增强软件漏洞预测的持续学习：通过混合-置信度感知选择性重放应对灾难性遗忘
Enhancing Continual Learning for Software Vulnerability Prediction: Addressing Catastrophic Forgetting via Hybrid-Confidence-Aware Selective Replay for Temporal LLM Fine-Tuning
AI总结：
本文提出Hybrid-CASR方法，通过置信度感知和类平衡的选性重放，提升LLM在时间漂移下的漏洞检测准确率和效率。
摘要：
近期的研究将大型语言模型（LLMs）应用于源代码漏洞检测，但大多数评估仍然依赖于随机的训练-测试分割，这忽略了时间因素并高估了现实中的性能。在实践中，检测器被部署在不断演变的代码库上，必须在时间分布偏移的情况下识别未来的漏洞。本文研究了在2018-2024年间与CVE相关的数据集上对解码器风格语言模型（Microsoft/phi-2 with LoRA）进行持续微调，该数据集被划分为双月窗口。我们评估了八种持续学习策略，包括窗口-only和累积训练、基于重放的基线和基于正则化的变体。我们提出了混合类感知选择性重放（Hybrid-CASR），一种用于二元漏洞分类的置信度感知重放方法，该方法优先选择不确定的样本，同时在重放缓冲区中保持VULNERABLE和FIXED函数的平衡比例。在双月前向评估中，Hybrid-CASR实现了宏F1值为0.667，比窗口-only基线（0.651）提高了0.016，具有统计显著性提升（p=0.026），并且在反向保留方面表现更优（IBR@1为0.741）。Hybrid-CASR还减少了17%的训练时间，而累积训练仅带来了微小的F1提升（0.661），但计算成本增加了15.9倍。总体而言，结果表明，具有类平衡的选性重放为LLM基于的时间漏洞检测在连续时间漂移下提供了实际的准确率-效率权衡。
英文摘要：
Recent work applies Large Language Models (LLMs) to source-code vulnerability detection, but most evaluations still rely on random train-test splits that ignore time and overestimate real-world performance. In practice, detectors are deployed on evolving code bases and must recognise future vulnerabilities under temporal distribution shift. This paper investigates continual fine-tuning of a decoder-style language model (microsoft/phi-2 with LoRA) on a CVE-linked dataset spanning 2018-2024, organised into bi-monthly windows. We evaluate eight continual learning strategies, including window-only and cumulative training, replay-based baselines and regularisation-based variants. We propose Hybrid Class-Aware Selective Replay (Hybrid-CASR), a confidence-aware replay method for binary vulnerability classification that prioritises uncertain samples while maintaining a balanced ratio of VULNERABLE and FIXED functions in the replay buffer. On bi-monthly forward evaluation Hybrid-CASR achieves a Macro-F1 of 0.667, improving on the window-only baseline (0.651) by 0.016 with statistically significant gains ($p = 0.026$) and stronger backward retention (IBR@1 of 0.741). Hybrid-CASR also reduces training time per window by about 17 percent compared to the baseline, whereas cumulative training delivers only a minor F1 increase (0.661) at a 15.9-fold computational cost. Overall, the results show that selective replay with class balancing offers a practical accuracy-efficiency trade-off for LLM-based temporal vulnerability detection under continuous temporal drift.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
