Cyber-JEV fine-tuning ranks code vulnerabilities above patches
Original title: Cyber-JEV: Matched Contrastive Fine-Tuning of Language Models for Fast Source-Code Vulnerability Triage
Cyber-JEV uses fix commits to create comparison groups and ensemble Qwen3.5-4B models to rank vulnerable functions 14.8-29.2 percentage points higher than patched versions on real fixes.
Single-pass scoring models like Jev provide vulnerability probabilities for code functions. Training open-weight models is limited by data scarcity in benchmarks. Cyber-JEV mixes labeled and unlabeled records using fix commits to form groups of vulnerable, patched, and unchanged functions. Ensemble of five fine-tuned models achieves 0.814 AUROC on 7,270-function benchmark.
- Ensemble of five Qwen3.5-4B models reaches 0.814 AUROC.
- Ranks vulnerable version above patched version 14.8-29.2 points higher on real fixes.
- With 4,031 alerts budget misses 16 of 322 vulnerable functions.
- Uses comparison groups from fix commits for training.
From the original article
1 min read at arxiv.orgSingle-pass scoring models such as Jev give each code function a vulnerability probability, so that security teams can rank many functions for review without generating written explanations. Training an open-weight model for this task is limited by data.
By Zhuyi Zhao · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.