Attention Is All You Need for LLM-Based Code Vulnerability Localization

Summary

The paper presents LOVA, a framework that uses the self-attention weights of LLMs to localize vulnerable lines of code. It reports up to a 5.3× improvement in F1-scores over existing LLM-based approaches, and up to a 14.6× improvement in smart contract vulnerability localization across C, Python, Java and Solidity.