# Toward Improved Deep Learning-based Vulnerability Detection

arXiv: https://arxiv.org/abs/2403.03024 · HTML: https://mlsanity.com/paper/2403.03024/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 5 Mar 2024.

## Built on by (most cited first, 9 of 9)

- [Vul-RAG: Enhancing LLM-based Vulnerability Detection via Knowledge-level RAG](https://mlsanity.com/paper/2406.11147/) (2024)
- [Top Score on the Wrong Exam: On Benchmarking in Machine Learning for Vulnerability Detection](https://mlsanity.com/paper/2408.12986/) (2024)
- [Security Vulnerability Detection with Multitask Self-Instructed Fine-Tuning of Large Language Models](https://mlsanity.com/paper/2406.05892/) (2024)
- [LLM-based Vulnerability Discovery through the Lens of Code Metrics](https://mlsanity.com/paper/2509.19117/) (2025)
- [An Empirical Study of Vulnerabilities in Python Packages and Their Detection](https://mlsanity.com/paper/2509.04260/) (2025)
- [Towards Iterative End-to-End Software Development: A Feature-Driven Multi-Agent Framework](https://mlsanity.com/paper/2511.02399/) (2025)
- [Investigating Execution-Aware Language Models for Code Optimization](https://mlsanity.com/paper/2503.08228/) (2025)
- [Repairing vulnerabilities without invisible hands. A differentiated replication study on LLMs](https://mlsanity.com/paper/2507.20977/) (2025)
- [AutoTrace: From Patches to Triggers via Agentic Interprocedural Exploration](https://mlsanity.com/paper/2607.12058/) (2026)

## Abstract (arXiv)

Deep learning (DL) has been a common thread across several recent techniques for vulnerability detection. The rise of large, publicly available datasets of vulnerabilities has fueled the learning process underpinning these techniques. While these datasets help the DL-based vulnerability detectors, they also constrain these detectors' predictive abilities. Vulnerabilities in these datasets have to be represented in a certain way, e.g., code lines, functions, or program slices within which the vulnerabilities exist. We refer to this representation as a base unit. The detectors learn how base units can be vulnerable and then predict whether other base units are vulnerable. We have hypothesized that this focus on individual base units harms the ability of the detectors to properly detect those vulnerabilities that span multiple base units (or MBU vulnerabilities). For vulnerabilities such as these, a correct detection occurs when all comprising base units are detected as vulnerable. Verifying how existing techniques perform in detecting all parts of a vulnerability is important to establish their effectiveness for other downstream tasks. To evaluate our hypothesis, we conducted a study focusing on three prominent DL-based detectors: ReVeal, DeepWukong, and LineVul. Our study shows that all three detectors contain MBU vulnerabilities in their respective datasets. Further, we observed significant accuracy drops when detecting these types of vulnerabilities. We present our study and a framework that can be used to help DL-based detectors toward the proper inclusion of MBU vulnerabilities.