TraceVIC: Causal Reasoning over Code Evolution for Identifying Vulnerability-Inducing Commits

Paper recorded by Signals 4 on 2026-09-22 in cs.AI. Abstract reproduced from arXiv; link to the original below.

Published 2026-09-22 on arXiv · recorded by Signals 4 on 2026-09-23

Category: cs.AI · 人工智能 · first seen 2026-09-23

Abstract

Software vulnerabilities are often discovered long after they are introduced, making it difficult to identify the vulnerability-inducing commit (VIC) responsible for introducing the underlying vulnerable condition. Existing VIC identification techniques largely rely on git blame to trace vulnerable code through revision history and use positional heuristics, such as selecting its earliest or most

Read on arXiv →