SV-GEN: Synergizing LLM-Empowered Variable Semantics and Graph Transformers for Vulnerability Detection

Deep-learning-based vulnerability detection has made substantial progress, but two limitations remain prominent. Sequence-based methods linearize source code and thus weaken the explicit modeling of control-flow and data-flow dependencies. Graph-based methods preserve program structure, yet conventional graph neural networks still have difficulty capturing long-range interactions in large code property graphs (CPGs). In addition, standard CPGs usually lack explicit variable semantics and security-critical node roles, which limits their ability to represent vulnerability-relevant program behavior. To address these issues, we propose SV-GEN, a vulnerability detection framework that combines large-language-model-driven semantic enhancement with hybrid sequence-graph learning. The novelty of SV-GEN lies in introducing a semantically enriched code property graph, termed Sem-CPG, which augments conventional CPGs with variable semantic roles and security-oriented node labels, and in coupling this representation with an adaptive fusion mechanism over structural and sequential views. Specifically, we use a large language model as an external semantic annotator to assign variable roles and identify source, sink, and sanitizer nodes, and then encode the resulting Sem-CPG with a Graph Transformer while modeling the code sequence with GraphCodeBERT. A learnable gating module is further used to adaptively fuse the graph-level and sequence-level representations for final prediction. Experiments on Devign, ReVeal, and DiverseVul show that SV-GEN achieves competitive or superior overall performance across benchmarks, with particularly strong improvements on the large and highly imbalanced DiverseVul dataset.