Attribution-Guided Prompt Optimization for Cross-CWE Vulnerability Detection

Software vulnerability detection plays a critical role in improving software quality, system reliability, and security assurance. Prompt-based adaptation offers a lightweight alternative for vulnerability detection in low-resource Common Weakness Enumeration (CWE) settings, where labeled target-domain data are limited and model fine-tuning can be costly or unstable. This paper proposes an Integrated-Gradient-Guided Prompt Optimization (IGPO) method that uses attribution feedback to guide large language models in revising prompts for low-resource cross-CWE vulnerability detection. IGPO keeps the vulnerability detector fixed, evaluates the current prompt on target validation data, identifies false-positive and false-negative cases, computes Integrated Gradients (IG) for misclassified functions, aggregates token-level attributions into line-level feedback, and uses a large language model to diagnose error patterns and optimize the prompt. Experiments on C/C++ functions from PrimeVul, DiverseVul, and BigVul across 14 CWE categories show that, on positive-transfer source–target pairs, IGPO improves the average F1 score from 0.6780 to 0.7267 and outperforms the zero-shot baseline on 94.97% of them. These results position IGPO as an attribution-informed prompt adaptation framework that improves cross-CWE vulnerability detection without updating the detector, while highlighting the importance of backbone suitability under negative transfer. This method is particularly useful for security researchers and practitioners who need to adapt vulnerability detectors to new CWE categories with limited labeled data.