SOURCE-LINKED INTELLIGENCE

TraceVIC: Causal Reasoning over Code Evolution for Identifying Vulnerability-Inducing Commits

arXiv · AI, language, vision and robotics · article · Sep 22, 2026 · UTC

Software vulnerabilities are often discovered long after they are introduced, making it difficult to identify the vulnerability-inducing commit (VIC) responsible for introducing the underlying vulnerable condition. Existing VIC identification techniques largely rely on git blame to trace vulnerable code through revision history and use positional heuristics, such as selecting its earliest or most recent modification. However, the true VIC may occur anywhere within this history, and vulnerable behavior may depend on code that evolves across multiple revisions. We therefore argue that VIC identi

Read original source ↗ Open in workspace

recordType

paper

region

Global