Abstract:The diversity and complexity of software code make vulnerability detection a pressing challenge. The contextual semantics of vulnerability features are difficult to capture using static rules, and large-scale training data are scarce. However, large code models, leveraging their extensive pre-trained knowledge, have emerged as an effective approach to address this issue. This study proposes a vulnerability detection multi-task fine-tuning method based on causal relationships, VulDet. The key idea is to integrate causal relationships across the entire vulnerability detection process, including vulnerability understanding, identification, analysis, and remediation, in order to construct a multi-task fine-tuning framework that injects vulnerability domain knowledge into the model from multiple dimensions and enhances its detection capability. Specifically, this method decomposes vulnerability domain knowledge based on authoritative databases such as CWE and CVE, designs causally progressive fine-tuning tasks covering vulnerability definition understanding, feature identification, cause analysis, and code remediation, and adopts equal-weight joint training to achieve effective integration of multi-dimensional domain knowledge. Experimental results on public datasets show that the proposed method outperforms mainstream baseline models, significantly improving the accuracy and reliability of vulnerability detection, thus validating the effectiveness of the proposed method.