Machine learning × software security

Cyber-JEV.

Learn from the fix.
Focus the review.

Matched contrastive fine-tuning of language models for fast source-code vulnerability triage.

A small change. A useful signal.

A security fixC / C++

−

Before the fixVulnerable

After the fixPatched

Learn to rank the vulnerable version higher. At inference: one function → one score.

Zhuyi Zhao*, Shengjie Yuan*, Shengyu Wang, Kang Wei, Wang Yang, Wenchao Xu, Fushuo Huo

* Equal contribution

@@ Offline evaluation · C/C++ functions @@

Test AUROC

−0.743Jev 1.13

+0.814Cyber-JEV

Five-model ensemble.

−39Jev 1.13

+16Cyber-JEV

Same budget: 4,031 alerts each.

·7,270test functions

·322vulnerable functions

From 57 projects.

The research question

Security archives contain many vulnerable functions, but few matched examples of what changed when the defect was fixed.

The source shortcut
When a data source contributes only vulnerable examples, its formatting and naming conventions can become a shortcut for the label.
The patch sensitivity gap
A model can rank functions well overall while assigning a higher risk score to a repaired function than to its vulnerable original.