一句话：初步评估 PLM 与大语言模型在七种编程语言上的漏洞检测效果，发现 CodeT5P 表现最佳。
现有基于深度学习和预训练语言模型（PLM）的软件漏洞检测方法多局限于特定编程语言，难以直接应用于多语言场景。尽管大语言模型（LLM）具备语言无关能力和更强的语义理解，但其在多语言漏洞检测上的性能仍不清楚。本文开展初步实证研究，在七种流行编程语言上评估 PLM 与当前先进 LLM 的漏洞检测效果。结果表明，PLM 中的 CodeT5P 在多语言漏洞检测上取得最佳性能，尤其在识别最关键漏洞方面表现突出。作者据此讨论了 LLM 推进真实世界多语言漏洞检测的潜力，并为未来研究与实际部署提供了初步见解。
Deep learning-based approaches, particularly those leveraging pre-trained language models (PLMs), have shown promise in automated software vulnerability detection. However, existing methods are predominantly limited to specific programming languages, restricting their applicability in multilingual settings. Recent advancements in large language models (LLMs) offer language-agnostic capabilities and enhanced semantic understanding, presenting a potential solution to this limitation. While existing studies have explored LLMs for vulnerability detection, their detection performance remains unknown for multilingual vulnerabilities. To address this gap, we conducted a preliminary study to evaluate the effectiveness of PLMs and state-of-the-art LLMs across seven popular programming languages. Our findings reveal that the PLM CodeT5P achieves the best performance in multilingual vulnerability detection, particularly in identifying the most critical vulnerabilities. Based on these results, we further discuss the potential of LLMs in advancing real-world multilingual vulnerability detection. This work represents an initial step toward exploring PLMs and LLMs for cross-language vulnerability detection, offering key insights for future research and practical deployment.
DOI 原文 ·
@inproceedings{paperbot9587,
title = {A Preliminary Study of Large Language Models for Multilingual Vulnerability Detection},
author = {Junji Yu and Honglin Shu and Michael Fu and Dong Wang and Chakkrit Tantithamthavorn and Yasutaka Kamei and Junjie Chen},
booktitle = {ISSTA},
year = {2025},
doi = {10.1145/3713081.3731746}
}