{"id":"https://openalex.org/W7117565328","doi":"https://doi.org/10.1109/tse.2025.3649250","title":"Evaluating Large Language Models for Line-Level Vulnerability Localization","display_name":"Evaluating Large Language Models for Line-Level Vulnerability Localization","publication_year":2025,"publication_date":"2025-12-30","ids":{"openalex":"https://openalex.org/W7117565328","doi":"https://doi.org/10.1109/tse.2025.3649250"},"language":"en","primary_location":{"id":"doi:10.1109/tse.2025.3649250","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tse.2025.3649250","pdf_url":null,"source":{"id":"https://openalex.org/S8351582","display_name":"IEEE Transactions on Software Engineering","issn_l":"0098-5589","issn":["0098-5589","1939-3520","2326-3881"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Software Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5121598438","display_name":"Jian Zhang","orcid":null},"institutions":[{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jian Zhang","raw_affiliation_strings":["School of Software, Beihang University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-8316-1894","affiliations":[{"raw_affiliation_string":"School of Software, Beihang University, Beijing, China","institution_ids":["https://openalex.org/I82880672"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5121583851","display_name":"Chong Wang","orcid":null},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Chong Wang","raw_affiliation_strings":["Nanyang Technological University, Singapore, Singapore"],"raw_orcid":"https://orcid.org/0000-0003-1424-6290","affiliations":[{"raw_affiliation_string":"Nanyang Technological University, Singapore, Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5023872969","display_name":"Anran Li","orcid":"https://orcid.org/0000-0002-3592-4153"},"institutions":[{"id":"https://openalex.org/I32971472","display_name":"Yale University","ror":"https://ror.org/03v76x132","country_code":"US","type":"education","lineage":["https://openalex.org/I32971472"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Anran Li","raw_affiliation_strings":["Yale University, New Haven, CT, USA"],"raw_orcid":"https://orcid.org/0000-0002-3592-4153","affiliations":[{"raw_affiliation_string":"Yale University, New Haven, CT, USA","institution_ids":["https://openalex.org/I32971472"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5013856385","display_name":"Weisong Sun","orcid":"https://orcid.org/0000-0001-9236-8264"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Weisong Sun","raw_affiliation_strings":["Nanyang Technological University, Singapore, Singapore"],"raw_orcid":"https://orcid.org/0000-0001-9236-8264","affiliations":[{"raw_affiliation_string":"Nanyang Technological University, Singapore, Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5027997455","display_name":"C Zhang","orcid":null},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Cen Zhang","raw_affiliation_strings":["Nanyang Technological University, Singapore, Singapore"],"raw_orcid":"https://orcid.org/0000-0001-5603-1322","affiliations":[{"raw_affiliation_string":"Nanyang Technological University, Singapore, Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5057849611","display_name":"Wei Ma","orcid":"https://orcid.org/0000-0002-0044-466X"},"institutions":[{"id":"https://openalex.org/I79891267","display_name":"Singapore Management University","ror":"https://ror.org/050qmg959","country_code":"SG","type":"education","lineage":["https://openalex.org/I79891267"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Wei Ma","raw_affiliation_strings":["Singapore Management University, Singapore, Singapore"],"raw_orcid":"https://orcid.org/0000-0002-0044-466X","affiliations":[{"raw_affiliation_string":"Singapore Management University, Singapore, Singapore","institution_ids":["https://openalex.org/I79891267"]}]},{"author_position":"last","author":{"id":null,"display_name":"Yang Liu","orcid":"https://orcid.org/0000-0001-7300-9215"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Yang Liu","raw_affiliation_strings":["Nanyang Technological University, Singapore, Singapore"],"raw_orcid":"https://orcid.org/0000-0001-7300-9215","affiliations":[{"raw_affiliation_string":"Nanyang Technological University, Singapore, Singapore","institution_ids":["https://openalex.org/I172675005"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.71601769,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"52","issue":"3","first_page":"770","last_page":"785"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.30570000410079956,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.30570000410079956,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.12030000239610672,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.10450000315904617,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/discriminative-model","display_name":"Discriminative model","score":0.7782999873161316},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.6471999883651733},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.5805000066757202},{"id":"https://openalex.org/keywords/generalizability-theory","display_name":"Generalizability theory","score":0.5115000009536743},{"id":"https://openalex.org/keywords/adaptation","display_name":"Adaptation (eye)","score":0.4943000078201294},{"id":"https://openalex.org/keywords/vulnerability-assessment","display_name":"Vulnerability assessment","score":0.4740999937057495},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.42250001430511475},{"id":"https://openalex.org/keywords/language-model","display_name":"Language model","score":0.39570000767707825},{"id":"https://openalex.org/keywords/remedial-education","display_name":"Remedial education","score":0.3402999937534332}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8215000033378601},{"id":"https://openalex.org/C97931131","wikidata":"https://www.wikidata.org/wiki/Q5282087","display_name":"Discriminative model","level":2,"score":0.7782999873161316},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.6471999883651733},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.5805000066757202},{"id":"https://openalex.org/C27158222","wikidata":"https://www.wikidata.org/wiki/Q5532422","display_name":"Generalizability theory","level":2,"score":0.5115000009536743},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5049999952316284},{"id":"https://openalex.org/C139807058","wikidata":"https://www.wikidata.org/wiki/Q352374","display_name":"Adaptation (eye)","level":2,"score":0.4943000078201294},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.4740999937057495},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4738999903202057},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.42250001430511475},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.39570000767707825},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3849000036716461},{"id":"https://openalex.org/C100207952","wikidata":"https://www.wikidata.org/wiki/Q7311597","display_name":"Remedial education","level":2,"score":0.3402999937534332},{"id":"https://openalex.org/C172776598","wikidata":"https://www.wikidata.org/wiki/Q7943570","display_name":"Vulnerability management","level":4,"score":0.3294999897480011},{"id":"https://openalex.org/C39890363","wikidata":"https://www.wikidata.org/wiki/Q36108","display_name":"Generative grammar","level":2,"score":0.310699999332428},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.31040000915527344},{"id":"https://openalex.org/C22019652","wikidata":"https://www.wikidata.org/wiki/Q331309","display_name":"Overfitting","level":3,"score":0.30390000343322754},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.2921000123023987},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.2833999991416931},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.27619999647140503},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.27379998564720154},{"id":"https://openalex.org/C199519371","wikidata":"https://www.wikidata.org/wiki/Q942695","display_name":"Source lines of code","level":3,"score":0.2709999978542328},{"id":"https://openalex.org/C177148314","wikidata":"https://www.wikidata.org/wiki/Q170084","display_name":"Generalization","level":2,"score":0.25949999690055847},{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.258899986743927},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.257999986410141},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.2556999921798706},{"id":"https://openalex.org/C18552078","wikidata":"https://www.wikidata.org/wiki/Q255615","display_name":"Code-switching","level":2,"score":0.2515999972820282},{"id":"https://openalex.org/C62230096","wikidata":"https://www.wikidata.org/wiki/Q275969","display_name":"Crowdsourcing","level":2,"score":0.25099998712539673},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.25040000677108765}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/tse.2025.3649250","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tse.2025.3649250","pdf_url":null,"source":{"id":"https://openalex.org/S8351582","display_name":"IEEE Transactions on Software Engineering","issn_l":"0098-5589","issn":["0098-5589","1939-3520","2326-3881"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Software Engineering","raw_type":"journal-article"},{"id":"pmh:oai:dr.ntu.edu.sg:10356/212328","is_oa":false,"landing_page_url":"https://hdl.handle.net/10356/212328","pdf_url":null,"source":{"id":"https://openalex.org/S4306402609","display_name":"DR-NTU (Nanyang Technological University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I172675005","host_organization_name":"Nanyang Technological University","host_organization_lineage":["https://openalex.org/I172675005"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Journal Article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/10","display_name":"Reduced inequalities","score":0.7124902606010437}],"awards":[{"id":"https://openalex.org/G2817391211","display_name":null,"funder_award_id":"KG16426001","funder_id":"https://openalex.org/F4320335787","funder_display_name":"Fundamental Research Funds for the Central Universities"}],"funders":[{"id":"https://openalex.org/F4320335787","display_name":"Fundamental Research Funds for the Central Universities","ror":null}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":40,"referenced_works":["https://openalex.org/W2013640190","https://openalex.org/W2130758759","https://openalex.org/W2293624369","https://openalex.org/W2781491433","https://openalex.org/W2975871742","https://openalex.org/W2998879504","https://openalex.org/W3091588759","https://openalex.org/W3098605233","https://openalex.org/W3141872514","https://openalex.org/W3166095789","https://openalex.org/W3170092793","https://openalex.org/W3177116043","https://openalex.org/W3183469243","https://openalex.org/W3185341429","https://openalex.org/W3198685994","https://openalex.org/W3202871865","https://openalex.org/W4225673889","https://openalex.org/W4284667406","https://openalex.org/W4285490465","https://openalex.org/W4312436517","https://openalex.org/W4312969325","https://openalex.org/W4378942602","https://openalex.org/W4380763529","https://openalex.org/W4384302744","https://openalex.org/W4384304728","https://openalex.org/W4384345641","https://openalex.org/W4384345694","https://openalex.org/W4384345698","https://openalex.org/W4384345708","https://openalex.org/W4384345728","https://openalex.org/W4384345745","https://openalex.org/W4385187279","https://openalex.org/W4388482980","https://openalex.org/W4388483128","https://openalex.org/W4388483660","https://openalex.org/W4389161980","https://openalex.org/W4391579639","https://openalex.org/W4394769344","https://openalex.org/W4400582623","https://openalex.org/W4416310693"],"related_works":[],"abstract_inverted_index":{"Recently,":[0],"Automated":[1],"Vulnerability":[2],"Localization":[3],"(AVL)":[4],"has":[5],"attracted":[6],"growing":[7],"attention,":[8],"aiming":[9],"to":[10,82,150],"facilitate":[11],"diagnosis":[12],"by":[13],"pinpointing":[14],"the":[15,46,179,216],"specific":[16],"lines":[17],"of":[18,51,171,182],"code":[19,63],"responsible":[20],"for":[21,53,62,105,205,218,226],"vulnerabilities.":[22],"Large":[23],"Language":[24],"Models":[25],"(LLMs)":[26],"have":[27],"shown":[28],"potential":[29],"in":[30,36,185,231],"various":[31],"domains,":[32],"yet":[33],"their":[34],"effectiveness":[35],"line-level":[37],"vulnerability":[38,111],"localization":[39],"remains":[40],"underexplored.In":[41],"this":[42],"work,":[43],"we":[44,177],"present":[45],"first":[47,180],"comprehensive":[48],"empirical":[49],"evaluation":[50],"LLMs":[52,60,138],"AVL.":[54],"Our":[55],"study":[56],"examines":[57],"19":[58],"leading":[59],"suitable":[61],"analysis,":[64],"including":[65],"ChatGPT":[66,141],"and":[67,74,92,95,107,153,158,167,199],"multiple":[68],"open-source":[69],"models,":[70],"spanning":[71],"encoder-only,":[72],"encoder-decoder,":[73],"decoder-only":[75],"architectures,":[76],"with":[77],"model":[78],"sizes":[79],"from":[80],"60M":[81],"70B":[83],"parameters.":[84],"We":[85,145],"evaluate":[86],"three":[87],"paradigms\u2014few-shot":[88],"prompting,":[89],"discriminative":[90,116],"fine-tuning,":[91,157],"generative":[93],"fine-tuning\u2014with":[94],"without":[96],"Low-Rank":[97],"Adaptation":[98],"(LoRA),":[99],"on":[100],"both":[101,170],"a":[102,108,163],"BigVul-derived":[103],"dataset":[104],"C/C++":[106],"smart":[109],"contract":[110],"dataset.Our":[112],"results":[113],"show":[114],"that":[115,188],"fine-tuning":[117],"achieves":[118],"substantial":[119],"performance":[120,202],"gains":[121],"over":[122],"existing":[123],"learning-based":[124],"AVL":[125,229],"methods":[126],"when":[127],"sufficient":[128],"training":[129],"data":[130],"is":[131],"available.":[132],"In":[133],"low-data":[134],"settings,":[135],"prompting":[136],"advanced":[137],"such":[139],"as":[140],"proves":[142],"more":[143],"effective.":[144],"also":[146],"identify":[147],"challenges":[148],"related":[149],"input":[151],"length":[152],"unidirectional":[154],"context":[155],"during":[156],"propose":[159],"two":[160],"remedial":[161],"strategies:":[162],"sliding":[164],"window":[165],"approach":[166],"right-forward":[168],"embedding,":[169],"which":[172],"yield":[173],"significant":[174],"improvements.":[175],"Moreover,":[176],"provide":[178],"assessment":[181],"LLM":[183],"generalizability":[184],"AVL,":[186],"showing":[187],"certain":[189],"models":[190],"can":[191],"transfer":[192],"effectively":[193],"across":[194],"Common":[195],"Weakness":[196],"Enumerations":[197],"(CWEs)":[198],"projects.":[200],"However,":[201],"degrades":[203],"notably":[204],"newly":[206],"discovered":[207],"vulnerabilities":[208],"containing":[209],"unfamiliar":[210],"lexical":[211],"or":[212],"structural":[213],"patterns,":[214],"underscoring":[215],"need":[217],"continual":[219],"adaptation.":[220],"These":[221],"findings":[222],"offer":[223],"practical":[224],"guidance":[225],"deploying":[227],"LLM-based":[228],"systems":[230],"realistic":[232],"software":[233],"security":[234],"workflows.":[235]},"counts_by_year":[],"updated_date":"2026-07-29T09:40:50.615796","created_date":"2025-12-30T00:00:00"}