Top Score on the Wrong Exam - On Benchmarking in Machine Learning for Vulnerability Detection

Aug 4, 2026

Upload by Oliver

Machine learning for vulnerability detection (ML4VD) research often frames vulnerability identification as a function-level binary classification task: deciding whether an isolated function contains a security flaw. Analyzing widely used ML4VD datasets, the study shows that vulnerability status typically cannot be determined without additional calling-context information. It further demonstrates that strong benchmark accuracy can be achieved through spurious correlations such as word counts, undermining evidence of real vulnerability detection capability and motivating revised benchmarking and problem statements.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages12

Reading Time30 min

AccessFree to download

Introduction

Problem formulation in prior ML4VD work

Context-dependent vulnerabilities and dataset limitations

Spurious correlations in benchmark performance

Top Score on the Wrong Exam: On Benchmarking in Machine Learning for Vulnerability Detection Niklas Risse Software Security Group MPI-SP Bochum, Germany Marcel Bhme Software Security Group MPI-SP Bochum, Germany arXiv :2408 . 12986v1 [ cs .CR] 23 Aug 2024 Abstract—According to our survey of the machine learning for vulnerability detection (ML4VD) literature published in the top Software Engineering conferences, every paper in the past 5 years defines ML4VD as a binary classification problem: Given a function, does it contain a security flaw? In this paper, we ask whether this decision can really be made without further context and study both vulnerable and nonvulnerable functions in the most popular ML4VD datasets. A function is vulnerable if it was involved in a patch of an actual security flaw and confirmed to cause the vulnerability. It is nonvulnerable otherwise. We find that in almost all cases this decision cannot be made without further context. Vulnerable functions are often vulnerable only because a corresponding vulnerabilityinducing calling context exists while non-vulnerable functions would often be vulnerable if a corresponding context existed. But why do ML4VD techniques perform so well even though there is demonstrably not enough information in these samples? Spurious correlations: We find that high accuracy can be achieved even when only word counts are available. This shows that these datasets can be exploited to achieve high accuracy without actually detecting any security vulnerabilities. We conclude that the current problem statement of ML4VDis ill-defined and call into question the internal validity of this growing body of work. Constructively, we call for more effective benchmarking methodologies to evaluate the true capabilities of ML4VD, propose alternative problem statements, and examine broader implications for the evaluation of machine learning and programming analysis research. I. INTRODUCTION In recent years, the number of papers published on the topic of machine learning for vulnerability detection (ML4VD) has dramatically increased. Because of this rise in popularity, the validity and soundness of the underlying methodologies and datasets becomes increasingly important. So then, how exactly is the problem of ML4VD defined and thus evaluated? In our survey of all 22 ML4VD papers published at the Top-4 Software Engineering conferences over the last five years [1]–[22], we find that state-of-the-art ML4VD techniques exclusively define ML4VD as a binary classification problem: Given an isolated function f, decide whether f contains a security vulnerability. The technique with the lowest classification error on the evaluation dataset is considered the best at detecting security vulnerabilities. 1 TfLiteStatus ResizeOutputTensors(TfLiteContext* context, TfLiteNode* node, 2 const TfLiteTensor* axis, 3 const TfLiteTensor* input, int num_splits) { 4 int axis_value = GetTensorData(axis)[0]; 5 // [ ] 6 const int input_size = SizeOfDimension(input, axis_value); 7 TF_LITE_ENSURE_MSG(context, input_size % num_splits == 0, 8 "Not an even split " ); 9 const int slice_size = input_size / num_splits; 10 for (int i = 0; i < NumOutputs(node); ++i) { 11 TfLiteIntArray* output_dims = TfLiteIntArrayCopy(input->dims); 12 output_dims->data[axis_value] = slice_size; 13 // [ ] 14 TF_LITE_ENSURE_STATUS(context->ResizeTensor(context, output, output_dims)); 15 } 16 return kTfLiteOk; 17 } Fig. 1: Context-dependent vulnerability (CVE-2021-29599) in DiverseVul dataset. If the function is called with num_splits=0, it crashes with a division-by-zero in Line 7 . However, based on our experience, we hypothesized that it might not always be possible to determine whether a function is vulnerable or not without additional context. We call these vulnerabilities context-dependent. Consider the example in Figure 1 . If this function from the DiverseVul benchmark dataset [2

FAQs

How does prior ML4VD work typically define the problem and evaluation task?

It defines ML4VD as a binary classification problem over isolated functions: decide whether a function contains a security vulnerability, and select the lowest classification error model on the evaluation dataset.

What are context-dependent vulnerabilities in this study?

A function may appear vulnerable only when called with a specific context; without knowing whether such a calling context occurs, the vulnerability status cannot be reliably decided.

Why can ML4VD techniques still obtain high benchmark accuracy?

The study finds spurious correlations: comparable accuracy can be achieved using features like word counts without truly detecting security vulnerabilities.

Aug 4, 2026

Upload by Oliver