{"id":"https://openalex.org/W7126246556","doi":"https://doi.org/10.1109/tse.2026.3659630","title":"CosFormer: A Code Semantic-Aware Transformer for Vulnerability Detection","display_name":"CosFormer: A Code Semantic-Aware Transformer for Vulnerability Detection","publication_year":2026,"publication_date":"2026-01-30","ids":{"openalex":"https://openalex.org/W7126246556","doi":"https://doi.org/10.1109/tse.2026.3659630"},"language":null,"primary_location":{"id":"doi:10.1109/tse.2026.3659630","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tse.2026.3659630","pdf_url":null,"source":{"id":"https://openalex.org/S8351582","display_name":"IEEE Transactions on Software Engineering","issn_l":"0098-5589","issn":["0098-5589","1939-3520","2326-3881"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Software Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5073429240","display_name":"Qianyue Wei","orcid":null},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qianyue Wei","raw_affiliation_strings":["Beijing University of Posts and Telecommunications"],"raw_orcid":"https://orcid.org/0009-0003-7542-3016","affiliations":[{"raw_affiliation_string":"Beijing University of Posts and Telecommunications","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100459199","display_name":"Zheng Zhang","orcid":"https://orcid.org/0009-0005-7992-519X"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zheng Zhang","raw_affiliation_strings":["Beijing University of Posts and Telecommunications"],"raw_orcid":"https://orcid.org/0009-0002-5644-9416","affiliations":[{"raw_affiliation_string":"Beijing University of Posts and Telecommunications","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5060126620","display_name":"Qiuping Yi","orcid":"https://orcid.org/0009-0007-4680-4820"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qiuping Yi","raw_affiliation_strings":["Beijing University of Posts and Telecommunications"],"raw_orcid":"https://orcid.org/0009-0007-4680-4820","affiliations":[{"raw_affiliation_string":"Beijing University of Posts and Telecommunications","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5014646800","display_name":"Zongcheng Ji","orcid":"https://orcid.org/0000-0002-4963-8422"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zongcheng Ji","raw_affiliation_strings":["PingAn Technology"],"raw_orcid":"https://orcid.org/0000-0002-4963-8422","affiliations":[{"raw_affiliation_string":"PingAn Technology","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100354105","display_name":"Hongliang Liang","orcid":"https://orcid.org/0000-0001-6877-780X"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hongliang Liang","raw_affiliation_strings":["Beijing University of Posts and Telecommunications"],"raw_orcid":"https://orcid.org/0000-0001-6877-780X","affiliations":[{"raw_affiliation_string":"Beijing University of Posts and Telecommunications","institution_ids":["https://openalex.org/I139759216"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":2645,"currency":"USD","value_usd":2645},"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.06169715,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"52","issue":"7","first_page":"2204","last_page":"2218"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.26080000400543213,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.26080000400543213,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.22499999403953552,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.13760000467300415,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.5555999875068665},{"id":"https://openalex.org/keywords/control-flow-graph","display_name":"Control flow graph","score":0.5206000208854675},{"id":"https://openalex.org/keywords/security-token","display_name":"Security token","score":0.5115000009536743},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.439300000667572},{"id":"https://openalex.org/keywords/transformer","display_name":"Transformer","score":0.42660000920295715},{"id":"https://openalex.org/keywords/vulnerability-assessment","display_name":"Vulnerability assessment","score":0.4226999878883362},{"id":"https://openalex.org/keywords/static-analysis","display_name":"Static analysis","score":0.41749998927116394},{"id":"https://openalex.org/keywords/dependency-graph","display_name":"Dependency graph","score":0.38749998807907104},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.3723999857902527}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8705000281333923},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.5555999875068665},{"id":"https://openalex.org/C27458966","wikidata":"https://www.wikidata.org/wiki/Q1187693","display_name":"Control flow graph","level":2,"score":0.5206000208854675},{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.5115000009536743},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.439300000667572},{"id":"https://openalex.org/C66322947","wikidata":"https://www.wikidata.org/wiki/Q11658","display_name":"Transformer","level":3,"score":0.42660000920295715},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.4226999878883362},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.41749998927116394},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.3950999975204468},{"id":"https://openalex.org/C16311509","wikidata":"https://www.wikidata.org/wiki/Q4148050","display_name":"Dependency graph","level":3,"score":0.38749998807907104},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.3723999857902527},{"id":"https://openalex.org/C113775141","wikidata":"https://www.wikidata.org/wiki/Q428691","display_name":"Computer engineering","level":1,"score":0.3700999915599823},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.3698999881744385},{"id":"https://openalex.org/C19768560","wikidata":"https://www.wikidata.org/wiki/Q320727","display_name":"Dependency (UML)","level":2,"score":0.35850000381469727},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.352400004863739},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.3522999882698059},{"id":"https://openalex.org/C160191386","wikidata":"https://www.wikidata.org/wiki/Q868299","display_name":"Control flow","level":2,"score":0.3504999876022339},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3416000008583069},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.33660000562667847},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.33329999446868896},{"id":"https://openalex.org/C177774035","wikidata":"https://www.wikidata.org/wiki/Q1246948","display_name":"Granularity","level":2,"score":0.32330000400543213},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.31459999084472656},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.3127000033855438},{"id":"https://openalex.org/C2779639559","wikidata":"https://www.wikidata.org/wiki/Q7661178","display_name":"Symbolic execution","level":3,"score":0.3041999936103821},{"id":"https://openalex.org/C88468194","wikidata":"https://www.wikidata.org/wiki/Q1172416","display_name":"Data-flow analysis","level":3,"score":0.2996000051498413},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.2912999987602234},{"id":"https://openalex.org/C177148314","wikidata":"https://www.wikidata.org/wiki/Q170084","display_name":"Generalization","level":2,"score":0.2849000096321106},{"id":"https://openalex.org/C199519371","wikidata":"https://www.wikidata.org/wiki/Q942695","display_name":"Source lines of code","level":3,"score":0.2824000120162964},{"id":"https://openalex.org/C115168132","wikidata":"https://www.wikidata.org/wiki/Q55813","display_name":"Machine code","level":3,"score":0.2782999873161316},{"id":"https://openalex.org/C133162039","wikidata":"https://www.wikidata.org/wiki/Q1061077","display_name":"Code generation","level":3,"score":0.2782999873161316},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.26409998536109924},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.262800008058548}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tse.2026.3659630","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tse.2026.3659630","pdf_url":null,"source":{"id":"https://openalex.org/S8351582","display_name":"IEEE Transactions on Software Engineering","issn_l":"0098-5589","issn":["0098-5589","1939-3520","2326-3881"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Software Engineering","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.6253132224082947,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[{"id":"https://openalex.org/G6273303709","display_name":null,"funder_award_id":"62102043","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":31,"referenced_works":["https://openalex.org/W2122312154","https://openalex.org/W2130758759","https://openalex.org/W2171295941","https://openalex.org/W2618530766","https://openalex.org/W2766540688","https://openalex.org/W2894151403","https://openalex.org/W2896457183","https://openalex.org/W2962960733","https://openalex.org/W2976184969","https://openalex.org/W3017889767","https://openalex.org/W3091588759","https://openalex.org/W3107087963","https://openalex.org/W3152524748","https://openalex.org/W3166095789","https://openalex.org/W3172606155","https://openalex.org/W3177116043","https://openalex.org/W4200154784","https://openalex.org/W4221033043","https://openalex.org/W4221166942","https://openalex.org/W4312436517","https://openalex.org/W4312690534","https://openalex.org/W4385080325","https://openalex.org/W4385245566","https://openalex.org/W4389158729","https://openalex.org/W4389161980","https://openalex.org/W4391558363","https://openalex.org/W4393029443","https://openalex.org/W4394769313","https://openalex.org/W4394769550","https://openalex.org/W4399851298","https://openalex.org/W4407152789"],"related_works":[],"abstract_inverted_index":{"Deep":[0],"learning-based":[1],"vulnerability":[2,46],"detection":[3],"has":[4],"made":[5],"significant":[6],"strides,":[7],"surpassing":[8,138],"traditional":[9],"static":[10],"and":[11,23,62,65,78,98,113,129,145,152],"dynamic":[12],"analysis":[13],"methods.":[14],"However,":[15],"existing":[16],"approaches,":[17],"including":[18,94],"Graph":[19],"Neural":[20],"Networks":[21],"(GNNs)":[22],"Transformer-based":[24,114],"models,":[25,115],"still":[26],"struggle":[27],"to":[28,83],"fully":[29],"capture":[30],"complex":[31],"code":[32],"semantics.":[33],"In":[34],"this":[35],"paper,":[36],"we":[37],"proposeCosFormer,":[38],"a":[39,95,124,130],"novel":[40],"Code":[41,51],"Semantic-aware":[42,52],"Transformer":[43],"tailored":[44],"for":[45],"detection.CosFormerintroduces":[47],"two":[48],"key":[49],"components:":[50],"Embedding,":[53],"which":[54,69],"enhances":[55],"semantic":[56],"representation":[57],"at":[58],"both":[59],"the":[60,103],"token":[61],"line":[63],"levels,":[64],"Spatial":[66],"Dependency-aware":[67],"Encoding,":[68],"integrates":[70],"structural":[71],"dependencies":[72],"from":[73],"Control":[74],"Flow":[75],"Graphs":[76,81],"(CFGs)":[77],"Program":[79],"Dependency":[80],"(PDGs)":[82],"guide":[84],"attention":[85],"toward":[86],"vulnerability-relevant":[87],"code.":[88],"We":[89],"evaluateCosFormeron":[90],"four":[91],"benchmark":[92],"datasets,":[93],"real-world":[96],"dataset,":[97],"demonstrate":[99],"its":[100],"superior":[101],"performance.CosFormerachieves":[102],"highest":[104],"F1":[105,126,132],"scores":[106],"across":[107,150],"all":[108,139],"tasks,":[109],"outperforming":[110],"state-of-the-art":[111],"GNN-based":[112],"as":[116,118],"well":[117],"large":[119],"language":[120],"models":[121],"(LLMs).":[122],"Notably,CosFormerachieves":[123],"Cross":[125],"of":[127,133],"69.37":[128],"Mixed":[131],"58.42":[134],"in":[135,147],"generalization":[136],"evaluation,":[137],"baselines.":[140],"These":[141],"results":[142],"highlightCosFormer\u2019s":[143],"effectiveness":[144],"robustness":[146],"detecting":[148],"vulnerabilities":[149],"diverse":[151],"previously":[153],"unseen":[154],"codebases.":[155]},"counts_by_year":[],"updated_date":"2026-08-21T09:56:20.448147","created_date":"2026-02-01T00:00:00"}