{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,23]],"date-time":"2026-10-23T23:49:40Z","timestamp":1792799380930,"version":"4.5.0"},"reference-count":52,"publisher":"Association for Computing Machinery (ACM)","issue":"7","funder":[{"name":"Research Grants Council Grant for Theme-based Research Scheme Project","award":["RGC Ref No. T43-513\/23-N"],"award-info":[{"award-number":["RGC Ref No. T43-513\/23-N"]}]},{"name":"National Natural Science Foundation of China under project","award":["62472126"],"award-info":[{"award-number":["62472126"]}],"id":[{"id":"https:\/\/ror.org\/01h0zpd94","id-type":"ROR","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100003453","name":"Natural Science Foundation of Guangdong Province","doi-asserted-by":"crossref","award":["2023A1515011959"],"award-info":[{"award-number":["2023A1515011959"]}],"id":[{"id":"10.13039\/501100003453","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Softw. Eng. Methodol."],"published-print":{"date-parts":[[2026,7,31]]},"abstract":"<jats:p>\n                    Software vulnerability detection has emerged as a significant concern in the field of software security recently, capturing the attention of numerous researchers and developers. Most previous approaches focus on coarse-grained vulnerability detection, such as at the function or file level. However, the developers would still encounter the challenge of manually inspecting a large volume of code inside the vulnerable function to identify the specific vulnerable statements for modification, indicating the importance of vulnerability localization. Training the model for vulnerability localization usually requires ground-truth labels at the statement-level, and labeling vulnerable statements demands expert knowledge, which incurs high costs. Hence, the demand for an approach that eliminates the need for additional labeling at the statement-level is on the rise. To tackle this problem, we propose a novel approach called WAVES for\n                    <jats:italic toggle=\"yes\">W<\/jats:italic>\n                    e\n                    <jats:italic toggle=\"yes\">A<\/jats:italic>\n                    kly supervised\n                    <jats:italic toggle=\"yes\">V<\/jats:italic>\n                    ulnerability Localization via multipl\n                    <jats:italic toggle=\"yes\">E<\/jats:italic>\n                    in\n                    <jats:italic toggle=\"yes\">S<\/jats:italic>\n                    tance learning, which does not need the additional statement-level labels during the training. WAVES has the capability to determine whether a function is vulnerable (i.e., vulnerability detection) and pinpoint the vulnerable statements (i.e., vulnerability localization). Specifically, inspired by the concept of multiple instance learning, WAVES converts the ground-truth label at the function-level into pseudo labels for individual statements, eliminating the need for additional statement-level labeling. These pseudo labels are utilized to train the classifiers for the function-level representation vectors. Extensive experimentation on three popular benchmark datasets demonstrates that, in comparison to previous baselines, our approach achieves comparable performance in vulnerability detection and state-of-the-art performance in statement-level vulnerability localization.\n                  <\/jats:p>","DOI":"10.1145\/3768572","type":"journal-article","created":{"date-parts":[[2025,9,29]],"date-time":"2025-09-29T15:52:22Z","timestamp":1759161142000},"page":"1-31","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["Weakly Supervised Vulnerability Localization via Multiple Instance Learning"],"prefix":"10.1145","volume":"35","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3503-8845","authenticated-orcid":false,"given":"Wenchao","family":"Gu","sequence":"first","affiliation":[{"name":"Department of Computer Science and Engineering, The Chinese University of Hong Kong, Hong Kong, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2720-5896","authenticated-orcid":false,"given":"Yupan","family":"Chen","sequence":"additional","affiliation":[{"name":"Harbin Institute of Technology, Shenzhen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7761-7269","authenticated-orcid":false,"given":"Yanlin","family":"Wang","sequence":"additional","affiliation":[{"name":"Sun Yat-sen University, Zhuhai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3063-9425","authenticated-orcid":false,"given":"Hongyu","family":"Zhang","sequence":"additional","affiliation":[{"name":"Chongqing University, Chongqing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4774-2434","authenticated-orcid":false,"given":"Cuiyun","family":"Gao","sequence":"additional","affiliation":[{"name":"Harbin Institute of Technology, Shenzhen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3666-5798","authenticated-orcid":false,"given":"Michael R.","family":"Lyu","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, The Chinese University of Hong Kong, Hong Kong, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,6,17]]},"reference":[{"key":"e_1_3_1_2_2","unstructured":"20123. 2023. CWE Top 25 Most Dangerous Software Weaknesses. Retrieved from https:\/\/cwe.mitre.org\/top25\/archive\/2023\/2023_top25_list.html"},{"key":"e_1_3_1_3_2","first-page":"561","volume-title":"Advances in Neural Information Processing Systems 15: Neural Information Processing Systems (NIPS \u201902)","author":"Andrews Stuart","year":"2002","unstructured":"Stuart Andrews, Ioannis Tsochantaridis, and Thomas Hofmann. 2002. Support vector machines for multiple-instance learning. In Advances in Neural Information Processing Systems 15: Neural Information Processing Systems (NIPS \u201902). Suzanna Becker, Sebastian Thrun, and Klaus Obermayer (Eds.), MIT Press, 561\u2013568. Retrieved from https:\/\/proceedings.neurips.cc\/paper\/2002\/hash\/3e6260b81898beacda3d16db379ed329-Abstract.html"},{"key":"e_1_3_1_4_2","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2011.194"},{"key":"e_1_3_1_5_2","doi-asserted-by":"publisher","DOI":"10.1145\/3475960.3475985"},{"key":"e_1_3_1_6_2","doi-asserted-by":"publisher","DOI":"10.1016\/J.PATCOG.2017.10.009"},{"key":"e_1_3_1_7_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2021.3087402"},{"key":"e_1_3_1_8_2","doi-asserted-by":"publisher","DOI":"10.1145\/3436877"},{"key":"e_1_3_1_9_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-59722-1_50"},{"key":"e_1_3_1_10_2","unstructured":"Junyoung Chung \u00c7aglar G\u00fcl\u00e7ehre KyungHyun Cho and Yoshua Bengio. 2014. Empirical evaluation of gated recurrent neural networks on sequence modeling. arXiv:1412.3555. Retrieved from http:\/\/arxiv.org\/abs\/1412.3555"},{"key":"e_1_3_1_11_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE48619.2023.00022"},{"key":"e_1_3_1_12_2","unstructured":"Hoa Khanh Dam Truyen Tran Trang Pham Shien Wee Ng John Grundy and Aditya Ghose. 2017. Automatic feature learning for vulnerability prediction. arXiv:1708.02368. Retrieved from http:\/\/arxiv.org\/abs\/1708.02368"},{"key":"e_1_3_1_13_2","doi-asserted-by":"publisher","DOI":"10.1109\/SANER53432.2022.00114"},{"key":"e_1_3_1_14_2","unstructured":"Facebook. 2021. Infer. Retrieved from https:\/\/fbinfer.com\/"},{"key":"e_1_3_1_15_2","doi-asserted-by":"publisher","DOI":"10.1145\/3379597.3387501"},{"key":"e_1_3_1_16_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.findings-emnlp.139"},{"key":"e_1_3_1_17_2","doi-asserted-by":"publisher","DOI":"10.1145\/3524842.3528452"},{"key":"e_1_3_1_18_2","unstructured":"Dan Goodin. 2017. An NSA-Derived Ransomware Worm Is Shutting Down Computers Worldwide. Retrieved from https:\/\/arstechnica.com\/information-technology\/2017\/05\/"},{"key":"e_1_3_1_19_2","doi-asserted-by":"publisher","DOI":"10.18653\/V1\/2022.ACL-LONG.499"},{"key":"e_1_3_1_20_2","volume-title":"9th International Conference on Learning Representations (ICLR \u201921), Virtual Event","author":"Guo Daya","year":"2021","unstructured":"Daya Guo, Shuo Ren, Shuai Lu, Zhangyin Feng, Duyu Tang, Shujie Liu, Long Zhou, Nan Duan, Alexey Svyatkovskiy, Shengyu Fu, et al. 2021. GraphCodeBERT: Pre-training code representations with data flow. In 9th International Conference on Learning Representations (ICLR \u201921), Virtual Event. OpenReview.net. Retrieved from https:\/\/openreview.net\/forum?id=jLoC4ez43PZ"},{"key":"e_1_3_1_21_2","doi-asserted-by":"publisher","DOI":"10.1145\/3524842.3527949"},{"key":"e_1_3_1_22_2","doi-asserted-by":"crossref","unstructured":"Sepp Hochreiter and J\u00fcrgen Schmidhuber. 1997. Long short-term memory. Neural Computation 9 8 (1997) 1735\u20131780.","DOI":"10.1162\/neco.1997.9.8.1735"},{"key":"e_1_3_1_23_2","unstructured":"Israel. 2021. Checkmarx. Retrieved from https:\/\/checkmarx.com\/"},{"key":"e_1_3_1_24_2","doi-asserted-by":"publisher","DOI":"10.1145\/2783258.2783380"},{"key":"e_1_3_1_25_2","first-page":"1106","volume-title":"Advances in Neural Information Processing Systems 25: 26th Annual Conference on Neural Information Processing Systems 2012","author":"Krizhevsky Alex","year":"2012","unstructured":"Alex Krizhevsky, Ilya Sutskever, and Geoffrey E. Hinton. 2012. ImageNet classification with deep convolutional neural networks. In Advances in Neural Information Processing Systems 25: 26th Annual Conference on Neural Information Processing Systems 2012. Peter L. Bartlett, Fernando C. N. Pereira, Christopher J. C. Burges, L\u00e9on Bottou, and Kilian Q. Weinberger (Eds.), 1106\u20131114."},{"key":"e_1_3_1_26_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-86890-1_14"},{"key":"e_1_3_1_27_2","doi-asserted-by":"publisher","DOI":"10.1145\/3468264.3468597"},{"key":"e_1_3_1_28_2","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2021.3051525"},{"key":"e_1_3_1_29_2","unstructured":"Zhen Li Deqing Zou Shouhuai Xu Xinyu Ou Hai Jin Sujuan Wang Zhijun Deng and Yuyi Zhong. 2018. VulDeePecker: A deep learning-based system for vulnerability detection. arXiv:1801.01681. Retrieved from https:\/\/arxiv.org\/abs\/1801.01681"},{"key":"e_1_3_1_30_2","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2018.2858826"},{"key":"e_1_3_1_31_2","unstructured":"Ilya Loshchilov and Frank Hutter. 2017. Fixing weight decay regularization in Adam. arXiv:1711.05101. Retrieved from http:\/\/arxiv.org\/abs\/\/1711.05101"},{"key":"e_1_3_1_32_2","volume-title":"1st International Conference on Learning Representations (ICLR \u201913)","author":"Mikolov Tom\u00e1s","year":"2013","unstructured":"Tom\u00e1s Mikolov, Kai Chen, Greg Corrado, and Jeffrey Dean. 2013. Efficient estimation of word representations in vector space. In 1st International Conference on Learning Representations (ICLR \u201913)."},{"key":"e_1_3_1_33_2","doi-asserted-by":"publisher","DOI":"10.1145\/3510454.3516865"},{"key":"e_1_3_1_34_2","doi-asserted-by":"publisher","DOI":"10.3115\/v1\/d14-1052"},{"key":"e_1_3_1_35_2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298780"},{"key":"e_1_3_1_36_2","doi-asserted-by":"publisher","DOI":"10.1145\/1143844.1143933"},{"key":"e_1_3_1_37_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA.2018.00120"},{"key":"e_1_3_1_38_2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P16-1162"},{"key":"e_1_3_1_39_2","doi-asserted-by":"publisher","DOI":"10.1145\/2892208.2892235"},{"key":"e_1_3_1_40_2","doi-asserted-by":"publisher","DOI":"10.3115\/v1\/P15-1150"},{"key":"e_1_3_1_41_2","unstructured":"Ming Tu Jing Huang Xiaodong He and Bowen Zhou. 2019. Multiple instance learning with graph neural networks. arXiv:1906.04881. Retrieved from http:\/\/arxiv.org\/abs\/1906.04881"},{"key":"e_1_3_1_42_2","first-page":"5998","volume-title":"Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017","author":"Vaswani Ashish","year":"2017","unstructured":"Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Lukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. In Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017. Isabelle Guyon, Ulrike von Luxburg, Samy Bengio, Hanna M. Wallach, Rob Fergus, S. V. N. Vishwanathan, and Roman Garnett (Eds.), 5998\u20136008."},{"key":"e_1_3_1_43_2","volume-title":"6th International Conference on Learning Representations (ICLR \u201918)","author":"Velickovic Petar","year":"2018","unstructured":"Petar Velickovic, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Li\u00f2, and Yoshua Bengio. 2018. Graph attention networks. In 6th International Conference on Learning Representations (ICLR \u201918). Conference Track Proceedings, OpenReview.net."},{"key":"e_1_3_1_44_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2000.898880"},{"key":"e_1_3_1_45_2","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2020.3044773"},{"key":"e_1_3_1_46_2","unstructured":"D. A. Wheeler. 2021. Flawfinder. Retrieved from https:\/\/dwheeler.com\/flawfinder\/"},{"key":"e_1_3_1_47_2","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510229"},{"key":"e_1_3_1_48_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.44"},{"key":"e_1_3_1_49_2","first-page":"662","volume-title":"10th Asian Conference on Machine Learning (ACML \u201918)","volume":"95","author":"Yan Yongluan","year":"2018","unstructured":"Yongluan Yan, Xinggang Wang, Xiaojie Guo, Jiemin Fang, Wenyu Liu, and Junzhou Huang. 2018. Deep multi-instance learning with dynamic pooling. In 10th Asian Conference on Machine Learning (ACML \u201918). Jun Zhu and Ichiro Takeuchi (Eds.), Proceedings of Machine Learning Research, Vol. 95, PMLR, 662\u2013677. Retrieved from http:\/\/proceedings.mlr.press\/v95\/yan18a.html"},{"key":"e_1_3_1_50_2","first-page":"9240","volume-title":"Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019 (NeurIPS \u201919)","author":"Ying Zhitao","year":"2019","unstructured":"Zhitao Ying, Dylan Bourgeois, Jiaxuan You, Marinka Zitnik, and Jure Leskovec. 2019. GNNExplainer: Generating explanations for graph neural networks. In Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019 (NeurIPS \u201919). Hanna M. Wallach, Hugo Larochelle, Alina Beygelzimer, Florence d\u2019Alch\u00e9-Buc, Emily B. Fox, and Roman Garnett (Eds.), 9240\u20139251."},{"key":"e_1_3_1_51_2","doi-asserted-by":"publisher","DOI":"10.1145\/1401890.1402015"},{"key":"e_1_3_1_52_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE-SEIP52600.2021.00020"},{"key":"e_1_3_1_53_2","first-page":"10197","volume-title":"Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019 (NeurIPS \u201919)","author":"Zhou Yaqin","year":"2019","unstructured":"Yaqin Zhou, Shangqing Liu, Jing Kai Siow, Xiaoning Du, and Yang Liu. 2019. Devign: Effective vulnerability identification by learning comprehensive program semantics via graph neural networks. In Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019 (NeurIPS \u201919), 10197\u201310207."}],"container-title":["ACM Transactions on Software Engineering and Methodology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3768572","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,17]],"date-time":"2026-06-17T14:51:19Z","timestamp":1781707879000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3768572"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,17]]},"references-count":52,"journal-issue":{"issue":"7","published-print":{"date-parts":[[2026,7,31]]}},"alternative-id":["10.1145\/3768572"],"URL":"https:\/\/doi.org\/10.1145\/3768572","relation":{},"ISSN":["1049-331X","1557-7392"],"issn-type":[{"value":"1049-331X","type":"print"},{"value":"1557-7392","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,6,17]]},"assertion":[{"value":"2023-07-31","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-09-06","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-06-17","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}