TraceVIC: Causal Reasoning over Code Evolution for Identifying Vulnerability-Inducing Commits
TraceVIC ranks suspected vulnerability-introducing commits by modeling how relevant code changes across revisions.
The paper argues that `git blame`-style heuristics can miss the real commit because vulnerable behavior may emerge through several edits, not a single line’s position in history. TraceVIC localizes likely root-cause lines, builds temporal graph representations over their revision history, and ranks candidate commits by their contribution to the vulnerable condition. In reported ablations, full-history modeling raised F2 from 0.637 to 0.814. The authors say it improved F2 by up to 28.7% over prior methods and found a valid VIC for 78 of 79 vulnerabilities across four unseen C/C++ projects. ArXiv · AI/CL/LG's note
The paper argues that `git blame`-style heuristics can miss the real commit because vulnerable behavior may emerge through several edits, not a single line’s position in history. TraceVIC localizes likely root-cause lines, builds temporal graph representations over their revision history, and ranks candidate commits by their contribution to the vulnerable condition. In reported ablations, full-history modeling raised F2 from 0.637 to 0.814. The authors say it improved F2 by up to 28.7% over prior methods and found a valid VIC for 78 of 79 vulnerabilities across four unseen C/C++ projects. ArXiv · AI/CL/LG's note
score 4