## 2 Related Works  
### Code Vulnerability Detection  
Code vulnerabilities refer to flaws in the design or implementation of a software system that can lead to unexpected or undesired behaviors during execution. Traditional vulnerability detection methods primarily rely on static analysis, dynamic analysis, and handcrafted feature extraction techniques. Static analysis detects potential vulnerabilities by examining the code's structure, syntax, and control flow without executing the program. For example, in 2010, [PERSON] et al. [16] proposed SecureSync, a reproducibility-based method utilizing an extended Abstract Syntax Tree (AST). However, tree-based representations often suffer from high computational complexity, which limits their scalability on large codebases. In 2018, [PERSON] et al. [17] introduced VulPecker, which detects vulnerabilities based on source code similarity. More recently, [PERSON] et al. [18] proposed an enhanced XGBoost model and used the HARSA algorithm to perform defect classification. While static analysis methods are efficient at scanning large volumes of code, they struggle with complex control flows and context-dependent vulnerabilities, often leading to high false-positive and false-negative rates. In contrast, dynamic analysis techniques detect vulnerabilities by monitoring the actual runtime behavior of a program. These methods can capture execution context and real data flows. For instance, Mayhem [19] prioritizes execution paths involving memory accesses using symbolic addresses to uncover exploitable bugs. In 2022, Google's security team introduced LibFuzzer [20], a fuzzing-based tool that identifies bugs by generating a large number of randomized test inputs. Although dynamic analysis can uncover complex runtime vulnerabilities, it is often inefficient due to long execution times and heavy dependence on the testing environment. Moreover, it may fail to cover all execution paths. In recent years, deep learning has driven the development of data-driven vulnerability detection approaches. Among them, GNNs have gained attention due to their ability to model graph structural and semantic relationships in code. In 2018, [PERSON] et al. [6] proposed VulDeePecker, which utilizes a Bidirectional Long Short-Term Memory (BLSTM) network to automatically learn features from source code. Building on this, [PERSON] et al. [21] introduced VGDetector in 2019, which leverages Graph Convolutional Network (GCN) to analyze program slices by converting them into graph structures. This representation enables the model to capture dependencies among code components. GNN-based methods have shown promising results, particularly in detecting complex and deeply embedded vulnerabilities, due to their ability to reason over code structure and data flow. With the advancement of Natural Language Processing (NLP) powered by AI technologies, source code has increasingly been treated as a form of language as well. In 2020, [PERSON] et al. [22] proposed CodeBERT based on the Transformer architecture and introduced a bimodal pre-trained model for programming and natural language. While CodeBERT processes code as a sequence of tokens, it inherently overlooks the structural graph properties of code. To address this limitation, [PERSON] et al. [23] introduced GraphCodeBERT in 2021, which explicitly incorporates structure information such as data flow and syntax trees via a novel data flow edge prediction task during pre-training. This enhancement allows the model to better capture the semantic dependencies. In 2024, [PERSON] [24] proposed a hybrid two-layer framework combining NLP-based techniques with CNN classifiers for software defect detection. Such hybrid models show improved capability in handling large feature spaces and learning intermediate representations. Despite these advances, NLP-based methods still face challenges in handling long-range dependencies and modeling complex control flows.