An Empirical Study of Automated Vulnerability Localization with Large Language Models
This work systematically evaluates the effectiveness of large language models (LLMs) for line-level vulnerability localization (AVL)—a task lacking comprehensive empirical investigation. Experiments are conducted on BigVul (C/C++) and smart contract vulnerability datasets, covering over ten code-understanding LLMs (60M–16B parameters) spanning encoder-only, encoder-decoder, and decoder-only architectures, under zero-shot, one-shot, discriminative fine-tuning, and generative fine-tuning paradigms. Key contributions include: (1) the first empirical demonstration that discriminative fine-tuning substantially outperforms existing approaches; (2) the proposal of sliding-window context partitioning and right-forward embedding to mitigate context-length limitations; and (3) strong cross-CWE and cross-project generalization, yielding significant improvements in localization accuracy and surpassing state-of-the-art methods.