Explainable multi-task transformer-based framework for cross-language source code vulnerability detection with auxiliary CWE and language classification

Software vulnerabilities pose a critical risk to modern cybersecurity infrastructure, yet existing detection methods struggle across diverse programming languages and vulnerability types. We propose the Vulnerability Encoder with Graph Augmentation (VEGA), a lightweight dual-stream architecture that jointly models lexical token sequences and typed structural graphs through iterative cross-modal attention, dynamic semantic edge scoring, and supervised contrastive loss for fine-grained CWE discrimination. Alongside VEGA, we conduct a rigorous controlled evaluation of seven transformer-based models, including CodeBERT, GraphCodeBERT, UniXcoder, VulBERTa, PLBART, CodeT5+, and PolyCoder-160M, within a unified four-stage framework incorporating Bayesian hyperparameter optimization, gradual unfreezing, and mixed-precision training on 157,430 function-level code samples across eight programming languages. Ablation experiments confirm that VEGA's graph stream and contrastive loss each contribute meaningfully to multi-task performance. A systematic imbalance analysis reveals strong correlations between sample frequency and per-class F1, explaining performance gaps across rare vulnerability types and minority languages. Among the evaluated models, the UniXcoder achieves the highest binary F1 of 88.98% and the CWE macro-F1 of 50.23%, which is statistically confirmed via McNemar's test (p < 0.05), while VEGA achieves the fastest inference speed of 812.80 samples/s. LIME analysis of 1,000 stratified samples exposes model-specific detection patterns to guide practical deployment decisions.