InterFuse: Scalable Detection of Memory Safety Violations via Differential Reasoning and Hierarchical Context Fusion
TL;DR
This work proposes InterFuse, a framework for differential path reasoning that builds compact interprocedural control-flow graphs with targeted pruning, samples high-contrast paths via genetic optimization, and uses hierarchical fusion with a lightweight concatenation-based module to enhance discriminative signals.
Abstract
Memory safety vulnerabilities in C/C++ remain a major source of critical CVEs, yet many arise from interprocedural interactions that single-function analysis misses. Traditional static analyzers suffer from path explosion across calls, while heavyweight graph-based approaches incur substantial construction and memory overhead. We observe that many such vulnerabilities manifest as contrasts between execution paths; for example, benign paths may clean up once, whereas vulnerable paths may trigger redundant frees. Based on this insight, we propose InterFuse, a framework for differential path reasoning. InterFuse builds compact interprocedural control-flow graphs with targeted pruning, samples high-contrast paths via genetic optimization, and uses hierarchical fusion with a lightweight concatenation-based module to enhance discriminative signals. Evaluated on three main benchmarks (D2A, MVD, and Juliet) and in a cross-project transfer setting on ReposVul, InterFuse achieves 84.7% F1 on D2A and 75.4% F1 on MVD. The filtered MVD benchmark contains 6,620 interprocedural samples with an average cyclomatic complexity of 12.7. Compared with SnapVuln, InterFuse improves D2A F1 by 4.0 points and reduces graph-construction time by \(11.7\times\) in our experimental environment. It also reaches 97.2% F1 on Juliet and 64.3% F1 on ReposVul using few-shot threshold calibration, without project-specific model retraining.