# TraceVIC: Causal Reasoning over Code Evolution for Identifying Vulnerability-Inducing Commits

arXiv: https://arxiv.org/abs/2609.26711 · HTML: https://mlsanity.com/paper/2609.26711/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 17 of its 52 references that are in the map.
- First posted on arXiv 22 Sep 2026.

## Builds on (most cited first, 17 of 17)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [CodeBERT: A Pre-Trained Model for Programming and Natural Languages](https://mlsanity.com/paper/2002.08155/) (2020)
- [UniXcoder: Unified Cross-Modal Pre-training for Code Representation](https://mlsanity.com/paper/2203.03850/) (2022)
- [Are Latent Vulnerabilities Hidden Gems for Software Vulnerability Prediction? An Empirical Study](https://mlsanity.com/paper/2401.11105/) (2024)
- [Noisy Label Learning for Security Defects](https://mlsanity.com/paper/2203.04468/) (2022)
- [Evaluating SZZ Implementations: An Empirical Study on the Linux Kernel](https://mlsanity.com/paper/2308.05060/) (2023)
- [Problems with SZZ and Features: An empirical study of the state of practice of defect prediction data collection](https://mlsanity.com/paper/1911.08938/) (2019)
- [Code Change Intention, Development Artifact and History Vulnerability: Putting Them Together for Vulnerability Fix Detection by LLM](https://mlsanity.com/paper/2501.14983/) (2025)
- [SZZ Unleashed: An Open Implementation of the SZZ Algorithm -- Featuring Example Usage in a Study of Just-in-Time Bug Prediction for the Jenkins Project](https://mlsanity.com/paper/1903.01742/) (2019)
- [The (Un)Reliability of NVD Vulnerable Versions Data: an Empirical Experiment on Google Chrome Vulnerabilities](https://mlsanity.com/paper/1302.4133/) (2013)
- [Fonte: Finding Bug Inducing Commits from Failures](https://mlsanity.com/paper/2212.06376/) (2022)
- [LLM4SZZ: Enhancing SZZ Algorithm with Context-Enhanced Assessment on Large Language Models](https://mlsanity.com/paper/2504.01404/) (2025)
- [Toward Realistic Evaluations of Just-In-Time Vulnerability Prediction](https://mlsanity.com/paper/2507.10729/) (2025)
- [Vulnerability-Affected Versions Identification: How Far Are We?](https://mlsanity.com/paper/2509.03876/) (2025)
- [CommitShield: Tracking Vulnerability Introduction and Fix in Version Control Systems](https://mlsanity.com/paper/2501.03626/) (2025)
- [Characteristics, Root Causes, and Detection of Incomplete Security Bug Fixes in the Linux Kernel](https://mlsanity.com/paper/2511.17799/) (2025)
- [AgenticSZZ: Temporal Knowledge Graph-Guided Agentic Bug-Inducing Commit Identification](https://mlsanity.com/paper/2602.02934/) (2026)

## Abstract (arXiv)

Software vulnerabilities are often discovered long after they are introduced, making it difficult to identify the vulnerability-inducing commit (VIC) responsible for introducing the underlying vulnerable condition. Existing VIC identification techniques largely rely on git blame to trace vulnerable code through revision history and use positional heuristics, such as selecting its earliest or most recent modification. However, the true VIC may occur anywhere within this history, and vulnerable behavior may depend on code that evolves across multiple revisions. We therefore argue that VIC identification requires reasoning about how vulnerability-relevant code evolves, rather than simply where a candidate commit appears in the revision history. We present TraceVIC, a temporal graph-based approach for identifying and ranking VICs by reasoning over code evolution. TraceVIC first localizes likely root-cause lines and traces their histories across revisions, constructing graph representations that capture program structure within each revision and the evolution of vulnerability-relevant code across the history. It reasons over the resulting revision history, using temporal edges to preserve correspondences between program elements across consecutive revisions, and directly ranks candidate commits according to their contribution to the vulnerable condition. Ablation results show that modeling the full revision history improves F2 from 0.637 to 0.814. TraceVIC improves F2 by up to 28.7% over state-of-the-art methods and identifies a valid VIC for 78 of 79 vulnerabilities across four unseen C/C++ projects.