Pith. sign in

REVIEW 6 major objections 5 minor 3 cited by

Improving LLM Reasoning for Vulnerability Detection via Group Relative Policy Optimization

T0 review · 6 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read GRPO fine-tuning with a dynamic formatting/correctness/reasoning reward makes small language models outperform zero-shot and supervised-fine-tuned models on software vulnerability detection, with gains holding on out-of-distribution code…

desk verdict First GRPO-for-vulnerability-detection paper with a sensible dynamic reward, but the headline GRPO-vs-SFT comparison rests on a checkpoint-selection protocol that needs rework. read the letter →

arxiv 2507.03051 v1 pith:GAI7B573 submitted 2025-07-03 cs.CR cs.AIcs.CL

Marco Simoni , Aleksandar Fontana , Giulio Rossolini , Andrea Saracino This is my paper
classification cs.CRcs.AIcs.CL
keywords GRPOvulnerabilitydetectionlargelanguagemodelsreinforcementlearningfine-tuningrewarddesignsupervisedreasoningcodesecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that Group Relative Policy Optimization (GRPO), a reinforcement-learning fine-tuning method, can turn small instruction-tuned language models into reliable software vulnerability detectors. The authors design a modular reward that scores output formatting, answer correctness, and reasoning coherence, and combine the scores with a dynamic weighting scheme that starts by enforcing format and later shifts weight to correctness, preventing the reward hacking that occurs with static rewards. Across three models and three datasets, the GRPO-trained models consistently outperform both zero-shot prompting and supervised fine-tuning, improving macro F1 by 1–29 points and accuracy by up to 17 points, with the largest gains on recall for non-vulnerable code. The improvements survive distribution shift to unseen code and to programming languages not seen during training, and the models' explanations become shorter and more aligned with official CWE weakness descriptions.

What carries the argument

The load-bearing mechanism is GRPO with the advantage defined as $A_{i,t}=R_i-\bar{R}$ instead of a standardized advantage, combined with a dynamic reward module. For each group of answers to the same prompt, formatting/reasoning ($F_i$) and correctness ($C_i$) sub-rewards are min–max normalized, combined as $r_i=\alpha\hat{F}_i+(1-\alpha)\hat{C}_i$ with $\alpha$ decaying from 0.9 to 0.2 once three consecutive batches average a formatting score above 3, then power-scaled $r_i^{1.5}$ and softmaxed across the group; incoherent explanations receive $R_i=0$. This schedule is what prevents the reward-hacking failure mode of the static 0.5/0.5 sum.

What would settle it

Retrain both GRPO and SFT models and evaluate each at the same relative position in training (for example, the final saved checkpoint), then compare macro F1 on the same test splits; if the GRPO advantage of 1–29 points disappears, the headline claim is an artifact of checkpoint selection.

Watch

Extended reading notes

Core claim

On the paper's terms, the central discovery is that a reward function which does not treat correctness as the only target, but first stabilizes the output format, then gradually increases the weight of correctness while nullifying any answer whose reasoning is incoherent, steers small language models to a balanced vulnerability-detection policy instead of the all-vulnerable collapse seen with a static reward sum. Under this signal, GRPO improves macro F1 over supervised fine-tuning by 1–29 points across all model–dataset combinations, raises accuracy by 4–17 points, and maintains those gains on CleanVul and BigVul when training only on DiverseVul, including on JavaScript, Python, and Java code. The paper also reports that GRPO moves the whole distribution of explanation-to-CWE cosine similarities upward according to a two-sample distribution test, and that it shortens reasoning lengths on correct predictions.

Load-bearing premise

The GRPO models are evaluated at training steps chosen for peak or near-peak reward, while the SFT models are evaluated at the end of a fixed schedule, so the reported GRPO advantage may come from checkpoint selection rather than from the training method itself.

Editorial extensions

If this is right

  • Small, general-purpose language models can serve as practical vulnerability detectors if fine-tuned with GRPO, without the all-vulnerable bias seen in zero-shot LLaMA runs.
  • Security teams get fewer false alarms: GRPO raises recall on non-vulnerable code by over seven times relative to SFT on some reported splits.
  • The gains transfer to programming languages never seen in training (JavaScript, Python, Java), indicating the method favors generalizable reasoning over dataset-specific pattern memorization.
  • GRPO models produce shorter, more CWE-aligned explanations for correct predictions, which matters when humans must audit the model's reasoning.
  • On the in-distribution set, smaller models benefit more from GRPO, while the largest model sometimes retains SFT's memorization advantage on specific CWEs.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the advantage survives an unbiased checkpoint comparison, GRPO-style dynamic rewards could generalize to other structured security classification tasks, such as misconfiguration detection or log-analysis triage, where output format and verdict correctness are both well-defined.
  • The static-reward collapse shows that reward design, not the RL algorithm alone, is what carries the result; varying the coherence threshold or the embedding model used for the reasoning score would test how much of the benefit depends on those choices.
  • Because GRPO training used a reasoning prompt while SFT used a direct verdict prompt, a matched SFT-with-reasoning baseline would separate the contribution of the training method from the contribution of the prompt format.
  • The per-CWE results are mixed on the in-distribution set (e.g., the 8B model drops on some CWEs under GRPO), so aggregate gains do not imply uniform improvement across weakness types; security practitioners should check per-CWE deltas before deployment.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 5 minor

Summary. The paper proposes a GRPO-based fine-tuning approach for vulnerability detection in small language models, using a dynamic reward that combines formatting, correctness, and reasoning sub-rewards. It evaluates LLaMA 8B, LLaMA 3B, and Qwen 2.5 3B on DiverseVul, CleanVul, and BigVul, comparing zero-shot prompts, SFT, and GRPO, and reports that GRPO improves accuracy and macro F1, especially on out-of-distribution data and unseen programming languages. It also includes ablations on KL regularization and an analysis of reasoning alignment via CWE-similarity.

Significance. If the findings hold, the paper provides a concrete recipe for applying GRPO to vulnerability detection and evidence that RL-based reasoning training can improve small-model generalization across languages and vulnerability types. The experimental scope is broad, and the authors explicitly acknowledge the reward-hacking problem and address it with a dynamic weighting mechanism, which is a useful contribution. However, the headline claim of consistent improvement is currently supported by fragile evidence: the GRPO checkpoints are selected at peak rewards, the SFT baseline uses a different prompt format, there are no error bars, and the reasoning-quality metric is unvalidated. No code or data release is mentioned, so reproducibility rests entirely on the hyperparameter and protocol descriptions.

major comments (6)
  1. [Section 4.2] The GRPO evaluation uses checkpoints selected at peak or near-peak training rewards (Section 4.2: 'To avoid policy collapse [30], we chose models at steps with peak or near-peak rewards'), while SFT is evaluated at the final epoch because Table 5 uses 'save strategy epoch' over 2 epochs. The paper reports no final-policy GRPO metrics and applies no equivalent checkpoint-selection rule to SFT. Since the central comparison in Tables 4, 6, and 7 therefore compares an early-stopped GRPO model with a final SFT model, the claimed consistency of the GRPO-over-SFT improvement may reflect the selection rule rather than a property of the training algorithm. Please report GRPO performance at the final training step or apply the same peak-reward selection rule to SFT, and discuss the stability of the final GRPO policy.
  2. [Section 5] The GRPO-vs-SFT comparison is confounded with output format. GRPO models are trained with the reasoning system prompt and a reward that explicitly rewards formatting and reasoning quality (Section 4.1), whereas SFT models are trained with the no-reasoning prompt to output only the verdict (Section 5: 'In SFT, the model is trained to directly predict the final verdict without generating any reasoning'). Consequently, the observed differences can be attributed to the prompt/reasoning objective, not to GRPO as an algorithm. To support the claim that GRPO itself is superior to SFT, add an SFT baseline trained with the reasoning prompt (e.g., teacher-forced reasoning traces) or a GRPO variant without the reasoning reward components, and discuss whether the resulting comparison remains favorable.
  3. [A3 and Table 10(a)] The answer to RQ3 (A3) states that 'GRPO consistently improves overall performance, enhances recall on non vulnerable code, and maintains robustness under distribution shift,' and Section 5.1 says GRPO leads to 'clear improvements over SFT across all models and datasets.' These statements are contradicted by the paper's own Table 10(a): for LLaMA 8B on DiverseVul, the vs-SFT changes are accuracy -0.60%, Not Vulnerable recall -1.9%, vulnerable precision -34.2%, and macro F1 +0.30%. Section 5.3 itself acknowledges 'little to no improvement' and 'small decreases' for LLaMA 8B on DiverseVul. Please revise A3 and the Section 5.1 sentence to state the exceptions explicitly, or correct the numbers if Table 10 is inaccurate.
  4. [Tables 4, 6, 7, 8] All experimental results are point estimates from single runs, with no error bars, standard deviations, or number of seeds reported. Given the stochasticity of LLM fine-tuning and GRPO sampling (temperature 0.9, top-k 50; Table 3), the repeated word 'consistently' is not statistically supported. Please report mean and standard deviation over at least three independent runs, or provide a paired statistical test across runs for the headline GRPO-versus-SFT comparisons.
  5. [Section 6.1] The reasoning-quality evaluation uses cosine similarity (MiniLM-L6-v2) between the model's Step 2 sentence and the official CWE description, but this metric is not validated: there is no human evaluation, no correlation with detection accuracy, and the reward function in Section 4.1 already uses MiniLM-L6-v2 for coherence scoring, so the metric may be partially aligned with the training objective. In addition, Table 8 reports KS tests for only three CWEs while Figure 6's caption says '10 CWE categories,' and the 'Same Distribution? No Yes No' row is unexplained. The claim that GRPO 'pushes the model to reason with concepts that match the real CWE definitions' needs a validated metric or a clearly caveated interpretation.
  6. [Section 4.1, Eqs. (7)-(9)] The dynamic reward function depends on several hand-set parameters: tau_A=0.9, tau_B=0.2, the power-scaling exponent 1.5, the coherence threshold 0.4, and the length-bonus saturation constant 2000, chosen based on 'preliminary experimental exploration.' The only ablation provided is for the KL weight beta (Section 6.2.1). Since the dynamic reward module is the paper's main methodological contribution, please add ablations over at least tau_A and tau_B (and ideally the exponent) to demonstrate that the reported gains do not hinge on a narrow parameter setting.
minor comments (5)
  1. [Section 5.1] The sentence 'Comparing the results of SFT in Table 6 and the results of GRPO in Table 1' should refer to Table 4, not Table 1.
  2. [Table 10] Several percentage changes in Table 10 are computed relative to a zero baseline (e.g., +100% for LLaMA 8B Not Vulnerable Recall vs No Reasoning where the baseline recall is 0.00), which is undefined as a percentage; please report absolute differences or use a distinct notation for undefined values.
  3. [Section 4.2] The sentence 'GRPO consistently achieves superior performance compared to the baseline across all evaluations' is too strong: Table 4 shows Qwen 2.5 on CleanVul with tied accuracy (0.57 vs 0.57) and lower Not Vulnerable F1 (0.56 vs 0.60). Please soften this sentence to match the qualified discussion that follows.
  4. [Section 6.1 / Figure 6] Please harmonize the number of CWEs analyzed: Figure 6's caption mentions '10 CWE categories' while Table 8 and the text discuss only three CWEs, and the 'Same Distribution? No Yes No' row in Table 8 is confusing as printed.
  5. [Eqs. (1)-(2)] The paper states the general GRPO loss with per-token clipped advantages C_i,t in Eq. (1), then simplifies to the response-level advantage (R_i - \bar R) in Eq. (2) without explaining the relationship between token-level and response-level quantities; a one-sentence clarification would help.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the headline GRPO accuracy gains are measured on external datasets, and the CWE-alignment analysis uses external CWE descriptions; the only by-construction element is reward shaping of reasoning length, which the paper presents as a training effect rather than an independent prediction.

full rationale

The central claims of the paper are empirically grounded on external benchmarks. GRPO performance is compared against zero-shot baselines and SFT using held-out test splits of DiverseVul, CleanVul, and BigVul, with labels that are not part of the training reward. The CWE-alignment analysis in Section 6.1 compares model reasoning embeddings against official MITRE CWE descriptions, which are not included in the reward function, so those improvements are not circular. The reasoning-length analysis in Section 6.2 is partly shaped by the reward design: Equation (6) defines a log-scaled length bonus that rewards moderate-length reasoning and discourages overly long outputs, so the observation that GRPO models produce shorter explanations than SFT is an expected consequence of the optimization objective rather than an emergent property. However, the paper does not present this as a first-principles prediction, and the accuracy and CWE-alignment results retain independent content. The only self-citation is reference [10], used to motivate the zero-shot analysis, and it is not load-bearing for the GRPO contribution. The checkpoint-selection asymmetry noted by the skeptic (GRPO models chosen at peak or near-peak rewards while SFT is evaluated at the final epoch) is a legitimate experimental validity concern, but it is not a circularity: the reported metrics are not equal to the training rewards by construction, and the issue concerns comparability rather than self-reference. Overall, the derivation chain does not reduce to its inputs.

Assumptions & free parameters 7 free parameters · 6 assumptions · 0 invented entities

The central claim depends on several hand-set reward parameters (tau_A, tau_B, exponent 1.5, coherence threshold, length saturation) and on unvalidated domain assumptions about label quality and the reasoning-similarity metric. The GRPO algorithm itself is imported from the prior literature. No new physical or conceptual entities are introduced.

free parameters (7)
  • tau_A = 0.9
    Initial formatting reward weight in the dynamic reward module; set based on preliminary experimental exploration (Section 4.1), not ablated.
  • tau_B = 0.2
    Floor for formatting reward weight; same ad hoc selection as tau_A.
  • power_scaling_exponent = 1.5
    Fixed exponent in r^1.5 to reinforce confident predictions; no ablation or justification beyond fixed exponent (Section 4.1).
  • coherence_threshold = 0.4
    Cosine similarity threshold below which an explanation is marked incoherent and the reward is zeroed; hand-set.
  • length_bonus_saturation = 2000 tokens, scale 5/log(2001)
    Constants in Eq. 6 that determine the length bonus curve; arbitrary choices.
  • KL_beta = 1e-6
    KL divergence penalty weight; only two values ablated (1e-4 and 1e-6), no systematic sweep.
  • G (group size) = 12
    Number of sampled answers per prompt in GRPO; fixed without ablation.
assumptions (6)
  • standard math The simplified GRPO loss in Eq. 2 with advantage Ri - Rbar and no clipping approximates the original GRPO
    Invoked in Section 2.1 with a citation to common practice; accepted as a valid approximation.
  • domain assumption DiverseVul, BigVul, and CleanVul labels are reliable ground truth
    Used for training and evaluation in Sections 3-5. CleanVul is an LLM-heuristic generated dataset with 90.6% reported correctness, so label noise is present.
  • domain assumption Cosine similarity between MiniLM embeddings of reasoning text and official CWE descriptions is a valid measure of reasoning quality
    Section 6.1 uses this as evidence that GRPO improves reasoning; the metric is not validated against human judgments.
  • ad hoc to paper The dynamic reward components (formatting tags, length, lexical diversity, coherence, edit distance) capture desirable reasoning
    Section 4.1 defines these sub-rewards; their selection is the paper's own design choice, not independently established.
  • ad hoc to paper Selecting GRPO checkpoints at peak or near-peak reward provides a fair evaluation of the method
    Section 4.2 states this selection without a comparison against final-epoch performance or a fixed budget.
  • domain assumption The two hand-crafted prompts represent the reasoning and no-reasoning extremes
    Section 3 uses these prompts as baselines; no prompt sensitivity analysis is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Improving LLM Reasoning for Vulnerability Detection via Group Relative Policy Optimization." pith.science (2026). https://pith.science/paper/GAI7B573

@misc{pith2026250703051,
  author       = {Pith},
  title        = {Pith review of: Improving LLM Reasoning for Vulnerability Detection via Group Relative Policy Optimization},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GAI7B573}},
  note         = {Machine review of arXiv:2507.03051}
}
read the original abstract

Improving and understanding the training dynamics and reasoning of Large Language Models (LLMs) has become essential for their deployment in AI-based security tools, such as software vulnerability detection. In this work, we present an extensive study aimed at advancing recent RL-based finetuning techniques for LLMs in the context of vulnerability detection. We start by highlighting key limitations of commonly adopted LLMs, such as their tendency to over-predict certain types of vulnerabilities while failing to detect others. To address this challenge, we explore the use of Group Relative Policy Optimization (GRPO), a recent policy-gradient method, for guiding LLM behavior through structured, rule-based rewards. We enable its application to the vulnerability detection task by redefining its advantage functions and reward signals using annotations from widely used datasets in the field, including BigVul, DiverseVul, and CleanVul. The proposed methodology enables an extensive set of experiments, addressing multiple research questions regarding the impact of GRPO on generalization, reasoning capabilities, and performance improvements over standard supervised finetuning (SFT). Our findings offer valuable insights into the potential of RL-based training to enhance both the performance and reasoning abilities of LLMs in the context of software vulnerability detection.

Figures

Figures reproduced from arXiv: 2507.03051 by the authors.

Figure 1
Figure 1. System prompts for the no-reasoning and reasoning set [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Sub-Rewards signals generated by Formatting, Reasoning and Correctness Analyses. The dotted lines indicate that incoherent reasoning by the model also nullifies the rewards from correctness and formatting. system prompt. Specifically, we check for the presence of the <reasoning> and <answer> tags and confirm that the reasoning follows the three-step pattern highlighted in second block of [PITH_FULL_IMAGE:figures/fu… view at source ↗
Figure 3
Figure 3. Final reward signal used to feedback the models [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (4 more)
Figure 5
Figure 5. Figure 5: Comparison of CWE performance for GRPO-SFT across three models. The 15 CWEs shown are part of MITRE’s Top 25. [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: Cosine-similarity distribution for the 10 CWE categories, comparing the GRPO and BASE models on the three models (LLaMA [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 8
Figure 8. Figure 8: Effect of β on True Negative and False Negative rates during training. findings, RQ2 asked whether a model can be finetuned to better exploit its own reasoning ability. To address this, we enabled the use of GRPO by designing a dynamic reward function that balances for…
Figure 7
Figure 7. Figure 7: Answer length comparison between GRPO and SFT [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 3 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Geometric quantification for nonlinear deformation in knitted fabrics

    cond-mat.soft 2026-04 unverdicted novelty 7.0 of 10

    A geometric quantification framework reconstructs yarn centerlines and fabric surfaces from sparse knit data and partitions large deformation into stitch reorientation, loop bending, surface bending, and dilation.

  2. CVE-Factory: Scaling Expert-Level Agentic Tasks for Code Security Vulnerability

    cs.CR 2026-02 unverdicted novelty 6.0 of 10

    CVE-Factory automatically converts CVE metadata into executable vulnerability tasks, yielding a 190-task LiveCVEBench and 1,000+ training tasks that lift fine-tuned Qwen3-32B from 5.3% to 35.8% on that benchmark.

  3. VULPO: Context-Aware Vulnerability Detection via On-Policy LLM Optimization

    cs.CR 2025-11 conditional novelty 6.0 of 10

    A 4B LLM trained with judge-scored, difficulty-scaled on-policy RL reaches F1 70.45 on context-aware C/C++ vulnerability detection, comparable to DeepSeek-V3.1, with the caveat that the same judge provided the trainin...

Reference graph

Works this paper leans on

46 extracted references · 34 canonical work pages · cited by 3 Pith papers

  1. [30]

    Dohare, Q

    S. Dohare, Q. Lan, A. R. Mahmood, Overcoming policy col- lapse in deep reinforcement learning, in: Sixteenth European Workshop on Reinforcement Learning, 2023

    work page 2023

  2. [1]

    Hasanov, S

    I. Hasanov, S. Virtanen, A. Hakkala, J. Isoaho, Application of large language models in cybersecurity: A systematic literature review, IEEE Access 12 (2024) 176751–176778

    work page 2024

  3. [2]

    X. Zhou, S. Cao, X. Sun, D. Lo, Large language model for vulnerability detection and repair: Literature review and the road ahead, ACM Transactions on Software Engineering and Methodology 34 (5) (2025) 1–31

    work page 2025

  4. [3]

    G. Lu, X. Ju, X. Chen, W. Pei, Z. Cai, GRACE: empowering llm-based software vulnerability detection with graph structure and in-context learning, J. Syst. Softw. 212 (2024) 112031

    work page 2024

  5. [4]

    Y. Guo, C. Patsakis, Q. Hu, Q. Tang, F. Casino, Outside the comfort zone: Analysing LLM capabilities in software vulnera- bility detection, in: Computer Security - ESORICS 2024 - 29th European Symposium on Research in Computer Security, By- dgoszcz, Poland, September 16-20, 2024, Proceedings, Part I, 2024, pp. 271–289

    work page 2024

  6. [5]

    A. Z. H. Yang, H. Tian, H. Ye, R. Martins, C. L. Goues, Secu- rity vulnerability detection with multitask self-instructed fine- tuning of large language models (2024). arXiv:2406.05892

    arXiv 2024

  7. [9]

    S. Jeen, T. Bewley, J. M. Cullen, Zero-shot reinforcement learn- ing from low quality data, in: A. Globerson, L. Mackey, D. Bel- grave, A. Fan, U. Paquet, J. Tomczak, C. Zhang (Eds.), Ad- vances in Neural Information Processing Systems, Vol. 37, Cur- ran Associates, Inc., 2024, pp. 16894–16942

    work page 2024

  8. [10]

    Fontana, M

    A. Fontana, M. Simoni, Unmasking model behavior: How llms reason on vulnerability detection, ACM, 2025

    work page 2025

Show all 46 references
  1. [11]

    C. Wang, Z. Zhao, Y. Jiang, Z. Chen, C. Zhu, Y. Chen, J. Liu, L. Zhang, X. Fan, H. Ma, et al., Beyond reward hacking: Causal rewards for large language model alignment, arXiv preprint arXiv:2501.09620 (2025)

    2025 arXiv

  2. [12]

    Rashidinejad, Y

    P. Rashidinejad, Y. Tian, Sail into the headwind: Alignment via robust rewards and dynamic labels against reward hacking, in: The Thirteenth International Conference on Learning Rep- resentations, ICLR 2025, Singapore, April 24-28, 2025, Open- Review.net, 2025

    2025

  3. [13]

    A. G. et al., The llama 3 herd of models (2024). arXiv:2407.21783

    2024 arXiv

  4. [14]

    A. Yang, A. Li, B. Yang, B. Zhang, B. Hui, B. Zheng, B. Yu, C. Gao, C. Huang, C. Lv, et al., Qwen3 technical report, arXiv preprint arXiv:2505.09388 (2025)

    2025 arXiv

  5. [15]

    J. Fan, Y. Li, S. Wang, T. N. Nguyen, A C/C++ code vulnera- bility dataset with code changes and CVE summaries, in: MSR ’20: 17th International Conference on Mining Software Repos- itories, Seoul, Republic of Korea, 29-30 June, 2020, 2020, pp. 508–512

    2020

  6. [16]

    Y. Chen, Z. Ding, L. Alowain, X. Chen, D. A. Wagner, Diver- sevul: A new vulnerable source code dataset for deep learning based vulnerability detection, in: Proceedings of the 26th In- ternational Symposium on Research in Attacks, Intrusions and Defenses, RAID 2023, Hong Kong,...

    2023

  7. [17]

    Y. Li, T. Zhang, R. Widyasari, Y. N. Tun, H. H. Nguyen, T. Bui, I. C. Irsan, Y. Cheng, X. Lan, H. W. Ang, F. Liauw, M. Weyssow, H. J. Kang, E. L. Ouh, L. K. Shar, D. Lo, Clean- vul: Automatic function-level vulnerability detection in code commits using LLM heuristics, CoRR abs...

    2024 arXiv

  8. [18]

    T. D. LaToza, G. Venolia, R. DeLine, Maintaining mental mod- els: a study of developer work habits, in: L. J. Osterweil, H. D. Rombach, M. L. Soffa (Eds.), 28th International Conference on Software Engineering (ICSE 2006), Shanghai, China, May 20- 28, 2006, ACM, 2006, pp. 492–501

    2006

  9. [19]

    Chatley, A

    R. Chatley, A. F. Donaldson, A. Mycroft, The next 7000 pro- gramming languages, in: B. Steffen, G. J. Woeginger (Eds.), Computing and Software Science - State of the Art and Per- spectives, Vol. 10000 of Lecture Notes in Computer Science, Springer, 2019, pp. 250–282

    2019

  10. [20]

    A. A. Mahyari, Harnessing the power of llms in source code vul- nerability detection, in: IEEE Military Communications Con- ference, MILCOM 2024, Washington, DC, USA, October 28 - Nov. 1, 2024, IEEE, 2024, pp. 251–256

    2024

  11. [21]

    A. Z. H. Yang, C. Le Goues, R. Martins, V. J. Hellendoorn, Large language models for test-free fault localization, in: Pro- ceedings of the 46th IEEE/ACM International Conference on Software Engineering, ICSE 2024, Lisbon, Portugal, April 14- 20, 2024, ACM, 2024, pp. 17:1–17:12

    2024

  12. [22]

    G. Dong, H. Yuan, K. Lu, C. Li, M. Xue, D. Liu, W. Wang, Z. Yuan, C. Zhou, J. Zhou, How abilities in large language mod- els are affected by supervised fine-tuning data composition, in: L. Ku, A. Martins, V. Srikumar (Eds.), Proceedings of the 62nd Annual Meeting of the Associ...

    2024

  13. [23]

    L. Q. Trung, X. Zhang, Z. Jie, P. Sun, X. Jin, H. Li, Reft: Reasoning with reinforced fine-tuning, in: L. Ku, A. Martins, V. Srikumar (Eds.), Proceedings of the 62nd Annual Meet- ing of the Association for Computational Linguistics (Volume 1: Long Papers), ACL 2024, Bangkok, T...

    2024

  14. [24]

    Z. Shao, P. Wang, Q. Zhu, R. Xu, J. Song, M. Zhang, Y. K. Li, Y. Wu, D. Guo, Deepseekmath: Pushing the lim- its of mathematical reasoning in open language models, CoRR abs/2402.03300 (2024). arXiv:2402.03300

    2024 arXiv

  15. [25]

    arXiv:2501.12948

    DeepSeek-AI,Deepseek-r1: Incentivizingreasoningcapabilityin llms via reinforcement learning, CoRR abs/2501.12948 (2025). arXiv:2501.12948

    2025 arXiv

  16. [26]

    Schulman, F

    J. Schulman, F. Wolski, P. Dhariwal, A. Radford, O. Klimov, Proximal policy optimization algorithms, arXiv preprint arXiv:1707.06347 (2017)

    2017 arXiv

  17. [27]

    Z. Liu, C. Chen, W. Li, P. Qi, T. Pang, C. Du, W. S. Lee, M. Lin, Understanding r1-zero-like training: A critical perspec- tive, arXiv preprint arXiv:2503.20783 (2025)

    2025 arXiv

  18. [28]

    S. S. Ramesh, Y. Hu, I. Chaimalas, V. Mehta, P. G. Sessa, H. Bou-Ammar, I. Bogunovic, Group robust preference opti- mization in reward-free RLHF, in: A. Globersons, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. M. Tomczak, C. Zhang 15 (Eds.), Advances in Neural Information Pro...

    2024

  19. [29]

    Z. Ren, X. Ju, X. Chen, H. Shen, Prorlearn: boosting prompt tuning-based vulnerability detection by reinforcement learning, Autom. Softw. Eng. 31 (2) (2024) 38

    2024

  20. [31]

    Smirnov, Table for estimating the goodness of fit of empir- ical distributions, The annals of mathematical statistics 19 (2) (1948) 279–281

    N. Smirnov, Table for estimating the goodness of fit of empir- ical distributions, The annals of mathematical statistics 19 (2) (1948) 279–281

    1948

  21. [32]

    J. Wang, H. Xiao, S. Zhong, Y. Xiao, Deepvulseeker: A novel vulnerability identification framework via code graph structure and pre-training mechanism, Future Generation Computer Sys- tems 148 (2023) 15–26

    2023

  22. [33]

    Wartschinski, Y

    L. Wartschinski, Y. Noller, T. Vogel, T. Kehrer, L. Grunske, Vudenc: Vulnerability detection with deep learning on a natural codebase for python, Information and Software Technology 144 (2022) 106809

    2022

  23. [34]

    Tran, A.-D

    H.-C. Tran, A.-D. Tran, K.-H. Le, Detectvul: A statement- level code vulnerability detection for python, Future Generation Computer Systems 163 (2025) 107504

    2025

  24. [35]

    Z. Tian, B. Tian, J. Lv, Y. Chen, L. Chen, Enhancing vul- nerability detection via ast decomposition and neural sub-tree encoding, Expert Systems with Applications 238 (2024) 121865

    2024

  25. [36]

    Z. Li, D. Zou, S. Xu, Z. Chen, Y. Zhu, H. Jin, VulDeeLoca- tor: A Deep Learning-Based Fine-Grained Vulnerability Detec- tor , IEEE Transactions on Dependable and Secure Computing 19 (04) (2022) 2821–2837

    2022

  26. [37]

    X. Du, G. Zheng, K. Wang, J. Feng, W. Deng, M. Liu, B. Chen, X. Peng, T. Ma, Y. Lou, Vul-rag: Enhancing llm- based vulnerability detection via knowledge-level RAG, CoRR abs/2406.11147 (2024)

    2024 arXiv

  27. [38]

    Zhang, H

    C. Zhang, H. Liu, J. Zeng, K. Yang, Y. Li, H. Li, Prompt- enhanced software vulnerability detection using chatgpt, in: Proceedings of the 2024 IEEE/ACM 46th International Confer- ence on Software Engineering: Companion Proceedings, ICSE Companion 2024, Lisbon, Portugal, April ...

    2024

  28. [39]

    Y. Zhou, S. Liu, J. K. Siow, X. Du, Y. Liu, Devign: Effec- tive vulnerability identification by learning comprehensive pro- gram semantics via graph neural networks, in: H. M. Wal- lach, H. Larochelle, A. Beygelzimer, F. d’Alché-Buc, E. B. Fox, R. Garnett (Eds.), Advances in N...

    2019

  29. [40]

    P. E. Black, A software assurance reference dataset: Thousands of programs with known bugs, Journal of research of the Na- tional Institute of Standards and Technology 123 (2018) 1

    2018

  30. [41]

    National Institute of Standards and Technology, National Vul- nerability Database (NVD)

  31. [42]

    McIntosh, X

    G.P.Bhandari, A.Naseer, L.Moonen, Cvefixes: automatedcol- lection of vulnerabilities and their fixes from open-source soft- ware, in: S. McIntosh, X. Xia, S. Amasaki (Eds.), PROMISE ’21: 17th International Conference on Predictive Models and Data Analytics in Software Engineer...

    2021

  32. [43]

    R. Just, D. Jalali, M. D. Ernst, Defects4j: a database of existing faults to enable controlled testing studies for java programs, in: C. S. Pasareanu, D. Marinov (Eds.), International Symposium on Software Testing and Analysis, ISSTA ’14, San Jose, CA, USA - July 21 - 26, 2014...

    2014

  33. [44]

    Widyasari, S

    R. Widyasari, S. Q. Sim, C. Lok, H. Qi, J. Phan, Q. Tay, C. Tan, F. Wee, J. E. Tan, Y. Yieh, B. Goh, F. Thung, H. J. Kang, T. Hoang, D. Lo, E. L. Ouh, Bugsinpy: A database of existing bugsinpythonprogramstoenablecontrolledtestinganddebug- ging studies, CoRR abs/2401.15481 (202...

    2024 arXiv

  34. [45]

    Nijkamp, B

    E. Nijkamp, B. Pang, H. Hayashi, L. Tu, H. Wang, Y. Zhou, S. Savarese, C. Xiong, Codegen: An open large language model for code with multi-turn program synthesis, in: The Eleventh International Conference on Learning Representations, ICLR 2023, Kigali, Rwanda, May 1-5, 2023, O...

    2023

  35. [46]

    Z. Li, D. Zou, S. Xu, H. Jin, Y. Zhu, Z. Chen, Sysevr: A frame- work for using deep learning to detect software vulnerabilities, IEEE Trans. Dependable Secur. Comput. 19 (4) (2022) 2244– 2258

    2022

  36. [47]

    arXiv:2303.08774

    OpenAI,GPT-4technicalreport, CoRRabs/2303.08774(2023). arXiv:2303.08774

    2023 arXiv

  37. [48]

    Chakraborty, R

    S. Chakraborty, R. Krishna, Y. Ding, B. Ray, Deep learning based vulnerability detection: Are we there yet?, Vol. 48, 2022, pp. 3280–3296

    2022

  38. [49]

    Z. Feng, D. Guo, D. Tang, N. Duan, X. Feng, M. Gong, L. Shou, B. Qin, T. Liu, D. Jiang, M. Zhou, Codebert: A pre-trained model for programming and natural languages, in: T. Cohn, Y. He, Y. Liu (Eds.), Findings of the Association for Computa- tional Linguistics: EMNLP 2020, Onl...

    2020

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.