Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

VulnScout-C: A Lightweight Transformer for C Code Vulnerability Detection

Aymen Lassoued, Nacef Mbarek, Bechir Dardouri, Bassem Ouni, Qing Li, Fakhri Karray

Abstract

Vulnerability detection in C programs is a critical challenge in software security. Although large language models (LLMs) achieve strong detection performance, their multi-billion-parameter scale makes them impractical for integration into development workflows requiring low latency and continuous analysis. We introduce VULNSCOUT-C, a compact transformer architecture with 693M total parameters (353M active during inference), derived from the Qwen model family and optimized for C code vulnerability detection. Alongside the model, we present VULNSCOUT, a new 33,565-sample curated dataset generated through a controlled multi-agent pipeline with formal verification, designed to fill coverage gaps in existing benchmarks across underrepresented CWE categories. Evaluated on a standardized C vulnerability detection benchmark, VULNSCOUT-C outperforms all evaluated baselines, including state-of-the-art reasoning LLMs and commercial static analysis tools, while offering a fraction of their inference cost. These results demonstrate that task-specialized compact architectures can match or even outperform the detection capability of models orders of magnitude larger, making continuous, low-latency vulnerability analysis practical within real-world development workflows.

VulnScout-C: A Lightweight Transformer for C Code Vulnerability Detection

Abstract

Vulnerability detection in C programs is a critical challenge in software security. Although large language models (LLMs) achieve strong detection performance, their multi-billion-parameter scale makes them impractical for integration into development workflows requiring low latency and continuous analysis. We introduce VULNSCOUT-C, a compact transformer architecture with 693M total parameters (353M active during inference), derived from the Qwen model family and optimized for C code vulnerability detection. Alongside the model, we present VULNSCOUT, a new 33,565-sample curated dataset generated through a controlled multi-agent pipeline with formal verification, designed to fill coverage gaps in existing benchmarks across underrepresented CWE categories. Evaluated on a standardized C vulnerability detection benchmark, VULNSCOUT-C outperforms all evaluated baselines, including state-of-the-art reasoning LLMs and commercial static analysis tools, while offering a fraction of their inference cost. These results demonstrate that task-specialized compact architectures can match or even outperform the detection capability of models orders of magnitude larger, making continuous, low-latency vulnerability analysis practical within real-world development workflows.

Paper Structure

This paper contains 60 sections, 16 equations, 2 figures, 8 tables.

Table of Contents

  1. Introduction
  2. Motivation and Challenges
  3. Our Contributions
  4. Paper Organization
  5. Related Work
  6. Traditional Vulnerability Detection Approaches
  7. Machine Learning for Vulnerability Detection
  8. LLMs for Code Security
  9. Vulnerability Detection Datasets
  10. Background
  11. Vulnerability Detection Challenges
  12. Dataset Overview
  13. Juliet Test Suite
  14. SecVulEval Dataset
  15. FormAI-v2 Dataset
  16. ...and 45 more sections

Figures (2)

  • Figure 1: Overview of the multi-agent generation and validation pipeline used to construct the VulnScout dataset.
  • Figure 2: Architecture of VulnScout-C. The model employs a custom transformer architecture with Mixture-of-Experts (MoE) feed-forward layers, Grouped Query Attention (GQA), and Rotary Position Embeddings (RoPE) for vulnerability detection in C code.