Calibration challenges limit reliability of deep code models
Beyond Confidence: Rethinking Uncertainty Calibration in Deep Code Models
Software Engineering
Summary
Deep learning models are used to analyze computer code, but knowing when these models are likely right or wrong is tricky. The authors studied if current ways to measure uncertainty and adjust confidence actually help decide when to trust model predictions or not. They found that these methods don’t always give clear guidance, especially for the most confident predictions, making it hard to skip uncertain cases reliably. This means we need to think differently about how to assess and use model confidence to improve decision-making in code analysis tasks.
What this means in practice
- •For software quality teams: Improve decision processes on when to accept or review automated defect and vulnerability detection outputs by combining calibrated scores with selective prediction metrics.
- •For security operations teams: Better prioritize which code vulnerability warnings to investigate based on calibrated uncertainty measures and predictive risk.
Authors
Ravishka Rathnasuriya, Wei Yang
Abstract
Deep learning models have shown significant promise in code-related tasks. While confidence calibration techniques have been proposed to improve model reliability, their effectiveness in real-world tasks with strict accuracy requirements remains uncertain. In this paper, we investigate two key questions: first, whether existing measurement metrics, including confidence scores and uncertainty metrics, are effective for guiding selective prediction; and second, whether existing calibration techniques can improve these metrics to better identify cases where model predictions are likely to succeed or fail. We conduct a systematic study on defect prediction and vulnerability detection using seven code models, evaluating thirteen uncertainty signals and three widely used post-hoc calibration methods. Our analysis reveals three major findings: (1) even strong uncertainty signals can remain poorly calibrated and provide limited separation at the high-confidence end, constraining selective prediction in practice; (2) standard post-hoc calibrators often improve calibration scores but do not consistently translate into better selective prediction behavior; and (3) commonly used calibration metrics can disagree with selective prediction performance, underscoring the need to evaluate both jointly. Moreover, our findings motivate a decision-oriented view of reliability in deep code models, where calibrated scores must be evaluated together with selective-prediction quality and retained-region risk before they can support accept--defer deployment.