Pith. sign in

REVIEW 3 major objections 5 minor 48 references

MVD: A Multi-Lingual Software Vulnerability Detection Framework

T0 review · 3 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A single model trained on vulnerabilities in six programming languages outperforms language-specific detectors and adds new languages without forgetting.

desk verdict A useful first multi-lingual vulnerability detector, but the headline gains are an artifact of comparing against off-language baselines – per-language it wins three, loses two, and ties one. read the letter →

arxiv 2412.06166 v1 pith:3PQRTXRH submitted 2024-12-09 cs.SE cs.CRcs.LG

Boyu Zhang , Triet H. M. Le , M. Ali Babar This is my paper · ORCID
classification cs.SEcs.CRcs.LG
keywords softwarevulnerabilitydetectionmulti-lingualcodeanalysisfunction-levelpredictionBERTclassimbalanceFOLAlossincrementallearningPR-AUC
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper introduces MVD, a framework that trains one deep-learning model to detect vulnerable functions in Python, C/C++, Java, C#, JavaScript, and TypeScript at the same time. The authors' central claim is that this multi-lingual model beats the single-language state-of-the-art baseline LineVul on every one of the six languages, with relative PR-AUC improvements from 83.7% to 193.6% and an average PR-AUC of 0.5376 across languages. They also claim MVD can learn a new language through incremental learning using only that language's data, while largely preserving performance on the original languages. If these results hold, polyglot software projects would not need one separately trained detector per language, and adding support for an emerging language would become much cheaper. The evaluation uses a curated dataset of more than 11,000 real-world vulnerabilities.

What carries the argument

The load-bearing mechanism is a multi-class classifier built on CodeBERT, a transformer-based code model pre-trained on multi-language source code. The classifier has a 'clean' class plus one vulnerable class per language, which lets the model learn both what a vulnerability looks like and how its expression varies across languages; the FOLA loss, a hybrid of Focal loss and logit adjustment, reweights hard examples and adjusts logits by class frequency to keep minority languages from being ignored; and the incremental stage adds a distillation loss that pins the new model's old-language logits to the frozen teacher's outputs. This combination is what lets one model carry cross-language vulnerability knowledge and acquire new languages without retraining on old data.

What would settle it

Retrain and evaluate MVD and the LineVul baselines with a repository-disjoint split, where all functions from any given project appear in only one of training, validation, or testing; then compare PR-AUC. If MVD's large advantage shrinks or reverses, the reported gains depend on within-project leakage rather than cross-language transfer.

Watch

Extended reading notes

Core claim

MVD is a CodeBERT model fine-tuned as a multi-class classifier whose output has one 'clean' class plus one vulnerable class per supported language. At test time the per-language vulnerable probabilities are summed into a single binary vulnerability score, so the model makes one detection decision regardless of language. During training the composite FOLA loss combines Focal loss with logit adjustment to counteract the heavy class imbalance in the curated data, and a distillation loss is added when extending to a new language: the new model is trained to keep its logits for old languages close to those of the frozen teacher, while learning the new language from new data. On the six-language test sets, MVD reports average PR-AUC of 0.5376, compared with averages between 0.1831 and 0.2926 for the six language-specific LineVul baselines, and the per-language relative gains are the 83.7%-193.6% figures. In the incremental-extension experiments, the model outperforms a language-only baseline for four of six new languages and mostly retains its previous-language performance.

Load-bearing premise

The 8:1:1 split of functions assumes that functions from the same repository in the test set are not made artificially easy by project-specific patterns learned from training; if the same project's code appears in both sets, the measured PR-AUC overstates detection on code the model has not seen.

Editorial extensions

If this is right

  • A single multi-lingual model can replace six separately trained detectors, cutting training cost by roughly a factor of five while matching or exceeding each per-language detector's PR-AUC.
  • Vulnerability knowledge transfers across languages: MVD lifts performance on low-resource languages such as TypeScript above what a model trained on that language alone achieves.
  • New languages can be added incrementally with only the new language's data, and the model outperforms a from-scratch single-language model in four of six tested languages.
  • Freezing the code model and training only the classifier loses about 30 points of average PR-AUC, so fine-tuning the full model is load-bearing for the result.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the evaluation splits functions randomly rather than by project, functions from the same repository can appear in both training and testing; a repository-disjoint split would test whether the reported gains reflect cross-language transfer or project-specific memorization.
  • The language-classification head may function as an implicit regularizer that forces the representation to separate language-specific vulnerability patterns; removing language supervision while keeping multi-lingual data would isolate this effect.
  • The language-order sensitivity observed in the incremental experiments suggests that choosing which new language to add and when could be scheduled by similarity to the already learned languages to improve transfer.
  • The multi-class encoder could be extended with a token-level head to predict line-level vulnerability locations across languages, combining the multi-lingual representation with the localization ability of line-level detectors.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper presents MVD, a multi-lingual vulnerability detection framework built on CodeBERT. MVD is trained as a multi-class classifier over vulnerable classes per language plus a clean class, uses a proposed FOLA loss that combines focal loss with a logit-adjustment term to handle class imbalance, and includes an incremental learning module based on knowledge distillation for adding new languages. The authors curate a dataset of over 11K vulnerable functions across Python, C/C++, Java, C#, JavaScript, and TypeScript, and report experiments comparing MVD to per-language LineVul models, an ablation study of the proposed components, and incremental learning results. The central claim is that MVD outperforms state-of-the-art single-language models by 83.7% to 193.6% in PR-AUC.

Significance. If the headline claim were valid, this would be a practically useful result: a single model that matches or exceeds language-specific state-of-the-art detectors across six languages would substantially reduce the cost of multi-language vulnerability detection. The paper also contributes a curated multi-lingual dataset, public artifact links, and an incremental learning setting that is relatively unexplored for vulnerability detection. The ablation study is a reasonable attempt to attribute gains to the multi-class formulation, the FOLA loss, and fine-tuning. However, the quantitative central claim is not supported by the presented analysis: the 83.7%–193.6% figures are computed against off-language LineVul models, and the same-language comparisons in Table II show MVD losing on two of six languages and nearly tying on a third. The additional risk of project-level data leakage from the random function-level split further undermines the reliability of the reported absolute numbers. The contribution is therefore not established as stated.

major comments (3)
  1. [Section V-A, Table II] The headline claim that MVD outperforms LineVul by 83.7%–193.6% in PR-AUC is not supported by a same-language comparison. In Table II, the 'Average' row compares MVD's average PR-AUC (0.5376) against each LineVul model's average PR-AUC over all six test languages (e.g., LineVul-Python = 0.2926), which includes languages that the LineVul model was never trained on and for which it performs near chance. Against the correctly paired same-language baseline, MVD improves by 0.6% on Python, 34.9% on C/C++, 30.7% on Java, and 148.4% on TypeScript, but is worse by 1.0% on C# and 4.5% on JavaScript. The average improvement over same-language baselines is approximately 11.9%, not the 83.7%–193.6% repeated in the abstract, Section V-A, and conclusion. This error is load-bearing for the paper's central quantitative claim.
  2. [Section IV-D, Section VI] The evaluation uses a random 8:1:1 split of individual functions into training, validation, and testing sets without grouping by project. Because functions from the same repository can appear in both training and testing, the model can memorize project-specific identifiers and patterns, inflating PR-AUC for both MVD and the LineVul baselines. The threats-to-validity section does not mention this issue. The authors should either repeat the main experiments with a project-level split or quantitatively show that the overlap does not affect the conclusions; without this, the reported absolute PR-AUC values and the claimed gains in RQ1, RQ2, and RQ3 do not establish generalization to unseen projects.
  3. [Equation (1), Section IV-D] The proposed FOLA loss relies on hyperparameters α_t, γ, and τ, but none of these values are reported in the experimental setup or anywhere else in the manuscript. This omission prevents reproduction of the method and makes it impossible to assess whether the class-imbalance handling is actually responsible for the observed results. In addition, the term τ log(q_t) as written in Eq. (1) adds a constant per-class offset to the loss, which is not the standard implementation of logit adjustment from the cited work [38]; logit adjustment is normally applied to the logits before softmax. The relation between Eq. (1) and the cited method should be clarified, and all loss hyperparameters should be reported.
minor comments (5)
  1. [Section V-A] The sentence 'MVD was approximately 7% better PR-AUC than that (0.5008) of the LineVul models trained for each language individually and requiring nearly five times more resources' is confusing: the number 0.5008 does not appear in Table II, and the computation of the five-fold resource comparison is not described.
  2. [Table IV] The rows labeled 'w/o-X' and 'inc-X' are not defined in the table caption; the caption should explain that w/o-X denotes a model trained on all languages except X, and inc-X denotes that model after incremental learning on X.
  3. [Section V-C] The statement that 'the performance on the original languages did not degrade significantly' is not fully supported by Table IV: for example, inc-Java drops Python PR-AUC from 0.8898 to 0.8059, a relative decrease of about 9.4%, which is larger than 'modest' for that language. The claim should be qualified with the observed variance.
  4. [Section II-C] The related work on incremental learning is brief and does not discuss knowledge-distillation-based continual learning methods, which are the direct technical basis for the proposed extension module; adding a short discussion would improve context.
  5. [Figure 1] Figure 1 is difficult to read at the current resolution; the three panels would benefit from higher-resolution rendering and larger labels.

Circularity Check

0 steps flagged · score 2.0 of 10

No load-bearing circularity; the 83.7%-193.6% gain claim reflects a mismatched-baseline comparison artifact, not a derivation that assumes its conclusion.

full rationale

MVD is an empirical deep-learning paper; its claimed contributions are measurements, not first-principles derivations. The FOLA loss (Eq. 1) is a stated combination of Focal loss and logit adjustment with standard hyperparameters, and the incremental-learning objective (Eqs. 2-3) is a distillation loss; neither defines the target 'better detection' result in terms of itself. The headline percentages in the abstract, Section V-A, and the conclusion are read from the Average sub-table of Table II: e.g., 0.5376/0.2926 - 1 = 83.7% for 'better than LineVul-Python.' That sub-table averages each single-language LineVul model over all six test languages, including languages on which it was never trained, so the reported advantage is inflated; the per-language same-baseline comparison shows MVD worse on C# and JavaScript and only +0.6% on Python. This is a serious validity/baseline-construction flaw, but it is not circular: the model's predictions are not fitted to the test labels, and the reported numbers are not equivalent to the model's training objective by construction. The paper's self-citations ([20], [36], [44], [45], [48]) are used only for related-work context or data-filtering practice and are not load-bearing for the central superiority claim. There is no reliance on an author-imported uniqueness theorem and no ansatz smuggled in via citation. Therefore no significant circularity; score 2 reflects the minor non-load-bearing self-citations and the absence of any definitional reduction.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

The model depends on the CVEfixes-style labeling assumption, the transferability of CodeBERT representations, and the unbiasedness of a random function-level split. The free parameters are the loss hyperparameters (alpha, gamma, tau), whose values are not reported. No new entities are postulated.

free parameters (4)
  • tau (logit adjustment strength) = not reported
    Hyperparameter controlling the strength of the logit adjustment term in FOLA loss (Eq. 1). No value or ranges given.
  • gamma (focal loss focusing parameter) = not reported
    Hyperparameter in focal loss term of FOLA loss (Eq. 1). No value given.
  • alpha_t (class weighting factor) = not reported
    Class weighting factor in FOLA loss (Eq. 1). No value given.
  • learning rate = 2e-5
    Initial learning rate for fine-tuning CodeBERT, set to 2e-5 with cosine annealing.
assumptions (3)
  • domain assumption Functions changed in vulnerability-fixing commits are vulnerable; all other functions in the commit are non-vulnerable
    This labeling rule from CVEfixes/Big-Vul is used to build the dataset (Section IV-B). It is known to introduce label noise because not every changed function is the root cause of the vulnerability.
  • domain assumption CodeBERT's pre-trained representations transfer across the six chosen programming languages
    The framework relies on CodeBERT to encode syntactic and semantic features of Python, Java, C/C++, C#, JavaScript, and TypeScript functions (Section III-A).
  • domain assumption Random 8:1:1 split at function level yields an unbiased evaluation
    Section IV-D partitions datasets without project-level separation, assuming no leakage between training and test functions from the same project.

how reviews work

0 comments
Cite this review

Pith. "Pith review of MVD: A Multi-Lingual Software Vulnerability Detection Framework." pith.science (2026). https://pith.science/paper/3PQRTXRH

@misc{pith2026241206166,
  author       = {Pith},
  title        = {Pith review of: MVD: A Multi-Lingual Software Vulnerability Detection Framework},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3PQRTXRH}},
  note         = {Machine review of arXiv:2412.06166}
}
read the original abstract

Software vulnerabilities can result in catastrophic cyberattacks that increasingly threaten business operations. Consequently, ensuring the safety of software systems has become a paramount concern for both private and public sectors. Recent literature has witnessed increasing exploration of learning-based approaches for software vulnerability detection. However, a key limitation of these techniques is their primary focus on a single programming language, such as C/C++, which poses constraints considering the polyglot nature of modern software projects. Further, there appears to be an oversight in harnessing the synergies of vulnerability knowledge across varied languages, potentially underutilizing the full capabilities of these methods. To address the aforementioned issues, we introduce MVD - an innovative multi-lingual vulnerability detection framework. This framework acquires the ability to detect vulnerabilities across multiple languages by concurrently learning from vulnerability data of various languages, which are curated by our specialized pipeline. We also incorporate incremental learning to enable the detection capability of MVD to be extended to new languages, thus augmenting its practical utility. Extensive experiments on our curated dataset of more than 11K real-world multi-lingual vulnerabilities substantiate that our framework significantly surpasses state-of-the-art methods in multi-lingual vulnerability detection by 83.7% to 193.6% in PR-AUC. The results also demonstrate that MVD detects vulnerabilities well for new languages without compromising the detection performance of previously trained languages, even when training data for the older languages is unavailable. Overall, our findings motivate and pave the way for the prediction of multi-lingual vulnerabilities in modern software systems.

Figures

Figures reproduced from arXiv: 2412.06166 by the authors.

Figure 1
Figure 1. An overview architecture of our MVD framework for multi-lingual vulnerability prediction as compared to the traditional approach for single-language [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

48 extracted references · 23 canonical work pages

  1. [38]

    Long-tail learning via logit adjustment,

    A. K. Menon, S. Jayasumana, A. S. Rawat, H. Jain, A. Veit, and S. Kumar, “Long-tail learning via logit adjustment,” in International Conference on Learning Representations , 2021. [Online]. Available: https://openreview.net/forum?id=37nvvqkCo5

    work page 2021

  2. [1]

    A survey on automated software vulnerability detection using machine learning and deep learning,

    N. S. Harzevili, A. B. Belle, J. Wang, S. Wang, Z. Ming, N. Nagappan et al. , “A survey on automated software vulnerability detection using machine learning and deep learning,” arXiv preprint arXiv:2306.11673 , 2023

    arXiv 2023

  3. [2]

    The matter of heartbleed,

    Z. Durumeric, F. Li, J. Kasten, J. Amann, J. Beekman, M. Payer, N. Weaver, D. Adrian, V . Paxson, M. Bailey et al. , “The matter of heartbleed,” in Proceedings of the 2014 conference on internet measurement conference, 2014, pp. 475–488

    2014

  4. [3]

    Measuring the cost of cybercrime,

    R. Anderson, C. Barton, R. B ¨ohme, R. Clayton, M. J. Van Eeten, M. Levi, T. Moore, and S. Savage, “Measuring the cost of cybercrime,” The economics of information security and privacy , pp. 265–300, 2013

    work page 2013

  5. [4]

    About penetration testing,

    M. Bishop, “About penetration testing,” IEEE Security & Privacy , vol. 5, no. 6, pp. 84–87, 2007

    work page 2007

  6. [5]

    Sage: whitebox fuzzing for security testing,

    P. Godefroid, M. Y . Levin, and D. Molnar, “Sage: whitebox fuzzing for security testing,” Communications of the ACM , vol. 55, no. 3, pp. 40–44, 2012

    work page 2012

  7. [6]

    A few billion lines of code later: using static analysis to find bugs in the real world,

    A. Bessey, K. Block, B. Chelf, A. Chou, B. Fulton, S. Hallem, C. Henri- Gros, A. Kamsky, S. McPeak, and D. Engler, “A few billion lines of code later: using static analysis to find bugs in the real world,” Communications of the ACM , vol. 53, no. 2, pp. 66–75, 2010

    2010

  8. [7]

    Deep learning based vulnerability detection: Are we there yet?

    S. Chakraborty, R. Krishna, Y . Ding, and B. Ray, “Deep learning based vulnerability detection: Are we there yet?” IEEE Transactions on Software Engineering , vol. 48, no. 9, pp. 3280–3296, 2021

    2021

Show all 48 references
  1. [8]

    Sysevr: A framework for using deep learning to detect software vulnerabilities,

    Z. Li, D. Zou, S. Xu, H. Jin, Y . Zhu, and Z. Chen, “Sysevr: A framework for using deep learning to detect software vulnerabilities,” IEEE Transactions on Dependable and Secure Computing , vol. 19, no. 4, pp. 2244–2258, 2021

    2021

  2. [9]

    Vuldeepecker: A deep learning-based system for vulnerability detec- tion,

    Z. Li, D. Zou, S. Xu, X. Ou, H. Jin, S. Wang, Z. Deng, and Y . Zhong, “Vuldeepecker: A deep learning-based system for vulnerability detec- tion,” arXiv preprint arXiv:1801.01681 , 2018

    2018 arXiv

  3. [10]

    Automated vulnerability detection in source code using deep representation learning,

    R. Russell, L. Kim, L. Hamilton, T. Lazovich, J. Harer, O. Ozdemir, P. Ellingwood, and M. McConley, “Automated vulnerability detection in source code using deep representation learning,” in 2018 17th IEEE international conference on machine learning and applications (ICMLA). I...

    2018

  4. [11]

    Linevul: A transformer-based line- level vulnerability prediction,

    M. Fu and C. Tantithamthavorn, “Linevul: A transformer-based line- level vulnerability prediction,” in Proceedings of the 19th International Conference on Mining Software Repositories , 2022, pp. 608–620

    2022

  5. [12]

    Regvd: Revisiting graph neural networks for vulnerability detection,

    V .-A. Nguyen, D. Q. Nguyen, V . Nguyen, T. Le, Q. H. Tran, and D. Phung, “Regvd: Revisiting graph neural networks for vulnerability detection,” in Proceedings of the ACM/IEEE 44th International Con- ference on Software Engineering: Companion Proceedings , 2022, pp. 178–182

    2022

  6. [13]

    Polyglot software development: Wait, what?

    G. Mussbacher, B. Combemale, J. Kienzle, L. Burgue ˜no, A. Garcia- Dominguez, J.-M. J ´ez´equel, G. Jouneaux, D.-E. Khelladi, S. Mosser, C. Pulgar et al. , “Polyglot software development: Wait, what?” IEEE Software, 2024

    2024

  7. [14]

    Finding security vulnerabilities in java applications with static analysis

    V . B. Livshits and M. S. Lam, “Finding security vulnerabilities in java applications with static analysis.” in USENIX security symposium , vol. 14, 2005, pp. 18–18

    2005

  8. [15]

    On the vulnerability proneness of multilingual code,

    W. Li, L. Li, and H. Cai, “On the vulnerability proneness of multilingual code,” in Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the F oundations of Software Engineering, 2022, pp. 847–859

    2022

  9. [16]

    Empirical analysis of security vulnerabilities in python packages,

    M. Alfadel, D. E. Costa, and E. Shihab, “Empirical analysis of security vulnerabilities in python packages,” Empirical Software Engineering , vol. 28, no. 3, p. 59, 2023

    2023

  10. [17]

    Codebert: A pre-trained model for programming and natural languages,

    Z. Feng, D. Guo, D. Tang, N. Duan, X. Feng, M. Gong, L. Shou, B. Qin, T. Liu, D. Jiang et al., “Codebert: A pre-trained model for programming and natural languages,” arXiv preprint arXiv:2002.08155 , 2020

    2002 arXiv

  11. [18]

    Software vulnera- bility detection using deep neural networks: A survey,

    G. Lin, S. Wen, Q.-L. Han, J. Zhang, and Y . Xiang, “Software vulnera- bility detection using deep neural networks: A survey,” Proceedings of the IEEE , vol. 108, no. 10, pp. 1825–1848, 2020

    2020

  12. [19]

    The rise of software vulnerability: Taxonomy of software vulnerabilities detection and machine learning approaches,

    H. Hanif, M. H. N. M. Nasir, M. F. Ab Razak, A. Firdaus, and N. B. Anuar, “The rise of software vulnerability: Taxonomy of software vulnerabilities detection and machine learning approaches,” Journal of Network and Computer Applications , vol. 179, p. 103009, 2021

    2021

  13. [20]

    Linevd: Statement-level vulnerability detection using graph neural networks,

    D. Hin, A. Kan, H. Chen, and M. A. Babar, “Linevd: Statement-level vulnerability detection using graph neural networks,” in Proceedings of the 19th International Conference on Mining Software Repositories , 2022, pp. 596–607

    2022

  14. [21]

    Software vulnerability analysis and discovery using deep learning techniques: A survey,

    P. Zeng, G. Lin, L. Pan, Y . Tai, and J. Zhang, “Software vulnerability analysis and discovery using deep learning techniques: A survey,” IEEE Access, vol. 8, pp. 197 158–197 172, 2020

    2020

  15. [22]

    Devign: Effective vul- nerability identification by learning comprehensive program semantics via graph neural networks,

    Y . Zhou, S. Liu, J. Siow, X. Du, and Y . Liu, “Devign: Effective vul- nerability identification by learning comprehensive program semantics via graph neural networks,” Advances in neural information processing systems, vol. 32, 2019

    2019

  16. [23]

    Vulnerability detection with fine- grained interpretations,

    Y . Li, S. Wang, and T. N. Nguyen, “Vulnerability detection with fine- grained interpretations,” in Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the F oundations of Software Engineering, 2021, pp. 292–303

    2021

  17. [24]

    An empirical study of deep learning models for vulnerability detection,

    B. Steenhoek, M. M. Rahman, R. Jiles, and W. Le, “An empirical study of deep learning models for vulnerability detection,” in 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE) . IEEE, 2023, pp. 2237–2248

    2023

  18. [25]

    An empirical analysis of the utilization of mul- tiple programming languages in open source projects,

    P. Mayer and A. Bauer, “An empirical analysis of the utilization of mul- tiple programming languages in open source projects,” in Proceedings of the 19th International Conference on Evaluation and Assessment in Software Engineering, 2015, pp. 1–10

    2015

  19. [26]

    On multi-language software development, cross-language links and accompanying tools: a survey of professional software developers,

    P. Mayer, M. Kirsch, and M. A. Le, “On multi-language software development, cross-language links and accompanying tools: a survey of professional software developers,” Journal of Software Engineering Research and Development , vol. 5, pp. 1–33, 2017

    2017

  20. [27]

    Log4shell vulnerability on nvd

    NIST. Log4shell vulnerability on nvd. [Online]. Available: https: //nvd.nist.gov/vuln/detail/CVE-2021-44228

    2021

  21. [28]

    A systematic evaluation of large language models of code,

    F. F. Xu, U. Alon, G. Neubig, and V . J. Hellendoorn, “A systematic evaluation of large language models of code,” in Proceedings of the 6th ACM SIGPLAN International Symposium on Machine Programming , 2022, pp. 1–10

    2022

  22. [29]

    A continual learning survey: Defying forgetting in classification tasks,

    M. De Lange, R. Aljundi, M. Masana, S. Parisot, X. Jia, A. Leonardis, G. Slabaugh, and T. Tuytelaars, “A continual learning survey: Defying forgetting in classification tasks,” IEEE transactions on pattern analysis and machine intelligence , vol. 44, no. 7, pp. 3366–3385, 2021

    2021

  23. [30]

    Fine-grained incremental learning and multi-feature tossing graphs to improve bug triaging,

    P. Bhattacharya and I. Neamtiu, “Fine-grained incremental learning and multi-feature tossing graphs to improve bug triaging,” in 2010 IEEE International Conference on Software Maintenance . IEEE, 2010, pp. 1–10

    2010

  24. [31]

    Predicting bugs in source code changes with incremental learning method

    Z. Yuan, L. Yu, C. Liu, and L. Zhang, “Predicting bugs in source code changes with incremental learning method.” J. Softw., vol. 8, no. 7, pp. 1620–1633, 2013

    2013

  25. [32]

    Incremental learning for malware classification in small datasets,

    J. Li, D. Xue, W. Wu, and J. Wang, “Incremental learning for malware classification in small datasets,” Security and Communication Networks , vol. 2020, pp. 1–12, 2020

    2020

  26. [33]

    Google’s neural machine translation system: Bridging the gap between human and machine translation,

    Y . Wu, M. Schuster, Z. Chen, Q. V . Le, M. Norouzi, W. Macherey, M. Krikun, Y . Cao, Q. Gao, K. Macherey et al. , “Google’s neural machine translation system: Bridging the gap between human and machine translation,” arXiv preprint arXiv:1609.08144 , 2016

    2016 arXiv

  27. [34]

    Codesearchnet challenge: Evaluating the state of semantic code search,

    H. Husain, H.-H. Wu, T. Gazit, M. Allamanis, and M. Brockschmidt, “Codesearchnet challenge: Evaluating the state of semantic code search,” arXiv preprint arXiv:1909.09436 , 2019

    1909 arXiv

  28. [35]

    Neural machine translation of rare words with subword units,

    R. Sennrich, B. Haddow, and A. Birch, “Neural machine translation of rare words with subword units,” in Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics (V olume 1: Long Papers) , K. Erk and N. A. Smith, Eds. Berlin, Germany: Association ...

    2016

  29. [36]

    Data preparation for software vul- nerability prediction: A systematic literature review,

    R. Croft, Y . Xie, and M. A. Babar, “Data preparation for software vul- nerability prediction: A systematic literature review,” IEEE Transactions on Software Engineering , vol. 49, no. 3, pp. 1044–1063, 2022

    2022

  30. [37]

    Focal loss for dense object detection,

    T.-Y . Lin, P. Goyal, R. Girshick, K. He, and P. Doll ´ar, “Focal loss for dense object detection,” in Proceedings of the IEEE international conference on computer vision , 2017, pp. 2980–2988

    2017

  31. [39]

    Open science in software engineering: A study on deep learning-based vulner- ability detection,

    Y . Nong, R. Sharma, A. Hamou-Lhadj, X. Luo, and H. Cai, “Open science in software engineering: A study on deep learning-based vulner- ability detection,” IEEE Transactions on Software Engineering , vol. 49, no. 4, pp. 1983–2005, 2022

    1983

  32. [40]

    Learning without forgetting,

    Z. Li and D. Hoiem, “Learning without forgetting,” IEEE transactions on pattern analysis and machine intelligence , vol. 40, no. 12, pp. 2935– 2947, 2017

    2017

  33. [41]

    Cvefixes: automated collec- tion of vulnerabilities and their fixes from open-source software,

    G. Bhandari, A. Naseer, and L. Moonen, “Cvefixes: automated collec- tion of vulnerabilities and their fixes from open-source software,” in Proceedings of the 17th International Conference on Predictive Models and Data Analytics in Software Engineering , 2021, pp. 30–39

    2021

  34. [42]

    National vulnerability database

    NIST. National vulnerability database. [Online]. Available: https: //nvd.nist.gov JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 12

    2021

  35. [43]

    A c/c++ code vulnerability dataset with code changes and cve summaries,

    J. Fan, Y . Li, S. Wang, and T. N. Nguyen, “A c/c++ code vulnerability dataset with code changes and cve summaries,” in Proceedings of the 17th International Conference on Mining Software Repositories , 2020, pp. 508–512

    2020

  36. [44]

    An empirical study of rule-based and learning-based approaches for static application security testing,

    R. Croft, D. Newlands, Z. Chen, and M. A. Babar, “An empirical study of rule-based and learning-based approaches for static application security testing,” in Proceedings of the 15th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM) , 202...

    2021

  37. [45]

    Noisy label learning for security defects,

    R. Croft, M. A. Babar, and H. Chen, “Noisy label learning for security defects,” in Proceedings of the 19th International Conference on Mining Software Repositories, 2022, p. 435–447

    2022

  38. [46]

    Decoupled weight decay regularization,

    I. Loshchilov and F. Hutter, “Decoupled weight decay regularization,” in International Conference on Learning Representations , 2019. [Online]. Available: https://openreview.net/forum?id=Bkg6RiCqY7

    2019

  39. [47]

    Adam: A method for stochastic optimization,

    D. P. Kingma and J. Ba, “Adam: A method for stochastic optimization,” arXiv preprint arXiv:1412.6980 , 2014

    2014 arXiv

  40. [48]

    Data quality for software vulnerability datasets,

    R. Croft, M. A. Babar, and M. M. Kholoosi, “Data quality for software vulnerability datasets,” in 2023 IEEE/ACM 45th International Confer- ence on Software Engineering (ICSE) . IEEE, 2023, pp. 121–133

    2023

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.