How code models rank vulnerabilities but struggle to label them clearly
When Models Know but Can't Linearly Say: Relational Encoding Limits Linear Vulnerability Classification in Code LLMs
Cryptography and SecurityArtificial Intelligence
Summary
Detecting security problems in computer code is important but tricky. The authors found that large language models can tell which code is riskier when comparing two pieces directly, but have trouble clearly marking a single piece as vulnerable or safe using simple methods. This happens because the way the model 'understands' vulnerability is more about relationships between codes, not clear categories. So, these models are better at saying which of two codes is worse than giving a yes-or-no answer about one code at a time.
What this means in practice
- •For software security teams: Rank software patches by relative security risk to guide code review priorities more accurately than yes/no labels.
- •For code analysis tool developers: Design tools that compare code pairs to detect vulnerability risk instead of relying on separate vulnerability labels for individual code samples.
Authors
Rui Melo, Andre Catarino, Claudia Mamede, Corina Pasareanu, Rui Abreu
Abstract
Large language models can detect vulnerable code, yet the form of vulnerability encoding in their representations remains unclear. We analyze 8 code models spanning 6.7B-15B parameters on C programs using three datasets (DELTASECOMMITS, SVEN, and PRECISE-BUGS), comparing two diagnostic tasks on the same representations: identifying what patterns the code instantiates, and determining whether it is vulnerable. Models encode the first with high fidelity. Under the studied paired C-code datasets and linear-probing setup, vulnerability information is more accessible as a paired relational signal-whether code A is riskier than code B-than as a globally separable categorical label. This structural difference has implications for classification: the model reliably ranks which code is riskier but standard classifiers on isolated samples achieve limited accuracy because vulnerable and secure samples form overlapping distributions in representation space.