TraceVIC: Causal Reasoning over Code Evolution for Identifying Vulnerability-Inducing Commits
TraceVIC ranks vulnerability-inducing commits by reasoning over how vulnerable code evolves across revisions.
TraceVIC identifies vulnerability-inducing commits by localizing likely root-cause lines, tracing them through revision history, and ranking commits by their contribution to the vulnerable condition instead of picking the earliest or latest git-blame change. Temporal graph edges preserve correspondences between program elements across consecutive revisions. Ablations show modeling the full history improves F2 from 0.637 to 0.814. The authors report up to a 28.7% F2 gain over prior methods and a valid inducing commit for 78 of 79 vulnerabilities in four unseen C/C++ projects.
- Rejects git-blame earliest-or-latest heuristics for finding inducing commits.
- Temporal graphs connect vulnerability-relevant code across revisions.
- Full-history modeling raises F2 from 0.637 to 0.814.
- A valid inducing commit was found for 78 of 79 cases.
Full article222 words · extracted from arxiv.org · click to collapse
Software vulnerabilities are often discovered long after they are introduced, making it difficult to identify the vulnerability-inducing commit (VIC) responsible for introducing the underlying vulnerable condition. Existing VIC identification techniques largely rely on git blame to trace vulnerable code through revision history and use positional heuristics, such as selecting its earliest or most recent modification. However, the true VIC may occur anywhere within this history, and vulnerable behavior may depend on code that evolves across multiple revisions. We therefore argue that VIC identification requires reasoning about how vulnerability-relevant code evolves, rather than simply where a candidate commit appears in the revision history. We present TraceVIC, a temporal graph-based approach for identifying and ranking VICs by reasoning over code evolution. TraceVIC first localizes likely root-cause lines and traces their histories across revisions, constructing graph representations that capture program structure within each revision and the evolution of vulnerability-relevant code across the history. It reasons over the resulting revision history, using temporal edges to preserve correspondences between program elements across consecutive revisions, and directly ranks candidate commits according to their contribution to the vulnerable condition. Ablation results show that modeling the full revision history improves F2 from 0.637 to 0.814. TraceVIC improves F2 by up to 28.7% over state-of-the-art methods and identifies a valid VIC for 78 of 79 vulnerabilities across four unseen C/C++ projects.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.26711