE 10.1109/ACSACW65225.2024.00031

[243] 2024. Boosting Cybersecurity Vulnerability Scanning based on LLM-supported Static Application Security Testing. https://arxiv.org/abs/2409.15735

[244] 2023. How Far Have We Gone in Vulnerability Detection Using Large Language Models. https://arxiv.org/abs/2311.12420

[245] Zhihong Liu and Qing Liao and Wenchao Gu and Cuiyun Gao Software Vulnerability Detection with GPT and In-Context Learning International Conference on Data Science in Cyberspace (DSC) 2023 229-236 IEEE 10.1109/DSC59305.2023.00041

[246] Larry Huynh and Yinghao Zhang and Djimon Jayasundera and Woojin Jeon and Hyoungshick Kim and Tingting Bi and Jin B. Hong Detecting Code Vulnerabilities using LLMs International Conference on Dependable Systems and Networks (DSN) 2025 401-414 IEEE/IFIP 10.1109/DSN64029.2025.00047

[247] Gergely Eberhardt and Ákos Milánkovich VulnGPT: Enhancing Source Code Vulnerability Detection Using AutoGPT and Adaptive Supervision Strategies International Conference on Distributed Computing in Smart Systems and the Internet of Things (DCOSS-IoT) 2024 450-454 IEEE 10.1109/DCOSS-IoT61029.2024.00072

[248] 2019. RoBERTa: A Robustly Optimized BERT Pretraining Approach. https://arxiv.org/abs/1907.11692

[249] 2020. DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lighter. https://arxiv.org/abs/1910.01108

[250] Alec Radford and Jeffrey Wu and Rewon Child and David Luan and Dario Amodei and Ilya Sutskever and others Language Models are Unsupervised Multitask Learners OpenAI Blog 2019 1 8 9

[251] Tom Brown and Benjamin Mann and Nick Ryder and Melanie Subbiah and Jared D Kaplan and Prafulla Dhariwal and Arvind Neelakantan and Pranav Shyam and Girish Sastry and Amanda Askell and others Language Models are Few-shot Learners Advances in Neural Information Processing Systems (NeurIPS) 2020 33 1877–1901 Curran Associates, Inc.

[252] 2024. GPT-4 Technical Report. https://arxiv.org/abs/2303.08774

[253] 2023. LLaMA: Open and Efficient Foundation Language Models. https://arxiv.org/abs/2302.13971

[254] 2023. Llama 2: Open Foundation and Fine-Tuned Chat Models. https://arxiv.org/abs/2307.09288

[255] 2024. The Llama 3 Herd of Models. https://arxiv.org/abs/2407.21783

[256] 2023. Qwen Technical Report. https://arxiv.org/abs/2309.16609

[257] 2024. Qwen2 Technical Report. https://arxiv.org/abs/2407.10671

[258] 2025. Qwen2.5 Technical Report. https://arxiv.org/abs/2412.15115

[259] 2024. Gemma: Open Models Based on Gemini Research and Technology. https://arxiv.org/abs/2403.08295

[260] 2024. Gemma 2: Improving Open Language Models at a Practical Size. https://arxiv.org/abs/2408.00118

[261] 2025. DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning. https://arxiv.org/abs/2501.12948

[262] 2024. DeepSeek-V2: A Strong, Economical, and Efficient Mixture-of-Experts Language Model. https://arxiv.org/abs/2405.04434

[263] 2023. Mistral 7B. https://arxiv.org/abs/2310.06825

[264] 2024. Mixtral of Experts. https://arxiv.org/abs/2401.04088

[265] Colin Raffel and Noam Shazeer and Adam Roberts and Katherine Lee and Sharan Narang and Michael Matena and Yanqi Zhou and Wei Li and Peter J Liu Exploring the Limits of Transfer Learning with a Unified Text-to-text Transformer Journal of Machine Learning Research (JMLR) 2020 21 140 1–67

[266] AI Anthropic The Claude 3 Model Family: Opus, Sonnet, Haiku Claude-3 Model Card 2024 1 1

[267] 2024. Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context. https://arxiv.org/abs/2403.05530

[268] Mojan Javaheripi and Sébastien Bubeck and Marah Abdin and Jyoti Aneja and Sebastien Bubeck and Caio César Teodoro Mendes and Weizhu Chen and Allie Del Giorno and Ronen Eldan and Sivakanth Gopi and others Phi-2: The Surprising Power of Small Language Models Microsoft Research Blog 2023 1 3 3

[269] 2024. Phi-3 Technical Report: A Highly Capable Language Model Locally on Your Phone. https://arxiv.org/abs/2404.14219

[270] 2020. CodeBERT: A Pre-Trained Model for Programming and Natural Languages. https://arxiv.org/abs/2002.08155

[271] 2021. GraphCodeBERT: Pre-training Code Representations with Data Flow. https://arxiv.org/abs/2009.08366

[272] 2023. StarCoder: may the source be with you! https://arxiv.org/abs/2305.06161

[273] 2024. StarCoder 2 and The Stack v2: The Next Generation. https://arxiv.org/abs/2402.19173

[274] 2022. UniXcoder: Unified Cross-Modal Pre-training for Code Representation. https://arxiv.org/abs/2203.03850

[275] 2021. Evaluating Large Language Models Trained on Code. https://arxiv.org/abs/2107.03374

[276] 2024. Code Llama: Open Foundation Models for Code. https://arxiv.org/abs/2308.12950

[277] 2024. Qwen2.5-Coder Technical Report. https://arxiv.org/abs/2409.12186

[278] 2024. CodeGemma: Open Code Models Based on Gemma. https://arxiv.org/abs/2406.11409

[279] 2024. DeepSeek-Coder: When the Large Language Model Meets Programming – The Rise of Code Intelligence. https://arxiv.org/abs/2401.14196

[280] 2024. DeepSeek-Coder-V2: Breaking the Barrier of Closed-Source Models in Code Intelligence. https://arxiv.org/abs/2406.11931

[281] 2021. CodeT5: Identifier-aware Unified Pre-trained Encoder-Decoder Models for Code Understanding and Generation. https://arxiv.org/abs/2109.00859

[282] 2023. CodeT5+: Open Code Large Language Models for Code Understanding and Generation. https://arxiv.org/abs/2305.07922

[283] Miltiadis Allamanis and Earl T. Barr and Premkumar Devanbu and Charles Sutton A Survey of Machine Learning for Big Code and Naturalness ACM Computing Surveys (CSUR) 2018 51 4 10.1145/3212695

[284] Guanjun Lin and Sheng Wen and Qing-Long Han and Jun Zhang and Yang Xiang Software Vulnerability Detection Using Deep Neural Networks: A Survey Proceedings of the IEEE 2020 108 10 1825-1848 10.1109/JPROC.2020.2993293

[285] Wei Chang and Chunyang Ye and Hui Zhou Fine-Tuning Pre-trained Model with Optimizable Prompt Learning for Code Vulnerability Detection International Symposium on Software Reliability Engineering (ISSRE) 2024 108-119 IEEE 10.1109/ISSRE62328.2024.00021

[286] 2023. Evaluation of ChatGPT Model for Vulnerability Detection. https://arxiv.org/abs/2304.07232

[287] 2024. Large Language Models for Secure Code Assessment: A Multi-Language Empirical Study. https://arxiv.org/abs/2408.06428

[288] M. Mehdi Kholoosi and M. Ali Babar and Roland Croft A Qualitative Study on Using ChatGPT for Software Security: Perception vs. Practicality International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA) 2024 107-117 IEEE 10.1109/TPS-ISA62245.2024.00022

[289] 2024. \showarticletitleEvaluating Large Language Models in Vulnerability Detection Under Variable Context Windows. In International Conference on Machine Learning and Applications (ICMLA). IEEE, Miami, FL, USA, 1131–1134. doi:\nolinkurl10.1109/ICMLA61862.2024.00173

[290] 2024. Learning-based Models for Vulnerability Detection: An Extensive Study. https://arxiv.org/abs/2408.07526

[291] 2023. \showarticletitleNew Tricks to Old Codes: Can AI Chatbots Replace Static Code Analysis Tools?. In European Interdisciplinary Cybersecurity Conference (EICC). ACM, Stavanger, Norway, 13–18. doi:\nolinkurl10.1145/3590777.3590780

[292] 2023. \showarticletitleEnhancing Code Security Through Open-source Large Language Models: A Comparative Study. In International Symposium on Foundations and Practice of Security (FPS). Springer, Bordeaux, France, 233–249. doi:\nolinkurl10.1007/978-3-031-57537-2_15

[293] 2024. \showarticletitleVulnerAI: GPT Based Web Application Vulnerability Detection. In International Conference on Artificial Intelligence, Metaverse and Cybersecurity (ICAMAC). IEEE, Dubai, UAE, 1–6. doi:\nolinkurl10.1109/ICAMAC62387.2024.10828788

[294] 2025. \showarticletitleManual Prompt Engineering is Not Dead: A Case Study on Large Language Models for Code Vulnerability Detection with DSPy. In International Conference on Data Science and Machine Learning Applications (CDMA). IEEE, Riyadh, Saudi Arabia, 168–173. doi:\nolinkurl10.1109/CDMA61895.2025.00034

[295] 2024. \showarticletitleEvaluating the Impact of Conventional Code Analysis Against Large Language Models in API Vulnerability Detection. In European Interdisciplinary Cybersecurity Conference (EICC). ACM, Xanthi, Greece, 57–64. doi:\nolinkurl10.1145/3655693.3655701

[296] 2025. Expert-in-the-Loop Systems with Cross-Domain and In-Domain Few-Shot Learning for Software Vulnerability Detection. https://arxiv.org/abs/2506.10104

[297] 2025. Large Language Models for Multilingual Vulnerability Detection: How Far Are We? https://arxiv.org/abs/2506.07503

[298] 2025. \showarticletitleBeyond Static Pattern Matching? Rethinking Automatic Cryptographic API Misuse Detection in the Era of LLMs. Proceedings of the ACM on Software Engineering (PACMSE) 2, ISSTA, Article ISSTA006 (2025), 24 pages. doi:\nolinkurl10.1145/3728875

[299] 2025. \showarticletitleCASTLE: Benchmarking Dataset for Static Code Analyzers and LLMs towards CWE Detection. In International Symposium on Theoretical Aspects of Software Engineering (TASE). Springer, Limassol, Cyprus, 253–272.

[300] Patrick Lewis and Ethan Perez and Aleksandra Piktus and Fabio Petroni and Vladimir Karpukhin and Naman Goyal and Heinrich Küttler and Mike Lewis and Wen-tau Yih and Tim Rocktäschel and others Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks Advances in Neural Information Processing Systems (NeurIPS) 2020 33 9459–9474 Curran Associates, Inc.

[301] 2024. LLbezpeky: Leveraging Large Language Models for Vulnerability Detection. https://arxiv.org/abs/2401.01269

[302] Jason Wei and Xuezhi Wang and Dale Schuurmans and Maarten Bosma and Fei Xia and Ed Chi and Quoc V Le and Denny Zhou and others Chain-of-Thought Prompting Elicits Reasoning in Large Language Models Advances in Neural Information Processing Systems (NeurIPS) 2022 35 24824–24837 Curran Associates, Inc.

[303] 2023. Self-Consistency Improves Chain of Thought Reasoning in Language Models. https://arxiv.org/abs/2203.11171

[304] Shunyu Yao and Jeffrey Zhao and Dian Yu and Nan Du and Izhak Shafran and Karthik Narasimhan and Yuan Cao ReAct: Synergizing Reasoning and Acting in Language Models International Conference on Learning Representations (ICLR) 2023 1-33 NSF PAR

[305] 2023. \showarticletitleAn Empirical Study of Parameter-Efficient Fine-Tuning Methods for Pre-Trained Code Models. In International Conference on Automated Software Engineering (ASE). IEEE/ACM, Kirchberg, Luxembourg, 397–408. doi:\nolinkurl10.1109/ASE56229.2023.00125

[306] 2024. \showarticletitleProRLearn: Boosting Prompt Tuning-based Vulnerability Detection by Reinforcement Learning. Automated Software Engineering (ASE) 31, 2 (2024), 38. doi:\nolinkurl10.1007/s10515-024-00438-9

[307] 2023. \showarticletitleSoftware Defect Prediction via Code Language Models. In International Conference on Communication Technology and Information Technology (ICCTIT). IEEE, Xi'an, China, 97–102. doi:\nolinkurl10.1109/ICCTIT60726.2023.10435711

[308] 2024. Parameter-Efficient Fine-Tuning for Large Models: A Comprehensive Survey. https://arxiv.org/abs/2403.14608

[309] Edward J. Hu and Yelong Shen and Phillip Wallis and Zeyuan Allen-Zhu and Yuanzhi Li and Shean Wang and Lu Wang and Weizhu Chen LoRA: Low-Rank Adaptation of Large Language Models International Conference on Learning Representations (ICLR) 2022 1 2 3

[310] Fanxu Meng and Zhaohui Wang and Muhan Zhang Pissa: Principal Singular Values and Singular Vectors Adaptation of Large Language Models Advances in Neural Information Processing Systems (NeurIPS) 2024 37 121038–121072 Curran Associates, Inc.

[311] Jiawei Zhao and Zhenyu Zhang and Beidi Chen and Zhangyang Wang and Anima Anandkumar and Yuandong Tian GaLore: Memory-efficient LLM Training by Gradient Low-rank Projection International Conference on Machine Learning (ICML) 2024 JMLR

[312] Tim Dettmers and Artidoro Pagnoni and Ari Holtzman and Luke Zettlemoyer QLoRA: Efficient Finetuning of Quantized LLMs Advances in Neural Information Processing Systems (NeurIPS) 2023 36 10088–10115 Curran Associates, Inc.

[313] 2017. Juliet C/C++ 1.3. https://samate.nist.gov/SARD/test-suites/112.

[314] 2017. Juliet Java 1.3. https://samate.nist.gov/SARD/test-suites/111.

[315] 2006. Software Assurance Reference Dataset. https://samate.nist.gov/SARD.

[316] 2019. \showarticletitleDevign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networks. In International Conference on Neural Information Processing Systems (NeurIPS). Curran Associates, Inc., Vancouver, BC, Canada, Article 915, 11 pages.

[317] 2020. \showarticletitleA C/C++ Code Vulnerability Dataset with Code Changes and CVE Summaries. In International Conference on Mining Software Repositories (MSR). ACM, Seoul, South Korea, 508–512. doi:\nolinkurl10.1145/3379597.3387501

[318] 2024. \showarticletitleMegaVul: A C/C++ Vulnerability Dataset with Comprehensive Code Representations. In International Conference on Mining Software Repositories (MSR). ACM, Lisbon, Portugal, 738–742. doi:\nolinkurl10.1145/3643991.3644886

[319] 2025. National Vulnerability Database (NVD). https://nvd.nist.gov/.

[320] 2018. \showarticletitleAutomated Vulnerability Detection in Source Code Using Deep Representation Learning. In International Conference on Machine Learning and Applications (ICMLA). IEEE, Orlando, FL, USA, 757–762. doi:\nolinkurl10.1109/ICMLA.2018.00120

[321] 2024. \showarticletitleReposVul: A Repository-Level High-Quality Vulnerability Dataset. In International Conference on Software Engineering: Companion Proceedings (ICSE-Companion). IEEE/ACM, Lisbon, Portugal, 472–483. doi:\nolinkurl10.1145/3639478.3647634

[322] 2021. \showarticletitleCrossVul: A Cross-Language Vulnerability Dataset with Commit Data. In Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE). ACM, Athens, Greece, 1565–1569. doi:\nolinkurl10.1145/3468264.3473122

[323] 2021. \showarticletitleD2A: A Dataset Built for AI-Based Vulnerability Detection Methods Using Differential Analysis. In International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP). IEEE/ACM, Madrid, Spain, 111–120. doi:\nolinkurl10.1109/ICSE-SEIP52600.2021.00020

[324] 2022. \showarticletitleDeep Learning Based Vulnerability Detection: Are We There Yet? IEEE Transactions on Software Engineering (TSE) 48, 9 (2022), 3280–3296. doi:\nolinkurl10.1109/TSE.2021.3087402

[325] 2021. \showarticletitleCVEfixes: Automated Collection of Vulnerabilities and Their Fixes from Open-Source Software. In International Conference on Predictive Models and Data Analytics in Software Engineering (PROMISE). ACM, Athens Greece, 30–39. doi:\nolinkurl10.1145/3475960.3475985

[326] 2024. Vulnerability Detection with Code Language Models: How Far Are We? https://arxiv.org/abs/2403.18624

[327] 2017. VulDeePecker: A Deep Learning-Based System for Vulnerability Detection. https://github.com/CGCL-codes/VulDeePecker.

[328] 2018. Draper VDISC Dataset - Vulnerability Detection in Source Code. https://osf.io/d45bw/.

[329] 2020. Devign. https://github.com/epicosy/devign.

[330] 2020. A C/C++ Code Vulnerability Dataset with Code Changes and CVE Summaries. https://github.com/ZeoVan/MSR_20_Code_vulnerability_CSV_Dataset.

[331] 2021. D2A Dataset and Generation Pipeline. https://github.com/IBM/D2A.

[332] 2020. Deep Learning based Vulnerability Detection:Are We There Yet? https://github.com/VulDetProject/ReVeal.

[333] 2024. CVEfixes Dataset: Automatically Collected Vulnerabilities and Their Fixes from Open-Source Software. https://zenodo.org/records/13118970.

[334] 2021. Cross-Language Vulnerability Dataset with File Changes and Commit Messages. https://zenodo.org/records/4734050.

[335] 2022. \showarticletitleSecurityEval Dataset: Mining Vulnerability Examples to Evaluate Machine Learning-Based Code Generation Techniques. In International Workshop on Mining Software Repositories Applications for Privacy and Security (MSR4P&S). ACM, Singapore, 29–33. doi:\nolinkurl10.1145/3549035.3561184

[336] 2022. SecurityEval. https://github.com/s2e-lab/SecurityEval.

[337] 2025. DiverseVul: A New Vulnerable Source Code Dataset for Deep Learning Based Vulnerability Detection. https://github.com/wagner-group/diversevul.

[338] 2023. \showarticletitleLarge Language Models for Code: Security Hardening and Adversarial Testing. In Conference on Computer and Communications Security (CCS). ACM, Copenhagen, Denmark, 1865–1879. doi:\nolinkurl10.1145/3576915.3623175

[339] 2023. SVEN: Security Hardening and Adversarial Testing for Code LLMs. https://github.com/eth-sri/sven.

[340] 2023. \showarticletitleThe FormAI Dataset: Generative AI in Software Security through the Lens of Formal Verification. In International Conference on Predictive Models and Data Analytics in Software Engineering (PROMISE). ACM, San Francisco, CA, USA, 33–43. doi:\nolinkurl10.1145/3617555.3617874

[341] 2023. FormAI Dataset. https://github.com/FormAI-Dataset/FormAI-dataset.

[342] 2024. [ICSE 2024 Industry Challenge Track] Official Implementation of "ReposVul: A Repository-Level High-Quality Vulnerability Dataset". https://github.com/Eshe0922/ReposVul.

[343] 2024. PrimeVul: Vulnerability Detection with Code Language Models: How Far Are We? https://github.com/DLVulDet/PrimeVul.

[344] 2024. KnowledgeRAG4LLMVulD. https://github.com/KnowledgeRAG4LLMVulD/KnowledgeRAG4LLMVulD/tree/main/dataset.

[345] 2023. MegaVul. https://github.com/Icyrockton/MegaVul.

[346] 2024. CleanVul. https://github.com/yikun-li/CleanVul.

[347] 2022. \showarticletitleVUDENC: Vulnerability Detection with Deep Learning on a Natural Codebase for Python. Information and Software Technology (INFSOF) 144 (2022), 106809. doi:\nolinkurl10.1016/j.infsof.2021.106809

[348] 2021. CodeXGLUE: A Machine Learning Benchmark Dataset for Code Understanding and Generation. https://arxiv.org/abs/2102.04664

[349] MITRE CWE-1000: Research Concepts 2023

[350] MITRE CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer 2025

[351] MITRE CWE CATEGORY: Resource Management Errors 2023

[352] MITRE CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') 2025

[353] 2025. \showarticletitleSemantic-Preserving Transformations as Mutation Operators: A Study on Their Effectiveness in Defect Detection. In International Conference on Software Testing, Verification and Validation Workshops (ICSTW). IEEE, Naples, Italy, 337–346. doi:\nolinkurl10.1109/ICSTW64639.2025.10962512

[354] 2023. How to Get Better Embeddings with Code Pre-Trained Models? {An} Empirical Study. https://arxiv.org/abs/2311.08066

[355] 2024. \showarticletitleRevisiting the Performance of Deep Learning-Based Vulnerability Detection on Realistic Datasets. IEEE Transactions on Software Engineering (TSE) 50, 8 (2024), 2163–2177. doi:\nolinkurl10.1109/TSE.2024.3423712

[356] 2025. PYPL PopularitY of Programming Language Index. https://pypl.github.io/PYPL.html.

[357] 2025. Mono: Is Your "Clean" Vulnerability Dataset Really Solvable? Exposing and Trapping Undecidable Patches and Beyond. https://arxiv.org/abs/2506.03651

[358] 2025. \showarticletitleICVul: A Well-labeled C/C++ Vulnerability Dataset with Comprehensive Metadata and VCCs. In International Conference on Mining Software Repositories (MSR). IEEE/ACM, Ottawa, ON, Canada, 154–158. doi:\nolinkurl10.1109/MSR66628.2025.00034

[359] 2025. \showarticletitleGVI: Guided Vulnerability Imagination for Boosting Deep Vulnerability Detectors. In International Conference on Software Engineering (ICSE). IEEE/ACM, Ottawa, ON, Canada, 2867–2879. doi:\nolinkurl10.1109/ICSE55347.2025.00214

[360] 2025. \showarticletitleFrom Theory to Practice: Code Generation Using LLMs for CAPEC and CWE Frameworks. In International Workshop on Large Language Models for Code (LLM4Code). IEEE/ACM, Ottawa, ON, Canada, 137–144. doi:\nolinkurl10.1109/LLM4Code66737.2025.00022

[361] 2023. \showarticletitleAn Empirical Study of Deep Learning Models for Vulnerability Detection. In International Conference on Software Engineering (ICSE). IEEE/ACM, Melbourne, Australia, 2237–2248. doi:\nolinkurl10.1109/ICSE48619.2023.00188

[362] Yu Nong and Rainy Sharma and Abdelwahab Hamou-Lhadj and Xiapu Luo and Haipeng Cai Open Science in Software Engineering: A Study on Deep Learning-Based Vulnerability Detection IEEE Transactions on Software Engineering (TSE) 2023 49 4 1983-2005 10.1109/TSE.2022.3207149

[363] 2025. \showarticletitleEnhancing Vulnerability Detection via Inter-procedural Semantic Completion. Proceedings of the ACM on Software Engineering (ASE) 2, ISSTA, Article ISSTA037 (2025), 23 pages. doi:\nolinkurl10.1145/3728912