LATIDIA · Ciberseguridad

Cuando los modelos saben pero no pueden decir linealmente: la codificación relacional limita la clasificación de vulnerabilidad lineal en los LLM de código

arXiv:2610.27257v1 Announce Type: new Resumen: Los modelos de lenguaje grandes pueden detectar código vulnerable, pero la forma de codificación de vulnerabilidades en sus representaciones sigue sin estar clara. Analizamos 8 modelos de código que abarcan 6.7B-15

La noticia

arXiv:2610.27257v1 Announce Type: new Abstract: Large language models can detect vulnerable code, yet the form of vulnerability encoding in their representations remains unclear. We analyze 8 code models spanning 6.7B-15B parameters on C programs using three datasets (DELTASECOMMITS, SVEN, and PRECISE-BUGS), comparing two diagnostic tasks on the same representations: identifying what patterns the code instantiates, and determining whether it is vulnerable. Models encode the first with high fidelity. Under the studied paired C-code datasets and linear-probing setup, vulnerability information is more accessible as a paired relational signal-whether code A is riskier than code B-than as a globally separable categorical label. This structural difference has implications for classification: the model reliably