CodeVulReason: Incentivizing reasoning for code vulnerability detection

This paper introduces CodeVulReason, a unified framework for enhancing the reasoning capabilities of large language models (LLMs) in code vulnerability detection (CVD). To address the scarcity of high-quality chain-of-thought (CoT) supervision, we automatically construct task-specific reasoning data using frontier reasoning models to generate and curate reasoning traces from benchmark datasets, including DiverseVul and MixedVul. We further propose S-LoRA, a parameter-efficient fine-tuning method that optimizes Low-Rank Adaptation (LoRA) rank allocation through a statistically grounded stability-aware importance scoring mechanism. In addition, we integrate S-LoRA with group relative policy optimization (GRPO) to further refine task-specific reasoning behavior. Experimental results show that CodeVulReason achieves state-of-the-art performance on two benchmark datasets, including an accuracy of 0.785 on DiverseVul, while also improving the interpretability of model predictions through explicit reasoning traces.