Fine-tuned Phi-3.5-mini predicts CVSS and CWE from CVE text
Original title: Predicting CVSS and CWE from CVE Descriptions with Fine-Tuned Small Language Models
It matched official vectors on 48.8% of 36,325 usable 2024 CVEs after training only on 2022 and 2023.
NIST now enriches only high-priority CVEs, so many new entries lack CVSS v3.1 vectors, severity, and CWE. Researchers predict those labels from the description alone, training only on 2022 and 2023 CVEs to limit near-duplicate leakage. A LoRA fine-tune of 3.8B-parameter Phi-3.5-mini beat TF-IDF logistic regression by 2.8 to 4.7 points. Zero-shot Phi-3.5-mini reached 20.8% severity accuracy on a 2,000-CVE sample.
Unconfirmed: Accuracy figures are the authors' results on one pinned NVD snapshot.
- LoRA training finished in 2.5 hours on one Apple M5 Pro.
- Severity accuracy was 69.9% and CWE accuracy was 70.9%.
- Scores are predicted directly or calculated from predicted vectors.
- TF-IDF critical recall rose from 50.7% to 73.3% when scores were derived.
- At least one system matched severity for 75.8% of test CVEs.
- Organizations
- NISTNational Vulnerability Database
- AI models
- Phi-3.5-mini
From the original article
1 min read at arxiv.orgUntil April 2026, the National Vulnerability Database labeled nearly every published Common Vulnerabilities and Exposures (CVE) entry with a Common Vulnerability Scoring System (CVSS) v3. 1 vector, a severity tier, and a Common Weakness Enumeration (CWE) weakness type.
By Tara Dixit · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.