A Review of Source Code Vulnerability Detection Methods Based on Large Language Models: Models, Techniques, and Evaluation

Abstract

In source code vulnerability detection, large language models (LLMs) are no longer used only as substitutes for traditional fixed classifiers. With prompt design, parameter fine-tuning, and program-context information, they can judge whether code contains vulnerabilities and can also provide suspicious locations and explanatory evidence. This paper takes lightweight code Transformers and large-scale language models as two main lines of discussion. It reviews methods for input construction, task adaptation, the use of program-analysis information, and multi-model collaboration, and compares them in terms of datasets, evaluation metrics, and deployment conditions. Existing studies show that code pretraining, prompt engineering, supervised fine-tuning, and structural-information enhancement can improve detection or explanation results on specific benchmarks. However, such improvements are easily affected by duplicate samples, label noise, random splits, temporal leakage, and changes in model versions, which may lead to overestimated performance. Therefore, model evaluation should not rely on a single metric alone. It should also report the data source, detection granularity, temporal or project-level isolation, false-positive cost, and whether generated explanations can be verified by program evidence. On this basis, this paper further discusses an application approach centered on data governance, strict data splitting, uncertainty calibration, and SAST-LLM-human collaboration. The discussion is limited to source-code-level vulnerability detection, localization, and classification, and does not cover network intrusion detection, malware analysis, smart-contract-specific detection, vulnerability generation, or automatic repair.