Rust is designed to prevent common memory safety issues, yet it remains susceptible to various security vulnerabilities. The limited availability of labeled vulnerability data in Rust presents a significant challenge for applying machine learning (ML) techniques. To address this, we propose TL-HGNN, a novel transfer learning framework that employs heterogeneous graph neural networks (HGNN) and LLMs to detect Rust vulnerabilities without the need for Rust-specific training. TL-HGNN utilizes Inter-procedural Compressed Code Property Graphs (ICCPGs) to represent source code from high-resource languages (C or Java), training HGNN models that capture semantic and structural relationships. Rust code is translated into the source language using an iterative LLM-based approach to ensure correct syntax. The translated code is then converted into an ICCPG representation and analyzed with pre-trained HGNN models. Evaluations on 82 real-world Rust CVE pairs across 44 CWEs indicate that TL-HGNN achieves higher performance than the evaluated baselines on this dataset, achieving an F1 score of 66.24%. Additionally, an ablation study suggests the advantages of ICCPG representation over prior graph methods and the effectiveness of LLM translation over dictionary-based mapping for transfer learning. Our results also indicate that Java serves as a more effective source language than C in this context, and GPT-4.0 achieves higher performance than several other LLMs in translation quality. TL-HGNN represents an early application of transfer learning to Rust vulnerability detection.
Paper
Full text
Detecting Rust Code Vulnerabilities Through Transfer Learning
Semantic Scholar · 2026
Abstract
Rust is designed to prevent common memory safety issues, yet it remains susceptible to various security vulnerabilities. The limited availability of labeled vulnerability data in Rust presents a significant challenge for applying machine learning (ML) techniques. To address this, we propose TL-HGNN, a novel transfer learning framework that employs heterogeneous graph neural networks (HGNN) and LLMs to detect Rust vulnerabilities without the need for Rust-specific training. TL-HGNN utilizes Inter-procedural Compressed Code Property Graphs (ICCPGs) to represent source code from high-resource languages (C or Java), training HGNN models that capture semantic and structural relationships. Rust code is translated into the source language using an iterative LLM-based approach to ensure correct syntax. The translated code is then converted into an ICCPG representation and analyzed with pre-trained HGNN models. Evaluations on 82 real-world Rust CVE pairs across 44 CWEs indicate that TL-HGNN achieves higher performance than the evaluated baselines on this dataset, achieving an F1 score of 66.24%. Additionally, an ablation study suggests the advantages of ICCPG representation over prior graph methods and the effectiveness of LLM translation over dictionary-based mapping for transfer learning. Our results also indicate that Java serves as a more effective source language than C in this context, and GPT-4.0 achieves higher performance than several other LLMs in translation quality. TL-HGNN represents an early application of transfer learning to Rust vulnerability detection.