Graph Neural Networks for Vulnerability Detection: A Counterfactual Explanation
Not on the map. Why?
Abstract (arXiv)
Vulnerability detection is crucial for ensuring the security and reliability of software systems. Recently, Graph Neural Networks (GNNs) have emerged as a prominent code embedding approach for vulnerability detection, owing to their ability to capture the underlying semantic structure of source code. However, GNNs face significant challenges in explainability due to their inherently black-box nature. To this end, several factual reasoning-based explainers have been proposed. These explainers provide explanations for the predictions made by GNNs by analyzing the key features that contribute to the outcomes. We argue that these factual reasoning-based explanations cannot answer critical what-if questions: What would happen to the GNN's decision if we were to alter the code graph into alternative structures? Inspired by advancements of counterfactual reasoning in artificial intelligence, we propose CFExplainer, a novel counterfactual explainer for GNN-based vulnerability detection. Unlike factual reasoning-based explainers, CFExplainer seeks the minimal perturbation to the input code graph that leads to a change in the prediction, thereby addressing the what-if questions for vulnerability detection. We term this perturbation a counterfactual explanation, which can pinpoint the root causes of the detected vulnerability and furnish valuable insights for developers to undertake appropriate actions for fixing the vulnerability. Extensive experiments on four GNN-based vulnerability detection models demonstrate the effectiveness of CFExplainer over existing state-of-the-art factual reasoning-based explainers.
Key facts. Cited by 12 papers in the map (data through 14 Oct 2026). Builds on 30 of its 64 references that are in the map. First posted on arXiv 24 Apr 2024.
Builds on
30 of 64 references.
References · 30
- 2014Adam: A Method for Stochastic Optimizationcited by 37,240
- 2016Semi-Supervised Classification with Graph Convolutional Networkscited by 11,361
- 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,733
- 2018How Powerful are Graph Neural Networks?cited by 4,393
- 2017Learning Important Features Through Propagating Activation Differencescited by 1,458
- 2015Gated Graph Sequence Neural Networkscited by 796
- 2019GNNExplainer: Generating Explanations for Graph Neural Networkscited by 737
- 2020GraphCodeBERT: Pre-training Code Representations with Data Flowcited by 609
- 2020Explainability in Graph Neural Networks: A Taxonomic Surveycited by 384
- 2021On Explainability of Graph Neural Networks via Subgraph Explorationscited by 281
- 2020Higher-Order Explanations of Graph Neural Networks via Relevant Walkscited by 138
- 2021Generative Causal Explanations for Graph Neural Networkscited by 124
18 more
- 2022Learning and Evaluating Graph Neural Network Explanations based on Counterfactual and Factual Reasoningcited by 79
- 2021Counterfactual Explainable Recommendationcited by 60
- 2021Vulnerability Detection with Fine-grained Interpretationscited by 56
- 2022What Do They Capture? -- A Structural Analysis of Pre-Trained Language Models for Source Codecited by 50
- 2022CLEAR: Generative Counterfactual Explanations on Graphscited by 48
- 2019Multi-Modal Attention Network Learning for Semantic Source Code Retrievalcited by 41
- 2021Counterfactual Graphs for Explainable Classification of Brain Networkscited by 33
- 2021MEG: Generating Molecular Counterfactual Explanations for Deep Graph Networkscited by 32
- 2021ReGVD: Revisiting Graph Neural Networks for Vulnerability Detectioncited by 32
- 2022Global Counterfactual Explainer for Graph Neural Networkscited by 30
- 2021Counterfactual Explanations for Models of Codecited by 25
- 2021Understanding Neural Code Intelligence Through Program Simplificationcited by 22
- 2021VELVET: a noVel Ensemble Learning approach to automatically locate VulnErable sTatementscited by 20
- 2020Probing Model Signal-Awareness via Prediction-Preserving Input Minimizationcited by 14
- 2022Reinforced Path Reasoning for Counterfactual Explainable Recommendationcited by 13
- 2016Spectrum-based Software Fault Localization: A Survey of Techniques, Advances, and Challengescited by 9
- 2021Be Causal: De-biasing Social Network Confounding in Recommendationcited by 9
- 2019Competitive Multi-Agent Deep Reinforcement Learning with Counterfactual Thinkingcited by 5
Built on by
Citing papers per year: 2024: 2; 2025: 7; 2026: 3.
12 papers.
- 2024Top Score on the Wrong Exam: On Benchmarking in Machine Learning for Vulnerability Detectioncited by 28
- 2025CODESYNC: Synchronizing Large Language Models with Dynamic Code Evolution at Scalecited by 8
- 2024An Empirical Study on Capability of Large Language Models in Understanding Code Semanticscited by 7
- 2025Implicit Hypergraph Neural Networks: A Stable Framework for Higher-Order Relational Learning with Provable Guaranteescited by 3
- 2025VISION: Robust and Interpretable Code Vulnerability Detection Leveraging Counterfactual Augmentationcited by 3
- 2025Can Large Language Models Understand Intermediate Representations in Compilers?cited by 1
- 2025Ralts: Robust Aggregation for Enhancing Graph Neural Network Resilience on Bit-flip Errorscited by 0
- 2025Diverse LLMs vs. Vulnerabilities: Who Detects and Fixes Them Better?cited by 0
- 2025Topologically-Stabilized Graph Neural Networks: Empirical Robustness Across Domainscited by 0
- 2026ORACAL: A Robust and Explainable Multimodal Framework for Smart Contract Vulnerability Detection with Causal Graph Enrichmentcited by 0
- 2026A Completion-Aware Framework for Impactful Counterfactual Explainability in Graph Neural Networkscited by 0
- 2026A Comparative Study of Counterfactual Explainers for Graph Neural Networks Enabling Multiple Types of Graph Editcited by 0
- 2026A Comparative Study of Counterfactual Explainers for Graph Neural Networks Enabling Multiple Types of Graph Edit4 Sep 2026
- 2026A Completion-Aware Framework for Impactful Counterfactual Explainability in Graph Neural Networks20 Jun 2026
- 2026ORACAL: A Robust and Explainable Multimodal Framework for Smart Contract Vulnerability Detection with Causal Graph Enrichment30 Mar 2026
- 2025Topologically-Stabilized Graph Neural Networks: Empirical Robustness Across Domains15 Dec 2025
- 2025Diverse LLMs vs. Vulnerabilities: Who Detects and Fixes Them Better?14 Dec 2025
- 2025VISION: Robust and Interpretable Code Vulnerability Detection Leveraging Counterfactual Augmentation26 Aug 2025
- 2025Implicit Hypergraph Neural Networks: A Stable Framework for Higher-Order Relational Learning with Provable Guarantees13 Aug 2025
- 2025Ralts: Robust Aggregation for Enhancing Graph Neural Network Resilience on Bit-flip Errors24 Jul 2025
- 2025CODESYNC: Synchronizing Large Language Models with Dynamic Code Evolution at Scale23 Feb 2025
- 2025Can Large Language Models Understand Intermediate Representations in Compilers?7 Feb 2025
- 2024Top Score on the Wrong Exam: On Benchmarking in Machine Learning for Vulnerability Detection23 Aug 2024
- 2024An Empirical Study on Capability of Large Language Models in Understanding Code Semantics4 Jul 2024