<scp>KDSA</scp> ‐ <scp>VD</scp> : Optimizing Cross‐Project Vulnerability Detection Through Dual‐Driven Fusion of Knowledge Distillation and Structural Alignment

ABSTRACT Supervised deep learning techniques have demonstrated potential for software vulnerability detection, yet their practical deployment is often constrained by the limited availability of high‐quality labelled data. Cross‐project vulnerability detection seeks to overcome this constraint by enabling knowledge transfer from labelled source projects to target projects with insufficient labels. Nevertheless, existing studies fail to fully leverage the discriminative knowledge of source‐domain models and overlook cross‐project local semantic inconsistencies. To tackle these issues, we propose KDSA‐VD, a cross‐project vulnerability detection approach that employs a dual‐driven fusion of knowledge distillation and structural alignment. Built on CodeBERT for code representation learning, the proposed method first acquires discriminative features through supervised training on source projects. It then enhances cross‐domain adaptation by integrating soft‐label distillation, consistency regularization, and structural alignment to better exploit unlabelled target‐project data. Experimental results on 12 cross‐project vulnerability detection tasks indicate that KDSA‐VD outperforms existing baseline methods in most settings and exhibits stable performance under varying target‐domain labelling conditions.