Transfer learning strategies for vulnerability detection in software binaries

Detecting vulnerabilities in closed-source software requires direct analysis of binary code, as source code is typically unavailable for proprietary applications, firmware, and legacy systems. The security community has increasingly adopted transformer-based models from NLP (Natural Language Processing) for this task due to their context-awareness. However, existing approaches mostly focus on similarity detection rather than direct vulnerability classification. We lack clear frameworks for adapting these models to Binary Code Vulnerability Detection (BCVD). To address this gap, this paper investigates transfer learning strategies for optimizing transformers in this domain. Specifically, we assess three adaptation methods: Full Sequence Fine-Tuning, Token-Level Fine-Tuning, and Frozen Feature Extraction across four datasets spanning x86 and ARM architectures, Linux and Windows platforms, and diverse software origins. To enable robust evaluation, we built VulnBin, a heterogeneous benchmark that consolidates these datasets. We further compare code-specialized against general-purpose transformers and benchmark against established BCVD methods. All three strategies achieve similar detection performance, with frozen feature extraction matching the others while using fewer resources. Code-pretrained transformers consistently outperform their text-pretrained counterparts, and context-aware embeddings capture vulnerability semantics better than static representations. When we evaluate across different projects, most configurations still work reasonably well, but we see generalization gaps that random-split benchmarks hide. This points to distribution shift as an under-explored challenge that deserves more attention in BCVD research.