Towards cost-efficient vulnerability detection with cross-modal adversarial reprogramming

While deep learning has advanced the automatic detection of software vulnerabilities, current DL-based methods still face two major obstacles: the scarcity of vulnerable code samples and the high computational cost of training models from scratch, which, however, have been largely overlooked. This paper introduces Capture, a novel Cross-modal Adversarial reProgramming approach Towards cost-efficient vUlneRability dEtection, which reduces the need for well-labeled large vulnerable datasets and minimizes training time. Specifically, Capture first performs lexical parsing and linearization on the AST of the source code to extract structure- and type-aware token sequences. These sequences are transformed into a perturbation image by retrieving and reshaping each token’s embedding from a learnable universal perturbation dictionary. This enables a pre-trained model originally designed for image classification to be repurposed to support code vulnerability detection, with a dynamic label remapping scheme applied at the end that reassigns the model’s output to the binary vulnerability detection result. Our experiments demonstrate that Capture achieves detection accuracy comparable to state-of-the-art methods, while enhancing training efficiency due to its minimal quantity of parameters to update during the model training. Notably, Capture excels in scenarios with limited vulnerable samples, delivering superior detection accuracy and F1 scores compared to baseline methods.