Transfer learning framework detects software vulnerabilities across programming languages

Deep learning models have become a common tool for hunting security flaws in source code, but they tend to stumble when moved from one programming language or codebase to another. A research team now reports a framework designed to ease that transition, describing a system called TL-CDVD that applies transfer learning techniques to cross-domain vulnerability detection. In their evaluation, the approach achieved an average accuracy of 88.8 percent and an F1-score of 65.2 percent on multi-language vulnerability benchmarks covering C, Java and PHP, along with an average AUC of 87.2 percent and precision of 84.9 percent on production-grade software datasets including FFmpeg, LibTIFF, LibPNG and VLC.

The work, published in the journal Cluster Computing, addresses a persistent weakness in automated vulnerability detection: the same underlying security flaw can surface in very different syntactic forms depending on the language or the practical implementation involved. According to the authors, current deep learning-based vulnerability detection systems struggle to adapt across these settings, and applying a model trained in one domain to another often produces negative transfer, a situation in which knowledge carried over from the source domain actively hurts performance rather than helping it.

TL-CDVD is built as a dual cross-domain vulnerability detection framework that employs knowledge transfer techniques, and its design rests on two stated intuitions. The first acknowledges that not all source samples are equally useful when a model is being adapted to a new domain. To handle that imbalance, the researchers designed a TrAdaBoost-derived neural architecture that iteratively adapts sample weighting, gradually emphasizing the transferable instances whose patterns are likely to carry over to the target domain while down-weighting those that do not.

The second intuition concerns what remains after that filtering step. Even once unhelpful samples have been de-emphasized, a global mismatch can persist between the statistical structure of the two domains. To mitigate this, the team proposed an adversarial architecture that maps data from both domains into a shared feature space. Within that space, a discriminator attempts to distinguish which domain a given representation came from, while the feature extractor is trained adversarially against it, encouraging the extractor to learn domain-invariant representations that look alike regardless of origin.

Together, the authors write, this cross-domain representation learning is what enables TL-CDVD to perform across heterogeneous settings. The reported figures come from two distinct groups of evaluation data. The multi-language benchmarks spanned C, Java and PHP, testing whether the framework could bridge differences between programming languages, while the production-grade software datasets drew on widely used projects such as FFmpeg, LibTIFF, LibPNG and VLC, testing performance on real-world code. The authors characterize these results as empirical evidence for the effectiveness of TL-CDVD under the evaluated cross-domain vulnerability detection settings.

The reported evaluation offers a snapshot of performance under specific conditions rather than a guarantee of general performance. The authors state that the results provide empirical evidence for the effectiveness of TL-CDVD under the evaluated cross-domain vulnerability detection settings, and the published abstract does not report results beyond those benchmarks and datasets. As with any machine learning approach to security, performance on the tested C, Java and PHP benchmarks and the FFmpeg, LibTIFF, LibPNG and VLC datasets does not by itself establish how the framework would behave on other languages, other projects or previously unseen vulnerability types.

What the study does establish is a documented approach to a problem that has limited the practical reach of deep learning-based vulnerability detection. By explicitly designing for the case where vulnerability semantics appear in distinct syntactic forms across domains, and by reporting measurable results on both multi-language benchmarks and production-grade software, the researchers provide a concrete data point for the ongoing effort to build code analysis tools that generalize beyond the domain in which they were trained.

Subject of Research: A dual transfer learning framework called TL-CDVD for detecting source code vulnerabilities across programming languages and real-world software projects.

Article Title: TL-CDVD: leveraging transfer learning for cross-domain source code vulnerability detection

Article References: Zhang, X., Liu, C., Guo, M., Zhang, Y., Chen, Z., & Zhou, B. (2026). TL-CDVD: leveraging transfer learning for cross-domain source code vulnerability detection. Cluster Computing, 29(16), Article 926. https://doi.org/10.1007/s10586-026-06720-7

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06720-7

Keywords: software vulnerability detection, transfer learning, deep learning, adversarial training, cross-domain learning, source code analysis, negative transfer, machine learning, cybersecurity, code security, TL-CDVD, neural networks