Attention Is All You Need for LLM-Based Code Vulnerability Localization

作者：Yue Li, Xiao Li, Hao Wu, Yue Zhang, Xiu-Zhen Cheng, Ya-Ting Liu, Fengyuan Xu, Sheng Zhong · 发表于：IEEE Transactions on Information Forensics and Security · 年份：2026 · DOI：10.1109/tifs.2026.3725564 · 被引用次数：19 · 研究领域：Computer Science

The rapid expansion of software systems and the growing number of reported vulnerabilities have emphasized the importance of accurately identifying vulnerable code segments. Traditional methods for vulnerability localization, such as manual code audits or rule-based tools, are often time-consuming and limited in scope, typically focusing on specific programming languages or types of vulnerabilities. In recent years, the introduction of large language models (LLMs) such as GPT and LLaMA has opened new possibilities for automating vulnerability localization. However, while LLMs show promise in this area, they face challenges, particularly in maintaining accuracy over longer code contexts. This paper introduces $\textsf {LOVA}$ , a novel framework leveraging the self-attention mechanisms inherent in LLMs to enhance vulnerability localization. Our key insight is that self-attention mechanisms assign varying importance to different parts of the input, making it possible to track how much attention the model focuses on specific lines of code. In the context of vulnerability localization, the hypothesis is that vulnerable lines of code will naturally attract higher attention weights because they have a greater influence on the model’s output. By systematically tracking changes in attention weights and focusing on specific lines of code, $\textsf {LOVA}$ improves the precision of identifying vulnerable lines across various programming languages. Through rigorous experiment...