Cyber-JEV improves vulnerability detection in source code with fine-tuned language models
Cyber-JEV: Matched Contrastive Fine-Tuning of Language Models for Fast Source-Code Vulnerability Triage
Cryptography and Security
Summary
Finding software vulnerabilities is hard because data on both vulnerable and safe code is limited. The authors developed Cyber-JEV, a method that teaches a language model to compare vulnerable code with its fixed version and similar unchanged code. This helps the model better spot risky code changes by learning from real code fixes. Their tests show it ranks vulnerable code more accurately than previous methods, helping security teams prioritize reviews more effectively.
What this means in practice
- •For security review teams: Prioritize code functions for security inspection by scoring and ranking vulnerabilities more accurately with Cyber-JEV fine-tuned models.
- •For software quality assurance teams: Use vulnerability scores from Cyber-JEV to order changed functions in pull requests or releases for focused security assessments.
Authors
Zhuyi Zhao, Shengjie Yuan, Shengyu Wang, Kang Wei, Wang Yang, Wenchao Xu, Fushuo Huo
Abstract
Single-pass scoring models such as Jev give each code function a vulnerability probability, so that security teams can rank many functions for review without generating written explanations. Training an open-weight model for this task is limited by data. Benchmarks with both vulnerable and non-vulnerable labels keep few vulnerable functions once examples related to the test data are removed, while larger public vulnerability records mostly contain vulnerable functions only. Mixing the two lets the data source predict the label, and training on the labeled data alone leaves a model that often scores a fixed function above its vulnerable original. We present Cyber-JEV, a fine-tuning method that uses fix commits to turn these records into comparison groups. Each group holds a vulnerable function, its patched version and up to two unchanged functions from the same file, so the model sees the change that removed a recorded defect. One shared model learns two tasks: classifying functions from the labeled reference data, and ranking the vulnerable function above the other members of its group. At test time the input is one function and the output is a vulnerability score. On a test benchmark of 7,270 functions, an ensemble of five fine-tuned Qwen3.5-4B models reaches an area under the receiver operating characteristic curve of 0.814, compared with 0.743 for Jev 1.13. With the 4,031 alerts of Jev as the review budget, it misses 16 of 322 vulnerable functions instead of 39. Compared with training on the reference data alone, it ranks the vulnerable version above the patched version 14.8 to 29.2 percentage points more often on three sets of real fixes. Such scores can order the changed functions of a pull request or a release for review under a fixed budget.