Fine-tuned small AI models better explain security flaws in code
Making Small Code LLMs More Efficient for Secure Code Review with Neuro-Symbolic Fine-Tuning
Software Engineering
Summary
As programmers write more code with AI help, checking for security problems becomes more important. The authors show that by teaching smaller AI code models to explain security warnings from static analysis tools, these models can produce clear, structured explanations that developers can trust. They created a new dataset and method to help models name issues, link warnings to code locations, and assign security flaw types. Their fine-tuned models could accurately relay the analysis results, making secure code review more accessible without sending code to external services.
What this means in practice
- •For software security teams: Use fine-tuned small code models locally to generate clear, verifiable explanations of static analysis alerts during security code reviews.
- •For software development teams: Integrate local AI code assistants that produce structured, evidence-linked security findings to support developers reviewing their own proprietary C/C++ code.
Authors
Mostafijur Rahman Akhond, Mahmuda Khatun, Gias Uddin
Abstract
As AI coding assistants generate more code, the need to review it for security flaws grows. Existing approaches leave a gap: static analyzers identify program sites but offer little explanation, while language-model explanations can be difficult to verify. Small open-weight code models could make security review available without sending proprietary code to a hosted service. We study whether fine-tuning helps these models turn security evidence into explanations that developers and tools can check. We present secSemScan, which pairs a static analyzer with a locally deployable model that writes a schema-constrained security monologue naming program sites, assigning a CWE, and giving a machine-parseable verdict. We also introduce OGSM (Oracle-Grounded Security Monologue), a dataset of 1,993 C/C\texttt{++} functions covering 22 CWEs in the taint and lifetime families. Each record pairs a function with analyzer-derived or fix-diff-derived evidence and a monologue. We fine-tune three open-weight code models in two stages, first on the output format and then on the monologue content. Because evaluation prompts supply the verdict and evidence, our results measure how well models use that information, not whether they detect vulnerabilities independently. On 355 test records, fine-tuning raised Qwen2.5-Coder-7B's verdict accuracy from 4.8\% to 96.6\%; DeepSeek-Coder-6.7B reached 78.9\%, and StarCoder2-7B reached 43.7\%. Qwen2.5-Coder-7B cited 87.5\% of Tier~1 oracle sites, and every line it cited belonged to the oracle evidence. The results suggest that fine-tuning helps small models produce more structured, evidence-linked security reasoning.