Pith. sign in

REVIEW 5 major objections 5 minor 63 references

PatchSeeker: Mapping NVD Records to their Vulnerability-fixing Commits with LLM Generated Commits and Embeddings

T0 review · 5 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read PatchSeeker claims that mapping NVD vulnerability records to their fixing commits is best solved as dense retrieval with LLM embeddings, beat prior methods by 59.3% in MRR and 27.9% in Recall@10.

desk verdict Solid retrieval system with a genuinely useful benchmark, but the headline comparisons need a repo-disjoint split before I'd trust the margin. read the letter →

arxiv 2509.07540 v1 pith:R3XMRUKH submitted 2025-09-09 cs.SE cs.CR

Huu Hung Nguyen , Anh Tuan Nguyen , Thanh Le-Cong , Yikun Li , Han Wei Ang , Yide Yin , Frank Liauw , Shar Lwin Khin
show 3 more authors
Ouh Eng Lieh Ting Zhang David Lo
This is my paper · ORCID
classification cs.SEcs.CR
keywords NVDVFCmappingcommitmessagegenerationLLMembeddingscontrastivelearningdenseretrievalCVEPatchSeeker
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

PatchSeeker claims that vulnerability reports and fixing commits can be linked by embedding both in a shared semantic space with a fine-tuned LLM, and that synthesizing a descriptive message from the code diff repairs the cases where the original commit message is terse or deliberately silent. On a new benchmark of 5,000 CVEs across 2,070 repositories, it reports Recall@10 of 0.871 and MRR of 0.739, beating the best baseline by 27.9% and 59.3% respectively. On recent CVEs with no explicit NVD links, it reports Precision@10 of 0.710, about 97% above PatchFinder. If correct, this makes it practical to automatically enrich NVD with fix links at scale, strengthening downstream vulnerability localization, patch analysis, and dataset construction.

What carries the argument

The mechanism is a bi-encoder dense retriever. A single LLM (Qwen 3) embeds the NVD description and each candidate commit message; the last-token hidden state is the vector, cosine similarity in that space produces the ranking, and Faiss indexes the candidate embeddings for fast search. Training uses the InfoNCE contrastive loss with in-batch negatives and hard negatives drawn from a BM25 plus CoCondenser hybrid retriever. The second mechanism is commit message augmentation: CCT5, a code-change-oriented model, takes a truncated diff and generates a descriptive message for the 27.3% of commits whose original messages are too short, and that generated message is concatenated with the original before embedding.

What would settle it

Take the test CVEs whose true VFCs are known but were committed more than one year before NVD publication, or equivalently widen the candidate window to the full repository history. If PatchSeeker's Recall@10 collapses on those CVEs because the true VFC is never in the candidate set, then the one-year-window assumption, not the embedding model, is doing a large share of the work.

Watch

Extended reading notes

Core claim

The paper's central claim is that the NVD-to-VFC mapping task is best solved as dense retrieval: a contrastively fine-tuned LLM encoder (Qwen 3) maps CVE descriptions and commit messages to vectors, and cosine similarity ranks candidates. The key added move is to run CCT5 on the code diff to generate a new message whenever the developer's commit message is short or uninformative, then concatenate the generated text with the original. This generated message acts as a semantic bridge between the natural-language vulnerability description and low-level code changes, which the paper argues is exactly what previous lexical and small-model approaches lack. The paper reports that this combination outperforms both heuristic (Prospector) and learning-based (PatchFinder, PatchScout) baselines across Recall@K, MRR, and Manual Effort@K.

Load-bearing premise

The benchmark assumes that the true fixing commit for each CVE lies within one year before the NVD publication date, so any CVE whose fix was committed earlier is impossible for the method (or any baseline) to retrieve, which would lower Recall@K across the board.

Editorial extensions

If this is right

  • If the reported gains hold, NVD records can be automatically enriched with fix commits at scale; about 93% of CVEs currently lack explicit VFC links.
  • Downstream tasks that need VFCs—vulnerable version identification, vulnerability detection, and vulnerability repair—can consume PatchSeeker-linked data instead of relying on sparse manual references.
  • The ablation implies that adding synthesized commit messages yields its largest gain at the top of the ranking, with Recall@1 rising from 0.612 to 0.702, making the method most valuable for silent or minimally documented fixes.
  • The backbone-model comparison indicates that a general-purpose LLM outperformed a code-specialized smaller model (CodeReviewer) as the embedding encoder, suggesting that general LLM encoders are the right base for this retrieval task.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An extension the paper leaves implicit is applying the same augmented-message plus dense-retrieval recipe to other security-text linking problems, such as pairing security advisories with patches or bug reports with fixing pull requests.
  • The reported tokenization failure on 'multiframe' suggests a testable improvement: repairing tokenization or adding a subword-aware lexical signal could close part of the remaining gap on compound technical terms.
  • Because the benchmark's negative samples come from the same repository and one-year window, the method's Precision@K on implicit CVEs rests on the two-author manual labels; an independent re-labeling or an automated oracle could shift the reported 0.710.
  • The approach could also be evaluated as a general commit-retrieval system beyond NVD, such as retrieving the commit that introduced a bug from a bug report, where the same semantic-bridge idea would apply.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper presents PatchSeeker, a retrieval system that maps NVD/CVE records to vulnerability-fixing commits (VFCs). The method augments short or uninformative developer-written commit messages with CCT5-generated summaries of the corresponding diffs, embeds CVE descriptions and commit messages with an LLM (Qwen3) fine-tuned via the InfoNCE contrastive loss, and ranks candidates with Faiss. The authors build a benchmark of 5,000 CVEs from MoreFixes across 2,070 repositories, with negative candidates drawn from a one-year pre-publication window, and compare against PatchScout, PatchFinder, and Prospector. They report large gains (e.g., MRR 0.739 vs. 0.464 for Prospector; Recall@10 0.871 vs. 0.681), and an additional evaluation on recent CVEs with explicit and implicit VFC links. An ablation shows positive contributions from CCT5 augmentation and from the choice of backbone model.

Significance. If the results hold, PatchSeeker would be a meaningful advance in a practically important task: only a small fraction of NVD entries contain explicit Git references, and silent fixes make lexical matching unreliable. The idea of using a code-change-oriented generator to synthesize a semantic bridge between NVD text and commit messages is well motivated, and the reported gains over strong baselines are large and consistent across metrics and across the explicit-set. The authors also state that they release the benchmark and a replication package, which would aid reproducibility. The main reservations concern evaluation validity: the random split may allow repository-level leakage, the candidate window imposes an unanalyzed recall ceiling, and the implicit-set labels are author-generated; these issues should be addressed before the central comparative claim can be accepted.

major comments (5)
  1. [Section 4.2 (Dataset Construction)] The CVEs are 'randomly split' into training/validation/test without any repository-disjoint constraint. With 5,000 CVEs over 2,070 repositories, many test CVEs very likely share a repository with training CVEs; the fine-tuned Qwen3 encoder can then memorize repository-specific vocabulary, commit-message conventions, and specific commits previously seen as positives or hard negatives, while PatchFinder and Prospector are not retrained on this split and cannot exploit such overlap. This can inflate the reported +59.3% MRR and +27.9% Recall@10 margins. Please add a repository-disjoint split (e.g., hold out whole repositories), report the degree of train/test repository overlap in the current split, and verify that the recent-CVE implicit-set repositories were not seen during training.
  2. [Section 4.2 (Candidate Window)] The negative sampling strategy restricts candidates to commits within one year before the NVD publication date, justified by the statistic that 91.2% of VFCs occur in that window. Consequently, for the remaining 8.8% of CVEs the true VFC is not in the candidate pool, so no method can retrieve it and the achievable Recall@K is at most about 0.912. The paper does not report how many test CVEs fall into this excluded group or analyze them separately. Please report the ceiling, quantify the affected fraction in the test set, and consider excluding those CVEs or widening the window as a robustness check.
  3. [Sections 3.2.1 and 5.2 (CCT5 Threshold)] The condition for applying CCT5 is described only as 'too brief' in Section 3.2.1 and quantified as applying to 27.3% of commits in Section 5.2, but no concrete threshold is given. This makes the method and the ablation difficult to reproduce and leaves open the possibility that the 14.5% Recall@1 improvement depends on an arbitrary cutoff. Please specify the exact criterion (e.g., message length in words or tokens) and report sensitivity to that threshold.
  4. [Section 5.3 (Implicit-Set Labeling)] For the implicit-set, the ground-truth labels are produced by two authors who inspected the top-10 candidates output by PatchFinder, Prospector, and PatchSeeker. Because the evaluators see the systems' outputs, the labels may be biased toward confirming a candidate when a plausible commit is surfaced; moreover, true VFCs outside every system's top-10 are never considered, so Precision@10 is computed against a truncated candidate pool. Please report the inter-rater agreement, describe the resolution process, state whether labels were created blind to which system produced each candidate, and make the labeled data available.
  5. [Tables 1-4 (Variance and Significance)] Tables 1-4 present single-run point estimates without confidence intervals, standard deviations, or significance tests, yet Section 5.1 describes the advantage as 'clear and significant.' Please report results over multiple training seeds or bootstrap confidence intervals and a paired significance test (e.g., Wilcoxon) across CVEs; this is particularly important because the margins over Prospector, while large, should not be evaluated without variance information.
minor comments (5)
  1. [Section 4.3] The baseline setup sentence 'For PatchScout and PatchFinder, we used the publicly available replication packages of PatchFinder' is ambiguous; please state explicitly which replication package was used for PatchScout.
  2. [Section 5.2] The text says 'Manual Efforts@50 decreases from 0.817 to 0.825 (+1%)'; since higher Manual Effort is worse, this is an increase, and the parenthetical sign should be corrected.
  3. [Sections 1 and 5.3] There are typos in 'Manul Efforst@10' and 'emplicit-set' that should be fixed.
  4. [Section 4.2] The 91.2% one-year statistic is presented without specifying the dataset, CVE subset, or time period used for the analysis; please provide that detail.
  5. [Section 5.2] The backbone ablation reports that LLaMA 2 has a higher MRR (0.746) than the chosen Qwen3 (0.739) on the same metric; please explain explicitly why Qwen3 is selected despite this result.

Circularity Check

0 steps flagged · score 2.0 of 10

No notable circularity: PatchSeeker's gains are measured against external baselines on externally derived VFC labels; the self-cited statistics are motivational, not load-bearing.

full rationale

PatchSeeker's claimed derivation chain is empirical, not definitional. The model is a supervised bi-encoder trained with InfoNCE on positive CVE-VFC pairs whose labels come from MoreFixes and NVD (external to the proposed method), then evaluated on a held-out split of those labels. The CCT5 component uses an off-the-shelf checkpoint with no additional fine-tuning, so the generated commit messages are not fitted to the benchmark. The one-year candidate window is a design decision based on an empirical statistic about VFC timing; even if that statistic were wrong, the reported metrics would change in a falsifiable way rather than being forced to a predetermined value. The self-citations to the authors' prior study [33] (93.3%/93.4% missing VFC links, ~8% Git references) are empirical, externally checkable claims used for motivation and framing, not uniqueness theorems or hidden assumptions that define the target result. The author-constructed benchmark and author-validated implicit-set labels introduce potential bias and reproducibility concerns, but the labels are defined by code-diff evidence, commit content, and NVD/MITRE criteria, not by PatchSeeker's own scores. A repository-level train/test overlap could inflate the absolute margin over the baselines, but that is a validity threat, not circularity: the test labels are not used as training inputs, and no fitted parameter is renamed as a prediction. No equation or evaluation step reduces to its own inputs; the central claim has independent empirical content.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central claim depends on a set of hyperparameters, dataset construction choices, and inherited label quality. Most are standard for retrieval fine-tuning, but the one-year window and the underspecified CCT5 threshold are the most consequential choices.

free parameters (6)
  • InfoNCE temperature tau = 0.01
    Set in Section 4.5; controls embedding similarity sharpness; no sensitivity analysis reported.
  • Learning rate = 1e-4
    Section 4.5; chosen for fine-tuning, no sweep reported.
  • Training epochs = 3
    Section 4.5; standard choice, no early stopping discussion.
  • Candidate window = 365 days before NVD publication
    Section 4.2; based on 91.2% of VFCs in the PatchFinder dataset occurring within one year; defines the search space and potentially caps recall.
  • CCT5 generation threshold = unknown, applied to 27.3% of commits
    Section 3.2.1 and ablation; the criterion for 'short or uninformative' messages is not specified, only that 27.3% of commits were augmented.
  • CCT5 diff truncation length = 100 tokens
    Section 3.2.1; follows CCT5's original setting.
assumptions (5)
  • domain assumption MoreFixes dataset labels are accurate enough to serve as ground truth for the selected high-confidence CVE-VFC pairs.
    Section 4.2 and 6.2; the paper inherits noise from MoreFixes and NVD labels.
  • domain assumption The one-year temporal window contains the true VFC for the evaluated CVEs; restricting candidates to this window does not systematically exclude positives.
    Section 4.2; uses a 91.2% empirical statistic from the PatchFinder dataset; if positives lie outside the window, evaluation is not solvable.
  • domain assumption CCT5-generated commit messages, concatenated with original messages, faithfully summarize the code change and do not introduce misleading text.
    Section 3.2.1; the method relies on generated messages to bridge the CVE-description-to-commit gap.
  • domain assumption The manual labels for the implicit-set are correct and unbiased despite being produced by the authors.
    Section 4.5 and 5.3; two authors labeled with discussion; potential confirmation bias is acknowledged in Section 6.2.
  • standard math Standard background results (InfoNCE contrastive learning, Faiss ANN search, PyTorch training) are accepted as correct.
    Throughout; no proofs are needed but they are relied upon.

how reviews work

0 comments
Cite this review

Pith. "Pith review of PatchSeeker: Mapping NVD Records to their Vulnerability-fixing Commits with LLM Generated Commits and Embeddings." pith.science (2026). https://pith.science/paper/R3XMRUKH

@misc{pith2026250907540,
  author       = {Pith},
  title        = {Pith review of: PatchSeeker: Mapping NVD Records to their Vulnerability-fixing Commits with LLM Generated Commits and Embeddings},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/R3XMRUKH}},
  note         = {Machine review of arXiv:2509.07540}
}
read the original abstract

Software vulnerabilities pose serious risks to modern software ecosystems. While the National Vulnerability Database (NVD) is the authoritative source for cataloging these vulnerabilities, it often lacks explicit links to the corresponding Vulnerability-Fixing Commits (VFCs). VFCs encode precise code changes, enabling vulnerability localization, patch analysis, and dataset construction. Automatically mapping NVD records to their true VFCs is therefore critical. Existing approaches have limitations as they rely on sparse, often noisy commit messages and fail to capture the deep semantics in the vulnerability descriptions. To address this gap, we introduce PatchSeeker, a novel method that leverages large language models to create rich semantic links between vulnerability descriptions and their VFCs. PatchSeeker generates embeddings from NVD descriptions and enhances commit messages by synthesizing detailed summaries for those that are short or uninformative. These generated messages act as a semantic bridge, effectively closing the information gap between natural language reports and low-level code changes. Our approach PatchSeeker achieves 59.3% higher MRR and 27.9% higher Recall@10 than the best-performing baseline, Prospector, on the benchmark dataset. The extended evaluation on recent CVEs further confirms PatchSeeker's effectiveness. Ablation study shows that both the commit message generation method and the selection of backbone LLMs make a positive contribution to PatchSeeker. We also discuss limitations and open challenges to guide future work.

Figures

Figures reproduced from arXiv: 2509.07540 by the authors.

Figure 1
Figure 1. PatchSeeker is a three-phase system for identifying VFCs. In Phase 1, it processes CVE descriptions and their corresponding commit messages. In Phase 2, it fine-tunes an LLM using a bi-encoder architecture with an InfoNCE loss function. In Phase 3, this fine-tuned LLM is used as an encoder to retrieve and rank candidate VFCs. of candidate VFCs. This allows PatchSeeker to scale effectively to real-world scenarios wit… view at source ↗
Figure 2
Figure 2. Venn diagram of CVEs that PatchSeeker, PatchFinder, and Prospector correctly identified VFCs on the first prediction [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Results of RQ2: Ablation study of PatchSeeker [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

63 extracted references · 23 canonical work pages

  1. [1]

    [n. d.]. Bugzilla Redhat. https://bugzilla.redhat.com/. (Accessed on 12/15/2024)

    2024

  2. [2]

    [n. d.]. MITRE Top 25 Most Dangerous Software Weaknesses in 2024. https: //cwe.mitre.org/top25/. (Accessed on 07/17/2025)

    work page 2024

  3. [3]

    [n. d.]. NVD - Home. https://nvd.nist.gov/. (Accessed on 13/07/2025)

    work page 2025

  4. [4]

    [n. d.]. Synk.io. https://snyk.io/. (Accessed on 12/15/2024)

    2024

  5. [5]

    Jafar Akhoundali, Sajad Rahim Nouri, Kristian Rietveld, and Olga Gadyatskaya

  6. [6]

    Guru Bhandari, Amara Naseer, and Leon Moonen. 2021. CVEfixes: automated collection of vulnerabilities and their fixes from open-source software. InProceed- ings of the 17th International Conference on Predictive Models and Data Analytics in Software Engineering. 30–39

    2021

  7. [7]

    Christopher JC Burges. 2010. From ranknet to lambdarank to lambdamart: An overview.Learning11, 23-581 (2010), 81

    2010

  8. [8]

    Raymond PL Buse and Westley R Weimer. 2010. Automatically documenting program changes. InProceedings of the 25th IEEE/ACM international conference on automated software engineering. 33–42

    2010

Show all 63 references
  1. [9]

    Yizheng Chen, Zhoujie Ding, Lamya Alowain, Xinyun Chen, and David Wagner

  2. [10]

    Yiran Cheng, Lwin Khin Shar, Ting Zhang, Shouguo Yang, Chaopeng Dong, David Lo, Shichao Lv, Zhiqiang Shi, and Limin Sun. 2024. Llm-enhanced static analysis for precise identification of vulnerable oss versions.arXiv preprint arXiv:2408.07321(2024)

    2024 arXiv

  3. [11]

    Yiran Cheng, Ting Zhang, Lwin Khin Shar, Zhe Lang, David Lo, Shichao Lv, Dongliang Fang, Zhiqiang Shi, and Limin Sun. 2025. Fixseeker: An Empirical Driven Graph-based Approach for Detecting Silent Vulnerability Fixes in Open Source Software.arXiv preprint arXiv:2503.20265(2025)

    2025 arXiv

  4. [12]

    2010.Introduction to modern information retrieval

    Gobinda G Chowdhury. 2010.Introduction to modern information retrieval. Facet publishing

    2010

  5. [13]

    Luis Fernando Cortés-Coy, Mario Linares-Vásquez, Jairo Aponte, and Denys Poshyvanyk. 2014. On automatically generating commit messages via sum- marization of source code changes. In2014 IEEE 14th International Working Conference on Source Code Analysis and Manipulation. IEEE, 275–284

    2014

  6. [14]

    Yangruibo Ding, Yanjun Fu, Omniyyah Ibrahim, Chawin Sitawarin, Xinyun Chen, Basel Alomair, David Wagner, Baishakhi Ray, and Yizheng Chen. 2024. Vulnerability Detection with Code Language Models: How Far Are We? arXiv:2403.18624 [cs.SE] https://arxiv.org/abs/2403.18624

    2024 arXiv

  7. [15]

    Jinhao Dong, Yiling Lou, Qihao Zhu, Zeyu Sun, Zhilin Li, Wenjie Zhang, and Dan Hao. 2022. FIRA: Fine-Grained Graph-Based Code Change Representation for Automated Commit Message Generation. In2022 IEEE/ACM 44th International Conference on Software Engineering (ICSE). 970–981. d...

    2022

  8. [16]

    Matthijs Douze, Alexandr Guzhva, Chengqi Deng, Jeff Johnson, Gergely Szilvasy, Pierre-Emmanuel Mazaré, Maria Lomeli, Lucas Hosseini, and Hervé Jégou. 2024. The Faiss library. (2024). arXiv:2401.08281 [cs.LG]

    2024 arXiv

  9. [17]

    Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. 2024. The llama 3 herd of models.arXiv e-prints(2024), arXiv–2407

    2024

  10. [18]

    Trevor Dunlap, Elizabeth Lin, William Enck, and Bradley Reaves. 2024. VFCFinder: Pairing Security Advisories and Patches. InProceedings of the 19th ACM Asia Conference on Computer and Communications Security. 1128–1142

    2024

  11. [19]

    Jiahao Fan, Yi Li, Shaohua Wang, and Tien N Nguyen. 2020. A C/C++ code vulnerability dataset with code changes and CVE summaries. InProceedings of the 17th International Conference on Mining Software Repositories. 508–512

    2020

  12. [20]

    Lishui Fan, Jiakun Liu, Zhongxin Liu, David Lo, Xin Xia, and Shanping Li. 2024. Exploring the capabilities of llms for code change related tasks.ACM Transactions on Software Engineering and Methodology(2024)

    2024

  13. [21]

    Zhangyin Feng, Daya Guo, Duyu Tang, Nan Duan, Xiaocheng Feng, Ming Gong, Linjun Shou, Bing Qin, Ting Liu, Daxin Jiang, et al. 2020. Codebert: A pre-trained model for programming and natural languages.arXiv preprint arXiv:2002.08155 (2020)

    2020 arXiv

  14. [22]

    Luyu Gao and Jamie Callan. 2021. Unsupervised corpus aware language model pre-training for dense passage retrieval.arXiv preprint arXiv:2108.05540(2021)

    2021 arXiv

  15. [23]

    Siyuan Jiang, Ameer Armaly, and Collin McMillan. 2017. Automatically generat- ing commit messages from diffs using neural machine translation. In2017 32nd IEEE/ACM International Conference on Automated Software Engineering (ASE). IEEE, 135–146

    2017

  16. [24]

    Ruoming Jin and Dong Li. 2023. (Debiased) Contrastive Learning Loss for Rec- ommendation (Technical Report).arXiv preprint arXiv:2312.08517(2023)

    2023 arXiv

  17. [25]

    Vladimir Karpukhin, Barlas Oguz, Sewon Min, Patrick SH Lewis, Ledell Wu, Sergey Edunov, Danqi Chen, and Wen-tau Yih. 2020. Dense Passage Retrieval for Open-Domain Question Answering.. InEMNLP (1). 6769–6781. Conference acronym ’XX, Feb 24, 2025, Woodstock, NY Nguyen et al

    2020

  18. [26]

    Pavneet Singh Kochhar, Xin Xia, David Lo, and Shanping Li. 2016. Practitioners’ expectations on automated fault localization. InProceedings of the 25th interna- tional symposium on software testing and analysis. 165–176

    2016

  19. [27]

    Kaixuan Li, Jian Zhang, Sen Chen, Han Liu, Yang Liu, and Yixiang Chen. 2024. PatchFinder: A two-phase approach to security patch tracing for disclosed vul- nerabilities in open-source software. InProceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing a...

    2024

  20. [28]

    Zhiyu Li, Shuai Lu, Daya Guo, Nan Duan, Shailesh Jannu, Grant Jenks, Deep Majumder, Jared Green, Alexey Svyatkovskiy, Shengyu Fu, et al. 2022. Automating code review activities by large-scale pre-training. InProceedings of the 30th ACM Joint European Software Engineering Confe...

    2022

  21. [29]

    Bo Lin, Shangwen Wang, Zhongxin Liu, Yepang Liu, Xin Xia, and Xiaoguang Mao. 2023. Cct5: A code-change-oriented pre-trained model. InProceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering. 1509–1521

    2023

  22. [30]

    Zhongxin Liu, Zhijie Tang, Xin Xia, and Xiaohu Yang. 2023. CCRep: Learning code change representations via pre-trained code model and query back. In2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE). IEEE, 17–29

    2023

  23. [31]

    Zhongxin Liu, Xin Xia, Ahmed E Hassan, David Lo, Zhenchang Xing, and Xinyu Wang. 2018. Neural-machine-translation-based commit message generation: how far are we?. InProceedings of the 33rd ACM/IEEE international conference on automated software engineering. 373–384

    2018

  24. [32]

    Xueguang Ma, Liang Wang, Nan Yang, Furu Wei, and Jimmy Lin. 2024. Fine- Tuning LLaMA for Multi-Stage Text Retrieval. InProceedings of the 47th Interna- tional ACM SIGIR Conference on Research and Development in Information Retrieval (Washington DC, USA)(SIGIR ’24). Association...

    2024

  25. [33]

    Huu Hung Nguyen, Duc Manh Tran, Yiran Cheng, Thanh Le-Cong, Hong Jin Kang, Ratnadira Widyasari, Shar Lwin Khin, Ouh Eng Lieh, Ting Zhang, and David Lo. 2025. Mapping NVD Records to Their VFCs: How Hard is it? arXiv:2506.09702 [cs.SE] https://arxiv.org/abs/2506.09702

    2025 arXiv

  26. [34]

    Son Nguyen, Thanh Trong Vu, and Hieu Dinh Vo. 2023. VFFINDER: A graph- based approach for automated silent vulnerability-fix identification. In2023 15th International Conference on Knowledge and Systems Engineering (KSE). IEEE, 1–6

    2023

  27. [35]

    Truong Giang Nguyen, Thanh Le-Cong, Hong Jin Kang, Ratnadira Widyasari, Chengran Yang, Zhipeng Zhao, Bowen Xu, Jiayuan Zhou, Xin Xia, Ahmed E Hassan, et al . 2023. Multi-granularity detector for vulnerability fixes.IEEE Transactions on Software Engineering49, 8 (2023), 4035–4057

    2023

  28. [36]

    Georgios Nikitopoulos, Konstantina Dritsa, Panos Louridas, and Dimitris Mitropoulos. 2021. CrossVul: a cross-language vulnerability dataset with commit data. InProceedings of the 29th ACM Joint Meeting on European Software Engi- neering Conference and Symposium on the Foundati...

    2021

  29. [37]

    Aaron van den Oord, Yazhe Li, and Oriol Vinyals. 2018. Representation learning with contrastive predictive coding.arXiv preprint arXiv:1807.03748(2018)

    2018 arXiv

  30. [38]

    1995.Okapi at TREC-3

    Stephen E Robertson, Steve Walker, Susan Jones, Micheline M Hancock-Beaulieu, Mike Gatford, et al. 1995.Okapi at TREC-3. British Library Research and Devel- opment Department

    1995

  31. [39]

    Antonino Sabetta, Serena Elisa Ponta, Rocio Cabrera Lozoya, Michele Bezzi, Tommaso Sacchetti, Matteo Greco, Gergő Balogh, Péter Hegedűs, Rudolf Ferenc, Ranindya Paramitha, Ivan Pashchenko, Aurora Papotti, Ákos Milánkovich, and Fabio Massacci. 2024. Known Vulnerabilities of Ope...

    2024

  32. [40]

    Arthur D Sawadogo, Tegawendé F Bissyandé, Naouel Moha, Kevin Allix, Jacques Klein, Li Li, and Yves Le Traon. 2020. Learning to catch security patches.arXiv preprint arXiv:2001.09148(2020)

    2020 arXiv

  33. [41]

    Jie Shao, Xin Wen, Bingchen Zhao, and Xiangyang Xue. 2021. Temporal context aggregation for video retrieval with contrastive learning. InProceedings of the IEEE/CVF winter conference on applications of computer vision. 3268–3278

    2021

  34. [42]

    Xin Tan, Yuan Zhang, Chenyuan Mi, Jiajun Cao, Kun Sun, Yifan Lin, and Min Yang. 2021. Locating the Security Patches for Disclosed OSS Vulnerabilities with Vulnerability-Commit Correlation Ranking. InProceedings of the 2021 ACM SIGSAC Conference on Computer and Communications S...

    2021

  35. [43]

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yas- mine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhos- ale, et al. 2023. Llama 2: Open foundation and fine-tuned chat models.arXiv preprint arXiv:2307.09288(2023)

    2023 arXiv

  36. [44]

    Laurie Tyzenhaus. 2018. Coordinated Vulnerability Disclosure. (2018)

    2018

  37. [45]

    Qi Wan, Xiangnan He, Xiang Wang, Jiancan Wu, Wei Guo, and Ruiming Tang

  38. [46]

    Shichao Wang, Yun Zhang, Liagfeng Bao, Xin Xia, and Minghui Wu. 2022. Vc- match: a ranking-based approach for automatic security patches localization for OSS vulnerabilities. In2022 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER). IEEE, 589–600

    2022

  39. [47]

    Yue Wang, Weishi Wang, Shafiq Joty, and Steven CH Hoi. 2021. Codet5: Identifier- aware unified pre-trained encoder-decoder models for code understanding and generation.arXiv preprint arXiv:2109.00859(2021)

    2021 arXiv

  40. [48]

    Chuhan Wu, Fangzhao Wu, and Yongfeng Huang. 2021. Rethinking infonce: How many negative samples do you need?arXiv preprint arXiv:2105.13003(2021)

    2021 arXiv

  41. [49]

    Shengbin Xu, Yuan Yao, Feng Xu, Tianxiao Gu, Hanghang Tong, and Jian Lu

  42. [50]

    An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, et al. 2025. Qwen3 technical report.arXiv preprint arXiv:2505.09388(2025)

    2025 arXiv

  43. [51]

    Jinhong Yu, Yi Chen, Di Tang, Xiaozhong Liu, XiaoFeng Wang, Chen Wu, and Haixu Tang. 2024. LLM-Enhanced Software Patch Localization. arXiv:2409.06816 (Sept. 2024). doi:10.48550/arXiv.2409.06816 arXiv:2409.06816 [cs]

    2024 doi arXiv

  44. [52]

    Ting Zhang, Ivana Clairine Irsan, Ferdian Thung, and David Lo. 2025. Revisiting sentiment analysis for software engineering in the era of large language models. ACM Transactions on Software Engineering and Methodology34, 3 (2025), 1–30

    2025

  45. [53]

    Ting Zhang, Chengran Yang, Yindu Su, Martin Weyssow, Hung Nguyen, Tan Bui, Hong Jin Kang, Yikun Li, Eng Lieh Ouh, Lwin Khin Shar, et al. 2025. Benchmarking Large Language Models for Multi-Language Software Vulnerability Detection. arXiv preprint arXiv:2503.01449(2025)

    2025 arXiv

  46. [54]

    Yuxia Zhang, Zhiqing Qiu, Klaas-Jan Stol, Wenhui Zhu, Jiaxin Zhu, Yingchen Tian, and Hui Liu. 2024. Automatic commit message generation: A critical review and directions for future work.IEEE Transactions on Software Engineering50, 4 (2024), 816–835

    2024

  47. [55]

    Jiayuan Zhou, Michael Pacheco, Jinfu Chen, Xing Hu, Xin Xia, David Lo, and Ahmed E Hassan. 2023. Colefunda: Explainable silent vulnerability fix identifi- cation. In2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE). IEEE, 2565–2577

    2023

  48. [56]

    Jiayuan Zhou, Michael Pacheco, Zhiyuan Wan, Xin Xia, David Lo, Yuan Wang, and Ahmed E Hassan. 2021. Finding a needle in a haystack: Automated mining of silent vulnerability fixes. In2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE). IEEE, 705–716

    2021

  49. [57]

    Xin Zhou, Kisub Kim, Bowen Xu, DongGyun Han, and David Lo. 2024. Out of sight, out of mind: Better automatic vulnerability repair by broadening input ranges and sources. InProceedings of the IEEE/ACM 46th international conference on software engineering. 1–13

    2024

  50. [58]

    Xin Zhou, Ting Zhang, and David Lo. 2024. Large language model for vulner- ability detection: Emerging results and future directions. InProceedings of the 2024 ACM/IEEE 44th International Conference on Software Engineering: New Ideas and Emerging Results. 47–51

    2024

  51. [59]

    Yaqin Zhou, Shangqing Liu, Jingkai Siow, Xiaoning Du, and Yang Liu. 2019. Devign: Effective Vulnerability Identification by Learning Comprehensive Pro- gram Semantics via Graph Neural Networks. arXiv:1909.03496 [cs.SE] https: //arxiv.org/abs/1909.03496

    2019 arXiv

  52. [2019]

    Commit message generation for source code changes. InIJCAI

  53. [2022]

    InProceedings of the ACM web conference 2022

    Cross pairwise ranking for unbiased item recommendation. InProceedings of the ACM web conference 2022. 2370–2378

    2022

  54. [2023]

    InProceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses

    Diversevul: A new vulnerable source code dataset for deep learning based vulnerability detection. InProceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses. 654–668

  55. [2024]

    InProceedings of the 20th International Confer- ence on Predictive Models and Data Analytics in Software Engineering(Porto de Galinhas, Brazil)(PROMISE 2024)

    MoreFixes: A Large-Scale Dataset of CVE Fix Commits Mined through Enhanced Repository Discovery. InProceedings of the 20th International Confer- ence on Predictive Models and Data Analytics in Software Engineering(Porto de Galinhas, Brazil)(PROMISE 2024). Association for Compu...

    2024

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.