@inproceedings{du-etal-2026-refinement,
title = "Refinement-Integrated Reasoning Elicits Better Generalization of {LLM}-Based Code Vulnerability Detection",
author = "Du, Xianda and
Ke, Pei and
Hu, Enping and
Li, Guannan and
Guo, Jinyu and
Qin, Ke",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {EMNLP} 2026",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.findings-emnlp.1933/",
pages = "41215--41233",
ISBN = "979-8-89176-462-0",
abstract = "Existing code vulnerability detection (CVD) methods face severe challenges in terms of generalization. Most of these methods directly map the source code to a binary vulnerability label or a vulnerability explanation, struggling to capture the deep features within the complex relationship between them. Thus, these works fail to generalize to out-of-distribution data well. To address this issue, we propose a simple yet effective training framework called refinement-integrated reasoning (RIRE), leveraging refinements that indicate the patched code in the CVD task. Firstly, RIRE introduces the refinement as a guiding signal to help LLMs synthesize reasoning chains as explanations, which align with the vulnerability label, and uses these data for supervised fine-tuning. Secondly, refinement is utilized through a hierarchical preference optimization framework to help determine which reasoning-enhanced detection result is of higher quality, further mining essential features for fine-grained distinguishability and detection capability. Experimental results across five benchmark datasets demonstrate that our proposed RIRE framework achieves superior performance over strong baselines, especially being more generalizable to unseen datasets during training."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="du-etal-2026-refinement">
<titleInfo>
<title>Refinement-Integrated Reasoning Elicits Better Generalization of LLM-Based Code Vulnerability Detection</title>
</titleInfo>
<name type="personal">
<namePart type="given">Xianda</namePart>
<namePart type="family">Du</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Pei</namePart>
<namePart type="family">Ke</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Enping</namePart>
<namePart type="family">Hu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Guannan</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jinyu</namePart>
<namePart type="family">Guo</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ke</namePart>
<namePart type="family">Qin</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-462-0</identifier>
</relatedItem>
<abstract>Existing code vulnerability detection (CVD) methods face severe challenges in terms of generalization. Most of these methods directly map the source code to a binary vulnerability label or a vulnerability explanation, struggling to capture the deep features within the complex relationship between them. Thus, these works fail to generalize to out-of-distribution data well. To address this issue, we propose a simple yet effective training framework called refinement-integrated reasoning (RIRE), leveraging refinements that indicate the patched code in the CVD task. Firstly, RIRE introduces the refinement as a guiding signal to help LLMs synthesize reasoning chains as explanations, which align with the vulnerability label, and uses these data for supervised fine-tuning. Secondly, refinement is utilized through a hierarchical preference optimization framework to help determine which reasoning-enhanced detection result is of higher quality, further mining essential features for fine-grained distinguishability and detection capability. Experimental results across five benchmark datasets demonstrate that our proposed RIRE framework achieves superior performance over strong baselines, especially being more generalizable to unseen datasets during training.</abstract>
<identifier type="citekey">du-etal-2026-refinement</identifier>
<location>
<url>https://aclanthology.org/2026.findings-emnlp.1933/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>41215</start>
<end>41233</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T Refinement-Integrated Reasoning Elicits Better Generalization of LLM-Based Code Vulnerability Detection
%A Du, Xianda
%A Ke, Pei
%A Hu, Enping
%A Li, Guannan
%A Guo, Jinyu
%A Qin, Ke
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F du-etal-2026-refinement
%X Existing code vulnerability detection (CVD) methods face severe challenges in terms of generalization. Most of these methods directly map the source code to a binary vulnerability label or a vulnerability explanation, struggling to capture the deep features within the complex relationship between them. Thus, these works fail to generalize to out-of-distribution data well. To address this issue, we propose a simple yet effective training framework called refinement-integrated reasoning (RIRE), leveraging refinements that indicate the patched code in the CVD task. Firstly, RIRE introduces the refinement as a guiding signal to help LLMs synthesize reasoning chains as explanations, which align with the vulnerability label, and uses these data for supervised fine-tuning. Secondly, refinement is utilized through a hierarchical preference optimization framework to help determine which reasoning-enhanced detection result is of higher quality, further mining essential features for fine-grained distinguishability and detection capability. Experimental results across five benchmark datasets demonstrate that our proposed RIRE framework achieves superior performance over strong baselines, especially being more generalizable to unseen datasets during training.
%U https://aclanthology.org/2026.findings-emnlp.1933/
%P 41215-41233
Markdown (Informal)
[Refinement-Integrated Reasoning Elicits Better Generalization of LLM-Based Code Vulnerability Detection](https://aclanthology.org/2026.findings-emnlp.1933/) (Du et al., Findings 2026)
ACL