From Evaluation to Optimisation: Hierarchy-Aware Training Signals for CWE Prediction in Python
cs.LG
Submitted: 2026-07-23
Updated: 2026-07-23
Journal ref: Adnan, M.; Srun, M.; Kuhn, C.C.N. From Evaluation to Optimisation: Hierarchy-Aware Training Signals for CWE Prediction in Python. Mach. Learn. Knowl. Extr. 2026, 8, 258
DOI: 10.3390/make8090258
License: http://creativecommons.org/licenses/by/4.0/
The gist: The original ALPHA benchmark introduced a taxonomy-aware penalty for evaluating CWE-level vulnerability prediction in Python and proposed that the penalty could theoretically also serve as a training
Terminology
Abstract
The original ALPHA benchmark introduced a taxonomy-aware penalty for evaluating CWE-level vulnerability prediction in Python and proposed that the penalty could theoretically also serve as a training signal. This paper provides that validation. We compare three delivery mechanisms: supervised fine-tuning, a dual-head classification loss, and reinforcement learning with a dense reward derived from the normalised penalty. We find that supervised approaches consistently regress below the zero-shot baseline under distribution shift, while GRPO succeeds. Our best policy reduces the cumulative ALPHA penalty of Qwen2.5-Coder-7B on Security Hardening and Adversarial Testing (SVEN) dataset by 27.9% under greedy decoding, and by 25.5% under sampled decoding(p = 0.005, Welch's t-test), reaching statistical parity with its 4.5x larger zero-shot teacher. We conclude that the value of a hierarchical penalty as a training signal depends largely on the directness of its delivery.
Sources
- Comparison of Static Application Security Testing Tools and Large Language Models for Repo-level Vulnerability Detection
- An Empirical Study of Vulnerabilities in Python Packages and Their Detection
- DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Models
- Execution-based Code Generation using Deep Reinforcement Learning
- LLM-Powered Code Vulnerability Repair with Reinforcement Learning and Semantic Reward
- Guiding AI to Fix Its Own Flaws: An Empirical Study on LLM-Driven Secure Code Generation
- Qwen2.5-Coder Technical Report
- A Study of BFLOAT16 for Deep Learning Training
Related papers
- Polynomial-Augmented Neural Networks (PANNs) with Weak Orthogonality Constraints for Enhanced Function and PDE Approximation
- AIRL-S: Unifying Reinforcement Learning and Search-Based Test-Time Scaling via Adversarial Inverse Reinforcement Learning
- Transformers as Bayesian In-Context Experimenters: Smoothness-Adaptive Efficient ATE Estimation
- Convergence issues in Relational Concept Analysis based on AOC-posets
- Beliefs Beyond Posteriors: The Predictive Cost of ELBO Binding
- Understanding Diffusion Models via Ratio-Based Function Approximation with SignReLU Networks