Can your coding style predict whether your code is vulnerable?
University of Massachusetts Dartmouth researchers present VulStyle, a stylometry-based vulnerability detector that also exposes benchmark reliability problems.
VulStyle combines stylometric features with syntax-tree structure and source tokens, pre-trained on about 4.9 million functions across seven programming languages and fine-tuned on five vulnerability detection datasets. It beat token-only detectors on some benchmarks but its F1 drops sharply on DiverseVul, which the authors link to noisy labels inflating reported performance across popular datasets. The authors argue style-aware detection should be harder to evade but did not test this empirically, and they note that uniform LLM-generated code may strip away the individual developer style the model depends on.
- VulStyle adds stylometric features such as expression types, declaration patterns, and statement structures to token- and structure-based detection.
- Pre-trained on roughly 4.9 million functions across seven languages, then fine-tuned on five vulnerability benchmarks.
- Inconsistent buffer handling, mixed naming, and irregular pointer use correlate with memory-corruption class bugs in C and C++.
- Benchmark scores vary widely across datasets, suggesting headline accuracy often reflects dataset construction more than detection capability.
- Stylometric signals collapse on templated or auto-generated code as LLM-assisted development spreads.
- Products
- VulStyleDiverseVul
- Organizations
- University of Massachusetts Dartmouth
From the original article
3 min read at helpnetsecurity.com
Developers leave fingerprints in the code they write. Naming choices, indentation patterns, preferred APIs, and the way someone structures a loop or handles a pointer all carry traces of individual habit. Researchers have used these stylistic signals for years to identify the authors of anonymous code samples, sometimes with surprising accuracy.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.