Skip to content

Article

Cyber-JEV: Matched Contrastive Fine-Tuning for Source-Code Vulnerability Triage

Fine-tuning method that turns fix commits into comparison groups so an open-weight model scores code functions for vulnerability. An ensemble of five Qwen3.5-4B models reaches 0.814 AUROC on a 7,270-function benchmark, against 0.743 for Jev 1.13.
Format
Article
Reading time
2 min
Published by
Community
Added
Nov 2026

Highlights

  • Uses fix commits to build groups holding a vulnerable function, its patched version, and up to two unchanged functions from the same file.
  • One shared model learns two tasks: classifying functions from labeled reference data and ranking the vulnerable function above its group members.
  • An ensemble of five fine-tuned Qwen3.5-4B models reaches 0.814 AUROC on a test benchmark of 7,270 functions.
  • Jev 1.13 scores 0.743 AUROC on the same benchmark.
  • At Jev's 4,031-alert review budget it misses 16 of 322 vulnerable functions instead of 39.

Questions about this entry

Short answers drawn from the linked project or page.

Reactions & coverage

Posts, threads, and videos about this entry from around the web.

X: Standard One SH (StandardThinking)

YouTube: Kubernetes admission control with a decision model, fail-closed.

LinkedIn: What multimodal decision models actually change, and what they do not.

LinkedInJevDirectory.org

From the Jev guides

Original write-ups on what this entry is for.

From the Jev AI model community

Posts from builders shipping with Jev right now.

Follow @typesafeai