Automated commit message generation, which aims at generating natural language description from code change, allows developers to focus more on project maintenance and management. To ensure the quality of commit messages, most projects constrain their style and adopt the conventional commit specification. Conventional commit message generation has been significantly benefited from recent progress in Large Language Models (LLMs). However, previous approaches typically rely on only one or two type of information for the generation, ignoring a wide range of context information. Moreover, they often extract the context in a coarse-grained manner, missing critical details.To address this limitation, We propose CCMG, a novel hierarchical context-augmentedConventionalCommitMessageGeneration framework, which incorporates project-agnostic and project-specific context. For project agnostic context, CCMG retrieves and refines the relevant commits to align conventional commit specification from large-scale corpus. For project-specific context, CCMG provides a wide range of software context information from the perspective of project, code, and style. Finally, CCMG designs two-stage prompt strategy to focus on conventional message inference and commit type adaptation. Compared with the state-of-the-art LLM-based approaches (i.e., OMG and OMEGA), experiment results show that CCMG achieves an average improvement of 31.45% based on human evaluation in commit message generation and improves accuracy by 21.00% and F1 score by 20.88% in commit type classification.

Hongbo Zheng, Suyuan Wang, Neeraj Gangwar, Nickvash Kani. Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers). 2025.

Traditional vulnerability detection methods have limitations due to their need for extensive manual labor. Using automated means for vulnerability detection has attracted research interest, especially deep learning, which has achieved remarkable results. Since graphs can better convey the structural feature of code than text, graph neural network (GNN) based vulnerability detection is significantly better than text-based approaches. Therefore, GNN-based vulnerability detection approaches are becoming popular. However, GNN models are close to black boxes for security analysts, so the models cannot provide clear evidence to explain why a code sample is detected as vulnerable or secure. At this stage, many GNN interpreters have been proposed. However, the explanations provided by these interpretations for vulnerability detection models are highly inconsistent and unconvincing to security experts. To address the above issues, we propose principled guidelines to assess the quality of the interpretation approaches for GNN-based vulnerability detectors based on concerns in vulnerability detection, namely, stability, robustness, and effectiveness. We conduct extensive experiments to evaluate the interpretation performance of six famous interpreters (GNN-LRP, DeepLIFT, GradCAM, GNNExplainer, PGExplainer, and SubGraphX) on four vulnerability detectors (DeepWukong, Devign, IVDetect, and Reveal). The experimental results show that the target interpreters achieve poor performance in terms of effectiveness, stability, and robustness. For effectiveness, we find that the instance-independent methods outperform others due to their deep insight into the detection model. In terms of stability, the perturbation-based interpretation methods are more resilient to slight changes in model parameters as they are model-agnostic. For robustness, the instance-independent approaches provide more consistent interpretation results for similar vulnerabilities.