Learning Generalizable Multimodal Representations for Software Vulnerability Detection

arXiv·medium signal

Source code and its accompanying comments encode complementary signals — code captures structural logic while comments capture developer intent — yet most vulnerability detection methods use only code. This paper aligns both modalities into a shared representation space, showing that the combination detects vulnerability patterns that neither modality catches alone. Benchmarked across multiple datasets with generalization to unseen vulnerability types. Actionable for security teams: comments aren't just documentation noise, they carry exploitable signal for automated vulnerability scanners.