Towards prompt tuning-based software vulnerability assessment with continual learning

Abstract

Software vulnerability assessment (SVA) has become increasingly important due to the growing reliance on various software systems and the rising complexity of cyber threats. SVA aims to quickly identify and remediate high-risk vulnerabilities in software systems, which helps protect sensitive information and maintain the integrity of digital infrastructure. In our study, we focus on prompt tuning-based SVA. Prompt tuning reduces computational costs by tuning the input prompts instead of the entire model. We further incorporate the continual learning paradigm to enable the SVA model to adapt to new vulnerabilities as they emerge dynamically. This paradigm ensures the SVA model remains up-to-date, reduces the risk of catastrophic forgetting, and provides resource-efficient updates. To achieve this goal, we propose a novel method SVACL. SVACL combines confidence-based replay and regularization methods for continual learning. Additionally, SVACL uses both source code and vulnerability descriptions to create hybrid prompts for prompt tuning with the pre-trained model CodeT5. Experimental results demonstrate that SVACL outperforms state-of-the-art SVA baselines by 20% to 380% in terms of MCC performance measure. Finally, our ablation study results confirm the effectiveness of the component settings (such as confidence-based replay, regularization method, vulnerability information fusion, CodeT5, and hybrid prompts) for SVACL. Therefore, our study provides the first promising step toward prompt tuning-based SVA with continual learning.