arXiv:2509. 20491v3 Announce Type: replace-cross Abstract: Machine Learning (ML) pipelines encode quality-relevant decisions across data preparation, training, evaluation, and configuration code.
arXiv:2606. 09957v1 Announce Type: cross Abstract: Semantic faults specific to the use of machine learning models are a common problem for machine learning developers, causing suboptimal predictions, high computational cost, or incorrect outputs.
arXiv:2607. 10411v1 Announce Type: cross Abstract: Large Language Models (LLMs) are increasingly used for code smell detection tasks due to their ability to interpret program semantics.
The paper introduces SWE-Flux, a repository‑level benchmark designed to test large language models’ ability to reason about runtime behavior. It contains 480 execution‑grounded instances from 12 real Python repositories, with gold answers automatically harvested from instrumented test executions. Evaluation of five LLMs shows the task remains difficult, with the best model achieving only 37% accuracy, and the benchmark can generate challenging variants through input perturbation.
The paper introduces CodeScan, a black-box, vulnerability-oriented scanning framework designed to detect data poisoning and backdoor attacks in code generation large language models (LLMs). CodeScan operates by analyzing structural similarities across multiple code generations, normalizing them with abstract syntax tree (AST) techniques, and then applying LLM-based vulnerability analysis to identify recurring insecure patterns. Evaluations on 117 models across three architectures and multiple sizes show over 97% detection accuracy with fewer false positives compared to prior methods.
arXiv:2506. 02791v4 Announce Type: replace-cross Abstract: In recent years, code intelligence has gained increasing importance in the field of automated software engineering.
arXiv:2606. 19149v1 Announce Type: cross Abstract: Automated vulnerability discovery in large codebases remains challenging: traditional static analysis produces high false-positive rates, while dynamic approaches such as fuzzing require substantial infrastructure and often target narrow classes of bugs.
arXiv:2509. 14335v2 Announce Type: replace-cross Abstract: Automated malware classifiers achieve strong detection performance, but auditing requires more than flagging a sample: analysts must explain malicious behaviors and justify them with code evidence.
arXiv:2606. 17283v1 Announce Type: cross Abstract: Achieving reproducibility, quantity, and diversity in vulnerability datasets has long been viewed as an inherent three-way trade-off, where improving one dimension often comes at the cost of the others.
arXiv:2512. 22827v2 Announce Type: replace-cross Abstract: Code often suffers from performance bugs.
arXiv:2507. 22580v2 Announce Type: replace-cross Abstract: Automated Program Repair (APR) seeks to automatically correct software bugs without requiring human intervention.
arXiv:2606. 16244v1 Announce Type: cross Abstract: Large language models routinely generate code with exploitable security flaws.
The paper surveys 87 influential studies on machine‑learning‑based automated vulnerability detection (ML4AVD), categorizing them by problem formulation, input and detection granularity, target languages, evaluation metrics, datasets, and detection approaches. It identifies twelve self‑reinforcing pain points—such as overreliance on binary classification of C/C++ function‑level vulnerabilities, limited language coverage, and intertwined datasets, baselines, and metrics—that trap the field in a narrow, artificial problem space. The authors propose concrete recommendations to break these feedback loops and evaluate a recent high‑profile effort, AIxCC, against these guidelines, reflecting on ML4AVD’s relevance amid the rise of agentic AI.