Pith. sign in

REVIEW 4 major objections 4 minor 31 references

EnStack: An Ensemble Stacking Framework of Large Language Models for Enhanced Vulnerability Detection in Source Code

T0 review · 4 major / 4 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read EnStack claims that stacking CodeBERT, GraphCodeBERT, and UniXcoder outputs through a meta-classifier outperforms any one of these code models at multiclass vulnerability detection, with best reported accuracy of 82.36%.

desk verdict A clean stacking pipeline wasted on a mislabeled task: the experiment classifies among CWE types, not vulnerability detection, and the 0.8-point gain doesn't support the abstract's claims. read the letter →

arxiv 2411.16561 v1 pith:GX4SAPGD submitted 2024-11-25 cs.SE cs.CL

Shahriyar Zaman Ridoy , Md. Shazzad Hossain Shaon , Alfredo Cuzzocrea , Mst Shapna Akter This is my paper · ORCID
classification cs.SEcs.CL
keywords vulnerabilitydetectionensemblestackinglargelanguagemodelsCodeBERTGraphUniXcoderDraperVDISCmeta-classifier
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

EnStack is an ensemble-stacking recipe for source-code vulnerability detection. The paper claims that no single code-focused language model captures all the facets of a vulnerability, so concatenating the probability outputs of CodeBERT, GraphCodeBERT, and UniXcoder and feeding them to a meta-classifier should beat the best individual model. On the authors' 28,105-sample, downsampled subset of the Draper VDISC dataset, the strongest combination, GraphCodeBERT plus UniXcoder with an SVM meta-classifier, reaches 82.36% accuracy and an 82.28% F1-score, roughly 0.8 percentage points above UniXcoder alone. The result matters because it suggests that improved code auditing can come from combining existing models rather than designing a new architecture.

What carries the argument

The load-bearing object is the stacked meta-feature vector: for a code snippet $x_i$, each fine-tuned base model $M_k$ outputs a probability distribution over the five CWE classes, and these distributions are concatenated as $z_i = [M_1(x_i), M_2(x_i), M_3(x_i)]$. A meta-classifier $F_{\mathrm{meta}}$ is trained on validation-set meta-features and then applied at test time to produce $\hat{y}_i = F_{\mathrm{meta}}(z_i)$. This two-stage design is what lets the framework combine CodeBERT's semantic view, GraphCodeBERT's structural view, and UniXcoder's cross-modal view without retraining a single network; the meta-classifier learns the weighting.

What would settle it

Run the same three fine-tuned base models and the four meta-classifiers on the full Draper VDISC dataset, or on a large, explicitly documented random sample, and compare the G+U+SVM configuration against UniXcoder alone; if the accuracy gap falls below run-to-run noise or reverses, the claimed stacking benefit rests on the unstated subset rather than on ensemble complementarity.

Watch

Extended reading notes

Core claim

The paper's central claim is that complementary pre-trained code models, stacked through a meta-classifier, detect vulnerability classes more accurately than any single model. Each base model (CodeBERT for token-level semantics, GraphCodeBERT for data-flow structure, UniXcoder for cross-modal code understanding) is fine-tuned on the same Draper VDISC labels and emits a five-class probability vector; those vectors are concatenated into a meta-feature vector on which logistic regression, SVM, random forest, and XGBoost are trained. In the reported experiments the best single model, UniXcoder, reaches 81.54% accuracy and 81.49% F1, while the G+U ensemble under SVM raises accuracy to 82.36% and F1 to 82.28%, and G+U under logistic regression reaches the highest AUC at 92.85%. The paper interprets this as evidence that structural and cross-modal representations carry complementary signal that a simple linear meta-classifier can exploit.

Load-bearing premise

The result depends on the unstated way the 28,105 samples in Table I were chosen from the 1.27 million functions of the Draper VDISC dataset; if that subset is not representative of the full dataset, the reported 0.8-point gain will not generalize.

Editorial extensions

If this is right

  • If EnStack's result holds, vulnerability detection can be improved by stacking already fine-tuned code models, since the meta-classifier stage is cheap and model-specific fine-tuning is reused as-is.
  • The G+U pairing outperforming C+G indicates that structural (GraphCodeBERT) and cross-modal (UniXcoder) representations are the complementary pair to prioritize; token-level semantics from CodeBERT add less.
  • SVM and logistic regression consistently beat random forest and XGBoost as meta-classifiers, suggesting that base-model outputs lie in a space where linear boundaries already separate vulnerability classes well.
  • The best stacking configurations improve both accuracy and F1 over UniXcoder alone, which implies the gain is not just a threshold effect on one class but a better overall multiclass separation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: the same stacking layer could be tested as a drop-in upgrade for newer code models; because the meta-classifier only consumes probability vectors, swapping CodeBERT, GraphCodeBERT, and UniXcoder for any code LLM requires no architectural change.
  • Beyond the paper: the paper's own framing suggests a testable selection principle, namely choose base models whose prediction errors are least correlated, which would let future work pick ensembles by diversity rather than by model availability.
  • Beyond the paper: the reported gap, about 0.8 points, is small enough that repeated runs with different random seeds and confidence intervals would be needed to confirm that stacking, rather than the particular 28k-sample split, produces the improvement.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes EnStack, an ensemble-stacking framework that fine-tunes CodeBERT, GraphCodeBERT, and UniXcoder on the Draper VDISC dataset and uses logistic regression, random forest, SVM, or XGBoost as a meta-classifier over the concatenated output probabilities. The authors evaluate a 28,105-sample subset of VDISC and report that stacking GraphCodeBERT and UniXcoder with SVM achieves 82.36% accuracy and 82.28% F1, compared with 81.54% and 81.49% for the best single model, UniXcoder. The paper interprets this result as a significant improvement in vulnerability detection and includes an ablation over model combinations and meta-classifiers.

Significance. Ensemble stacking of code LLMs is a reasonable idea, and the training/meta-feature protocol is structurally sound: base models are fine-tuned only on training data, meta-features are generated for validation and test, and the meta-classifier is fitted on validation predictions, so there is no apparent test-label leakage. However, the reported evidence is substantially weaker than the claims. The experiment is multiclass classification among CWE vulnerability types rather than vulnerability detection, because no benign or non-vulnerable class is present. The 28k subset is unexplained, no prior vulnerability-detection system is included as a baseline, and the performance gain over the best single model is about 0.8 percentage points with no error bars or significance tests. If the authors can add a benign class, report detection-oriented metrics, justify the subset, and compare with published systems, the framework could be a modest contribution; the current manuscript overstates what the data show.

major comments (4)
  1. [III-A, III-B, Table I] Section III-A defines yi in {0,1,2,3,4} as vulnerability class labels, and Section III-B and Table I list only CWE-119, CWE-120, CWE-469, CWE-476, and CWE-other. There is no benign or non-vulnerable class in the problem formulation, the dataset description, or the experimental results. All reported accuracy, precision, recall, F1, and AUC values therefore measure discrimination among five vulnerability types, not the detection of vulnerabilities. The abstract and conclusion frame the task as vulnerability detection, but the experiment never separates vulnerable from non-vulnerable code. The paper should either include a benign class and report detection-oriented metrics, or explicitly reframe the contribution as multiclass vulnerability-type classification.
  2. [III-B, Table I] Table I reports 28,105 total samples (20,305 training, 3,900 validation, 3,900 test), but Section III-B states that the Draper VDISC dataset contains over 1.27 million functions and says only that null entries were removed after an 80/10/10 split. Removing nulls cannot reduce a million-scale dataset to 28k, and the downsampling described later is applied only to the majority classes in the training set, so it also cannot explain the reduction. The selection or sampling procedure that produced the 28k sample is never stated; without it, every metric in Table III is conditional on an unknown subset and may not generalize even to the full VDISC dataset. The authors must describe the full data flow, state whether the 28k is a random subset, and justify its representativeness.
  3. [IV-B, IV-C] The baseline set in Section IV-B consists only of the base LLMs (CodeBERT, GraphCodeBERT, UniXcoder) and Attention LSTM. No prior vulnerability-detection system (e.g., VulDeePecker, SySeVR, Devign, VulBERTa, or VulDeBERT, all discussed in Section II) is evaluated or cited with comparable numbers on the same data. Therefore the abstract's claim that EnStack significantly outperforms existing methods is not supported by the experimental comparison. The authors should include at least one published vulnerability-detection baseline on VDISC, or clearly restrict all claims to outperforming the base models considered here.
  4. [IV-C, Table III] The largest reported gain over the best single model is 82.36% versus 81.54% accuracy (0.82 percentage points) for G+U with SVM, with no confidence intervals, standard deviations, repeated runs, or statistical significance tests reported. Given that fine-tuning LLMs is stochastic and the meta-classifier is selected on validation data, this difference may lie within run-to-run variation. The word significantly in the abstract and conclusion is therefore not justified. At minimum, the authors should run multiple seeds and report means and variances, or paired significance tests.
minor comments (4)
  1. [IV-C, Table III] The text in Section IV-C says stacking UniXcoder with SVM resulted in an accuracy of 81.36% and an F1-score of 81.89%, but Table III lists Stacking U (SVM) as 81.31% accuracy and 81.33% F1; the value 81.89 appears to be the precision. Please reconcile the text with the table.
  2. [IV-E] The discussion mentions combining models through both weighted aggregation and stacking, but no weighted-aggregation experiment is described anywhere in Sections III or IV; either add the experiment or remove the phrase.
  3. [IV-C, evaluation metrics] The evaluation lists AUC-Score as a metric, but for a multiclass problem with five classes the paper does not state how the ROC/AUC was computed (macro-average, one-vs-rest, etc.). Please specify, since Table III reports AUC values for all models.
  4. [General] No code or data availability statement is provided; sharing the data-processing and fine-tuning code would significantly aid reproducibility of the reported numbers.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the stacking pipeline trains meta-classifiers on validation predictions and evaluates on a held-out test set, so the reported results are empirical and not forced by construction.

full rationale

The paper's central derivation is an empirical stacking pipeline, and none of its load-bearing steps reduces to its own inputs by construction. Algorithm 1 separates data preparation, base-model fine-tuning on Dtrain, meta-feature generation on Dval, meta-classifier training on Dval, and final evaluation on Dtest (lines 13-24). No parameter is fitted to test labels, and the test metrics in Table III are computed on held-out samples, so the claimed improvement of the G+U/SVM ensemble over UniXcoder alone is not statistically forced by the fitting procedure. The vulnerability class labels are external CWE categories from the Draper dataset, not defined in terms of the model outputs, so there is no self-definitional step. The meta-features are simply concatenated probability outputs of the base models; the meta-classifier learns a combination, but this is standard stacking rather than a circular definition. The paper's self-citations, mainly [3]-[8] in the introduction, are background references to prior AI/big-data work by one author and are not load-bearing for the stacking premise, for any uniqueness claim, or for the choice of base models; hence they do not constitute circularity. There is no invoked uniqueness theorem from prior work by the same authors, and no ansatz is smuggled in via citation: CodeBERT, GraphCodeBERT, and UniXcoder are externally published models with their own pre-training. The reviewer-identified concerns about the paper are real but are not circularity: the task is formulated as five-class CWE classification without a benign/non-vulnerable class (Section III-A sets yi in {0,1,2,3,4} and Table I lists only CWE categories), which undermines the 'detection' framing; and the path from the 1.27M-function Draper dataset to the 28,105 samples in Table I is not fully explained, since removing null entries and downsampling alone cannot account for the reduction. These are external-validity and reporting issues, not cases where a prediction is equivalent to its input by construction. Therefore the honest finding is no significant circularity.

Assumptions & free parameters 6 free parameters · 3 assumptions · 0 invented entities

The framework does not rely on invented physical entities or circular derivations. Its empirical burden consists of an unstated data-subsampling step, hand-chosen hyperparameters, and static-analysis-derived labels, which are enumerated as axioms and free parameters above.

free parameters (6)
  • Fine-tuning learning rate = 2e-5
    Hand-chosen in Table II; no learning-rate sweep or sensitivity analysis is reported.
  • Fine-tuning epochs = 10
    Hand-chosen in Table II; no early stopping or epoch sweep is reported.
  • Max token length = 512
    Hand-chosen truncation length in Table II; longer code snippets are cut off, which affects the content seen by all base models.
  • Downsampled training class sizes = CWE-119: 5942, CWE-120: 5777, CWE-other: 5582 (training)
    Majority classes are reduced toward minority scales in Table I; the target sizes are a modeling choice that changes the training distribution and all downstream metrics.
  • Meta-classifier hyperparameters = RF estimators=200, depth=10; XGB estimators=100, lr=0.1, depth=6
    Hand-picked in Table II; no tuning procedure or sensitivity analysis is reported.
  • Meta-classifier selection = G+U with SVM (validation-best)
    Algorithm 1 selects the classifier with the best validation performance, which is a model-selection choice that affects the reported test numbers.
assumptions (3)
  • domain assumption Draper VDISC labels are accurate enough to serve as ground truth.
    All training and evaluation in Sections III-C and IV treat static-analysis-derived labels as correct; any label noise propagates directly into every reported metric.
  • domain assumption The 28,105 examples are a representative sample of the 1.27M-function Draper dataset.
    Section III-B states the dataset size but never describes how the used subset was formed; all results depend on this unstated sampling step.
  • domain assumption Concatenated base-model probability vectors are sufficient meta-features.
    Algorithm 1 and Section III-D construct meta-features only from the softmax outputs of the three LLMs; any information not in those vectors is unavailable to the meta-classifier.

how reviews work

0 comments
Cite this review

Pith. "Pith review of EnStack: An Ensemble Stacking Framework of Large Language Models for Enhanced Vulnerability Detection in Source Code." pith.science (2026). https://pith.science/paper/GX4SAPGD

@misc{pith2026241116561,
  author       = {Pith},
  title        = {Pith review of: EnStack: An Ensemble Stacking Framework of Large Language Models for Enhanced Vulnerability Detection in Source Code},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GX4SAPGD}},
  note         = {Machine review of arXiv:2411.16561}
}
read the original abstract

Automated detection of software vulnerabilities is critical for enhancing security, yet existing methods often struggle with the complexity and diversity of modern codebases. In this paper, we introduce EnStack, a novel ensemble stacking framework that enhances vulnerability detection using natural language processing (NLP) techniques. Our approach synergizes multiple pre-trained large language models (LLMs) specialized in code understanding CodeBERT for semantic analysis, GraphCodeBERT for structural representation, and UniXcoder for cross-modal capabilities. By fine-tuning these models on the Draper VDISC dataset and integrating their outputs through meta-classifiers such as Logistic Regression, Support Vector Machines (SVM), Random Forest, and XGBoost, EnStack effectively captures intricate code patterns and vulnerabilities that individual models may overlook. The meta-classifiers consolidate the strengths of each LLM, resulting in a comprehensive model that excels in detecting subtle and complex vulnerabilities across diverse programming contexts. Experimental results demonstrate that EnStack significantly outperforms existing methods, achieving notable improvements in accuracy, precision, recall, and F1-score. This work highlights the potential of ensemble LLM approaches in code analysis tasks and offers valuable insights into applying NLP techniques for advancing automated vulnerability detection.

Figures

Figures reproduced from arXiv: 2411.16561 by the authors.

Figure 1
Figure 1. A Comparative Overview of Vulnerability Detection Techniques. (1) Traditional LLM-based processing, which directly outputs predictions but experiences notable data loss, (2) Traditional+Meta models from previous studies that integrate a meta-classifier to enhance LLM outputs, and (3) the proposed EnStack framework, which leverages an ensemble of multiple LLMs combined through stacking methods. EnStack incorporates a… view at source ↗
Figure 2
Figure 2. Methodology Workflow for Enhanced Vulnerability Detection using EnStack Framework. The proposed methodology begins with the CWE dataset, which includes multiclass labels associated with various types of vulnerable code. During the processing phase, data cleansing steps, such as null value removal and down sampling, ensure balanced and representative input data. This furnished data is then fed into an ensemble of lar… view at source ↗
Figure 3
Figure 3. t-SNE visualization of latent space representations for CWE categories in vulnerability detection. (a) baseline model fine-tuned using CodeBert, exhibiting class overlap and reduced inter-cluster separation; (b) enhanced representations through ensemble stacking (EnStack) with CodeBert and GraphCodeBERT (C+G) followed by logistic regression (LR), demonstrating improved cluster formation and class separability. cover… view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Ablation study results showcasing the impact of model combi￾nations and meta-classifier choice in stacking ensembles. (a) Performance comparison of model combinations (C+G vs. G+U) across meta-classifiers (LR, RF, SVM, and XGBoost). G+U consistently outperforms C+G, wi…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

31 extracted references · 20 canonical work pages

  1. [1]

    A systematic literature review on the cyber security,

    Y . Perwej, S. Q. Abbas, J. P. Dixit, N. Akhtar, and A. K. Jaiswal, “A systematic literature review on the cyber security,” International Journal of scientific research and management, vol. 9, no. 12, pp. 669–710, 2021

    work page 2021

  2. [2]

    Software vulnerability analysis and discovery using machine-learning and data-mining techniques: A survey,

    S. M. Ghaffarian and H. R. Shahriari, “Software vulnerability analysis and discovery using machine-learning and data-mining techniques: A survey,”ACM computing surveys (CSUR), vol. 50, no. 4, pp. 1–36, 2017

    2017

  3. [3]

    Predictive analytics on open big data for supporting smart transportation services,

    P. P. F. Balbin, J. C. Barker, C. K. Leung, M. Tran, R. P. Wall, and A. Cuzzocrea, “Predictive analytics on open big data for supporting smart transportation services,” Procedia computer science , vol. 176, pp. 3009–3018, 2020

    work page 2020

  4. [4]

    Malware detection and prevention using artificial intelligence techniques,

    M. J. H. Faruk, H. Shahriar, M. Valero, F. L. Barsha, S. Sobhan, M. A. Khan, M. Whitman, A. Cuzzocrea, D. Lo, A. Rahman, et al., “Malware detection and prevention using artificial intelligence techniques,” in 2021 IEEE international conference on big data (big data) , pp. 5369–5377, IEEE, 2021

    work page 2021

  5. [5]

    Bayesian hyperparameter optimization for deep neural network-based network intrusion detection,

    M. Masum, H. Shahriar, H. Haddad, M. J. H. Faruk, M. Valero, M. A. Khan, M. A. Rahman, M. I. Adnan, A. Cuzzocrea, and F. Wu, “Bayesian hyperparameter optimization for deep neural network-based network intrusion detection,” in 2021 IEEE International Conference on Big Data (Big Data), pp. 5413–5419, IEEE, 2021

    work page 2021

  6. [6]

    Ai-based sensor information fusion for supporting deep supervised learning,

    C. K. Leung, P. Braun, and A. Cuzzocrea, “Ai-based sensor information fusion for supporting deep supervised learning,” Sensors, vol. 19, no. 6, p. 1345, 2019

    work page 2019

  7. [7]

    Fuzzy logic-based data analytics on predicting the effect of hurricanes on the stock market,

    R. C. Camara, A. Cuzzocrea, G. M. Grasso, C. K. Leung, S. B. Powell, J. Souza, and B. Tang, “Fuzzy logic-based data analytics on predicting the effect of hurricanes on the stock market,” in 2018 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE) , pp. 1–8, IEEE, 2018

    work page 2018

  8. [8]

    Predicting facebook-users’ personality based on status and linguistic features via flexible regression analysis techniques,

    P. Howlader, K. K. Pal, A. Cuzzocrea, and S. M. Kumar, “Predicting facebook-users’ personality based on status and linguistic features via flexible regression analysis techniques,” in Proceedings of the 33rd annual ACM symposium on applied computing , pp. 339–345, 2018

    work page 2018

Show all 31 references
  1. [9]

    A survey of machine learning for big code and naturalness,

    M. Allamanis, E. T. Barr, P. Devanbu, and C. Sutton, “A survey of machine learning for big code and naturalness,” ACM Computing Surveys (CSUR), vol. 51, no. 4, pp. 1–37, 2018

    2018

  2. [10]

    Codebert: A pre-trained model for programming and natural languages,

    Z. Feng, D. Guo, D. Tang, N. Duan, X. Feng, M. Gong, L. Shou, B. Qin, T. Liu, D. Jiang, et al., “Codebert: A pre-trained model for programming and natural languages,” arXiv preprint arXiv:2002.08155 , 2020

    2002 arXiv

  3. [11]

    Graphcodebert: Pre-training code repre- sentations with data flow,

    D. Guo, S. Ren, S. Lu, Z. Feng, D. Tang, S. Liu, L. Zhou, N. Duan, A. Svyatkovskiy, S. Fu, et al., “Graphcodebert: Pre-training code repre- sentations with data flow,” arXiv preprint arXiv:2009.08366 , 2020

    2009 arXiv

  4. [12]

    Unixcoder: Unified cross-modal pre-training for code representation,

    D. Guo, S. Lu, N. Duan, Y . Wang, M. Zhou, and J. Yin, “Unixcoder: Unified cross-modal pre-training for code representation,” arXiv preprint arXiv:2203.03850, 2022

    2022 arXiv

  5. [13]

    Modeling and discover- ing vulnerabilities with code property graphs,

    F. Yamaguchi, N. Golde, D. Arp, and K. Rieck, “Modeling and discover- ing vulnerabilities with code property graphs,” in 2014 IEEE symposium on security and privacy , pp. 590–604, IEEE, 2014

    2014

  6. [14]

    Vuldeepecker: A deep learning-based system for vulnerability detec- tion,

    Z. Li, D. Zou, S. Xu, X. Ou, H. Jin, S. Wang, Z. Deng, and Y . Zhong, “Vuldeepecker: A deep learning-based system for vulnerability detec- tion,” arXiv preprint arXiv:1801.01681 , 2018

    2018 arXiv

  7. [15]

    Sysevr: A framework for using deep learning to detect software vulnerabilities,

    Z. Li, D. Zou, S. Xu, H. Jin, Y . Zhu, and Z. Chen, “Sysevr: A framework for using deep learning to detect software vulnerabilities,” IEEE Transactions on Dependable and Secure Computing, vol. 19, no. 4, pp. 2244–2258, 2021

    2021

  8. [16]

    Devign: Effective vul- nerability identification by learning comprehensive program semantics via graph neural networks,

    Y . Zhou, S. Liu, J. Siow, X. Du, and Y . Liu, “Devign: Effective vul- nerability identification by learning comprehensive program semantics via graph neural networks,” Advances in neural information processing systems, vol. 32, 2019

    2019

  9. [17]

    Automated vulnerability detection in source code using deep representation learning,

    R. Russell, L. Kim, L. Hamilton, T. Lazovich, J. Harer, O. Ozdemir, P. Ellingwood, and M. McConley, “Automated vulnerability detection in source code using deep representation learning,” in 2018 17th IEEE international conference on machine learning and applications (ICMLA), p...

    2018

  10. [18]

    D. W. Hosmer Jr, S. Lemeshow, and R. X. Sturdivant, Applied logistic regression. John Wiley & Sons, 2013

    2013

  11. [19]

    Support vector machine,

    D. A. Pisner and D. M. Schnyer, “Support vector machine,” in Machine learning, pp. 101–121, Elsevier, 2020

    2020

  12. [20]

    Genuer, J.-M

    R. Genuer, J.-M. Poggi, R. Genuer, and J.-M. Poggi, Random forests. Springer, 2020

    2020

  13. [21]

    Xgboost: A scalable tree boosting system,

    T. Chen and C. Guestrin, “Xgboost: A scalable tree boosting system,” in Proceedings of the 22nd acm sigkdd international conference on knowledge discovery and data mining , pp. 785–794, 2016

    2016

  14. [22]

    Fault attacks on secure em- bedded software: Threats, design, and evaluation,

    B. Yuce, P. Schaumont, and M. Witteman, “Fault attacks on secure em- bedded software: Threats, design, and evaluation,” Journal of Hardware and Systems Security , vol. 2, pp. 111–130, 2018

    2018

  15. [23]

    Comparison and analysis of software vulnerability databases,

    H. KEK ¨UL, B. ERGEN, and H. ARSLAN, “Comparison and analysis of software vulnerability databases,” International Journal of Engineering and Manufacturing, vol. 12, no. 4, p. 1, 2022

    2022

  16. [24]

    Auto- mated vulnerability detection in source code using deep representation learning,

    C. Seas, G. Fitzpatrick, J. A. Hamilton, and M. C. Carlisle, “Auto- mated vulnerability detection in source code using deep representation learning,” in 2024 IEEE 14th Annual Computing and Communication Workshop and Conference (CCWC) , pp. 0484–0490, IEEE, 2024

    2024

  17. [25]

    Vulnerability detection in c/c++ source code with graph representation learning,

    Y . Wu, J. Lu, Y . Zhang, and S. Jin, “Vulnerability detection in c/c++ source code with graph representation learning,” in 2021 IEEE 11th Annual Computing and Communication Workshop and Conference (CCWC), pp. 1519–1524, IEEE, 2021

    2021

  18. [26]

    Software vulner- ability detection using deep neural networks: a survey,

    G. Lin, S. Wen, Q.-L. Han, J. Zhang, and Y . Xiang, “Software vulner- ability detection using deep neural networks: a survey,” Proceedings of the IEEE, vol. 108, no. 10, pp. 1825–1848, 2020

    2020

  19. [27]

    Vuldeelocator: A deep learning-based system for detecting and locating software vulnerabilities,

    Z. Li, D. Zou, S. Xu, H. Jin, Y . Zhu, Y . Zhang, Z. Chen, and D. Li, “Vuldeelocator: A deep learning-based system for detecting and locating software vulnerabilities,” IEEE Transactions on Dependable and Secure Computing, 2021

    2021

  20. [28]

    Vuldebert: A vulnerability detection system using bert,

    S. Kim, J. Choi, M. E. Ahmed, S. Nepal, and H. Kim, “Vuldebert: A vulnerability detection system using bert,” in 2022 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW) , pp. 69–74, IEEE, 2022

    2022

  21. [29]

    Vulberta: Simplified source code pre-training for vulnerability detection,

    H. Hanif and S. Maffeis, “Vulberta: Simplified source code pre-training for vulnerability detection,” in 2022 International joint conference on neural networks (IJCNN) , pp. 1–8, IEEE, 2022

    2022

  22. [30]

    Chatgpt for vulnerability detection, classification, and repair: How far are we?,

    M. Fu, C. K. Tantithamthavorn, V . Nguyen, and T. Le, “Chatgpt for vulnerability detection, classification, and repair: How far are we?,” in 2023 30th Asia-Pacific Software Engineering Conference (APSEC) , pp. 632–636, IEEE, 2023

    2023

  23. [31]

    Attention-based lstm for aspect-level sentiment classification,

    Y . Wang, M. Huang, X. Zhu, and L. Zhao, “Attention-based lstm for aspect-level sentiment classification,” in Proceedings of the 2016 confer- ence on empirical methods in natural language processing, pp. 606–615, 2016

    2016

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.