DCVD: Dual-Channel Cross-Modal Fusion for Joint Vulnerability Detection and Localization

TL;DR

DCVD is a novel framework that jointly detects software vulnerabilities at the function level and localizes the specific lines responsible by leveraging dual-channel cross-modal features and explicit supervision.

Contribution

It introduces a unified dual-channel approach with cross-modal alignment and explicit supervision for improved vulnerability detection and localization.

Findings

Outperforms state-of-the-art methods on real-world benchmarks.

Effectively bridges cross-modal representation gaps.

Achieves high accuracy in both detection and localization tasks.

Abstract

Software vulnerability detection plays a critical role in ensuring system security, where real-world auditing requires not only determining whether a function is vulnerable but also pinpointing the specific lines responsible. However, existing approaches either rely on a single information source -- sequential, structural, or semantic -- failing to jointly exploit the complementary strengths across modalities, or treat statement-level localization merely as a byproduct of function-level detection without explicit line-level supervision. To address these limitations, we propose DCVD (Dual-Channel Cross-Modal Vulnerability Detection), a unified framework that performs joint function-level detection and statement-level localization. DCVD extracts control-dependency and semantic features through two parallel branches and integrates them via contrastive alignment coupled with bidirectional cross-attention, effectively bridging the cross-modal representation gap. It further introduces explicit supervision signals at both the function and statement levels, enabling collaborative optimization across the two granularities. Extensive experiments on a large-scale real-world vulnerability benchmark demonstrate that DCVD consistently outperforms state-of-the-art methods on both function-level detection and statement-level localization. Our code is available at https://github.com/vinsontang1/DCVD.