Leveraging syntactic dual-graph representations for security patch identification via structural latent alignment

Abstract

Security patch identification is to automatically detect security-relevant commits from a vast number of code diffs. Previous works significantly improve the performance of automatic security patch identification by introducing pre-trained models. However, most existing approaches fail to capture the structural evolution across code diffs which is essential for understanding how code behavior changes during patching. Furthermore, the changes in code diffs are usually subtles, resulting in sparse representation of structural changes and making difficulty in distinguishing the effects of different structural changes. Finally, none of existing methods can fully capture the syntactic and semantic information from code diffs and commit message. In this work, we propose DualGraphPatcher, a framework designed to learn a well-structured and discriminative feature in the latent space by jointly modeling semantic information and structural code evolution. To capture fine-grained code structural changes, instead of relying on a single snapshot of a function, we construct two independent Abstract Syntax Tree (AST) structures for the pre-change and post-change versions from the original code diffs to model the entire graph topology of each version, enabling explicit modeling of structural evolution across code diffs. To alleviate the sparse representation of structural changes, we propose a latent structural alignment module, which performs soft clustering over the representations of pre-change and post-change ASTs and minimizes their distributional divergence in the shared latent space. To jointly learn syntactic and semantic information from code diffs and commit messages, we design a tri-encoder architecture, where CodeBERT and BERT extract semantic embeddings from code diffs and commit messages, and GCN encodes the syntactic structures of pre-change and post-change ASTs. Experiments on three real-world datasets demonstrate that DualGraphPatcher consistently outperforms state-of-the-art baselines in security patch identification, validating the effectiveness of both dual-graph modeling, latent structural alignment and tri-encoder. The code and data are shared in https://github.com/AppleMax1992/DualGraphPatcher.