An Uncertainty-Aware Adaptive Hybrid Framework for Robust Source Code Vulnerability Detection

Abstract

: Source code vulnerability detection is important for improving software security and reliability. Pre-trained code representation models, such as CodeBERT and GraphCodeBERT, have improved vulnerability detection by learning semantic and structural characteristics from source code. However, existing approaches often rely on fixed fusion strategies or end-to-end architectures, without considering the sample-wise reliability of different representations. This paper proposes an uncertainty-aware adaptive hybrid framework that integrates pretrained code representations, uncertainty estimation, adaptive feature fusion, and machine learning-based classification. CodeBERT and GraphCodeBERT extract complementary semantic and structural embeddings, while uncertainty estimates guide their adaptive fusion before classification using XGBoost or LightGBM. Experiments were conducted on four benchmark datasets, Devign, Big-Vul, Juliet Test Suite, and DiverseVul, with additional cross-project evaluation and multiple independent runs. On the three primary benchmarks, the framework achieves F1-scores of 0.936, 0.898, and 0.972, respectively, with an average F1-score of 0.935 and ROC-AUC of 0.982. It also outperforms traditional machine learning, pretrained code models, and fixed and learned fusion baselines. Cross-project and statistical evaluations further show consistent performance on unseen projects and across independent runs. These results support uncertainty-aware adaptive fusion as an effective approach for combining complementary code representations in vulnerability detection.