When Models Know but Can't Linearly Say: Relational Encoding Limits Linear Vulnerability Classification in Code LLMs

Reported by arXiv cs.CR (Rui Melo, Andre Catarino, Claudia Mamede, Corina Pasareanu, Rui Abreu)

Summary by Cyber Security News21 Oct 2026, 06:00 CET

About this summary. This is a short excerpt from the description that arXiv cs.CR published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://arxiv.org/abs/2610.27257

arXiv:2610.27257v1 Announce Type: new Abstract: Large language models can detect vulnerable code, yet the form of vulnerability encoding in their representations remains unclear. We analyze 8 code models spanning 6.7B-15B parameters on C programs using three datasets (DELTASECOMMITS, SVEN, and PRECISE-BUGS), comparing two diagnostic tasks on the same representations: identifying what patterns the code instantiates, and determining whether it is vulnerable.

Read the full article at arXiv cs.CR →

Source attribution: headline and facts are from arXiv cs.CR (arxiv.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

Secure and Functional Code Generation with Self-Evaluation

VulDec: Vulnerability Detection in Binaries via Neural Decompilation

Enhancing LLM-Based Vulnerability Detection via Representation-Aware Logical Ensemble

SEMPRE: Semantic-Aware Protocol Reverse Engineering via Consistency-Driven Joint Optimization

Black-Box Red-Teaming of Multi-Agent Systems via Reinforcement Learning

SecReason: Vulnerability Detection and In-Stream Self-Repair for LLM Code Generation