# Structure-Enhanced Prompt Learning for Graph-Based Code Vulnerability Detection
## 3 Methodology
### Solution Overview  
As depicted in Figure 3, our methodology is architecturally divided into three critical phases: code feature construction, structure-enhanced prompt and vulnerability detection.  
In the code feature construction phase, we first normalize the source code of the target function. Using advanced static analysis techniques, we construct the CPGs to encapsulate the behavior of the function. Subsequently, we perform a preorder traversal of the CPG, merging leaf nodes with Abstract Syntax Tree (AST) attributes into syntactically meaningful subwords. These subwords are then embedded using a pretrained language model. To extract both syntactic and semantic information between subwords, we employ a TextCNN as the core component of the statement encoder. Additionally, we utilize Graph Convolutional Networks (GCNs) to analyze the structural relationships in the code and capture dependencies between nodes in the property graph. This synergistic combination enables multi-scale vulnerability feature extraction, effectively preserving both fine-grained textual nuances and coarse-grained structural characteristics inherent in source code.  
During the structure-enhanced prompt phase, we introduce a novel graph prompt mechanism derived from text prompts. This mechanism integrates generalized code information and the structures related to the task into the prompts. To achieve this, we leverage graph theory to systematically incorporate task-related knowledge into the prompt generation process. A graphon is a continuous, measurable function \(W:[0,1]\times[0,1]\rightarrow[0,1]\), defined on the unit square, which describes the probability of an edge existing between any two vertices in a graph \(G\) with an infinite number of nodes. Here, \(W(x,y)\) denotes the probability of an edge between two vertices corresponding to coordinates \(x\) and \(y\) in \(G\). The function satisfies non-negativity, \(0\leq W(x,y)\leq 1\), and symmetry, \(W(x,y)=W(y,x)\), indicating that the probability of an edge between \(x\) and \(y\) is identical to that between \(y\) and \(x\). Graphons effectively model the complexity and randomness of  
Figure 3: Overview of our approach.  
real-world networks, facilitating a deeper understanding of graph formation processes. This insight guides the generation of graph structures, allowing us to extract knowledge from graph data in downstream tasks by estimating graphons. We then utilize these estimated graphons to generate graph-level prompts enriched with task-related knowledge. Furthermore, we incorporate the corresponding text prompts to refine and optimize the generated graph prompts, enhancing their adaptability to downstream tasks.  
In the final stage, we align the embedding spaces of the code and the prompts to enhance vulnerability detection. We employ a joint loss function, combining Triplet Loss and Cross-Entropy Loss, to optimize model parameters. During training, we compute the cosine similarity between paired embeddings and minimize the prediction error using Cross-Entropy loss based on class labels. Simultaneously, we construct triplets consisting of an anchor (a code sample), a positive sample (a prompt representing a vulnerability) and a negative sample (a prompt corresponding to non-vulnerability). The training objective is to reduce the latent space distance between the anchor and the positive sample while increasing the distance between the anchor and the negative sample. By leveraging a joint learning paradigm, the model effectively captures discriminative relationships between code semantics and vulnerability patterns, enabling accurate vulnerability classification through cross-modal feature alignment.  
In the sections that follow, we provide an in-depth examination of the essential components that constitute our methodology.