In this paper, we present CGP-Tuning, a novel code graph-enhanced structure-aware soft prompt tuning method for software vulnerability detection. To address the problem that existing fine-tuning techniques miss the structural information of source code, CGP-Tuning introduces type-aware embeddings that capture rich semantic information (e.g., control/data flow) in the code graph and an efficient cross-modal alignment module that integrates graph-text interactions while achieving linear computational cost. Experimental results on the state-of-the-art open source code LLM and DiverseVul datasets, including CodeLlama, CodeGemma, and Qwen2.5-Coder, show that CGP-Tuning provides model-independent performance improvements while maintaining practical inference speed, outperforming the existing state-of-the-art graph-enhanced soft prompt tuning techniques by 4% on average and the untuned zero-shot prompting by 15%.
