Multimodal Fusion for Vulnerability Detection: Integrating Sequence and Graph-Based Analysis with LLM Augmentation

Detecting vulnerabilities in source code remains a challenging task due to the complex and diverse ways security flaws can manifest. This study investigates how to effectively combine sequential code semantics and graph-based structural features for improved vulnerability detection. We hypothesize that the choice of fusion strategy plays a critical role in leveraging the complementary strengths of these two modalities. To address the limitation of labeled data, we employ the CodeQwen2.5-3B-Instruct large language model to generate augmented vulnerable samples, enriching the original PrimeVul dataset. The resulting dataset, MegaVul+, consists of both human-labeled and LLM- augmented functions, formatted in a standardized JSON structure. Our primary research question centers on identifying the most effective strategy for fusing sequential and structural representations of code. We conduct a comparative evaluation of three multimodal fusion techniques: simple concatenation, gated multi-modal units (GMU), and cross-attention mechanisms. Experimental results show that the concatenation-based fusion achieves the best F1-score of 31.34%, outperforming GMU (25.45%), cross-attention (25.72%), the sequence-only model (25.01%), and the graph-only model (16.45%). We hypothesize that this advantage arises from the simplicity of concatenation, which preserves raw information from both modalities without introducing additional complexity or overfitting risks—particularly important in settings with imbalanced or noisy data. These findings highlight the potential of combining diverse code representations and demonstrate the value of LLM-driven data augmentation in improving software vulnerability detection.