Article
CommunityJev Models & Reimplementations
Cyber-JEV: Matched Contrastive Fine-Tuning for Source-Code Vulnerability Triage
Fine-tuning method that turns fix commits into comparison groups so an open-weight model scores code functions for vulnerability. An ensemble of five Qwen3.5-4B models reaches 0.814 AUROC on a 7,270-function benchmark, against 0.743 for Jev 1.13.
- Format
- Article
- Reading time
- 2 min
- Published by
- Community
- Added
- Nov 2026
Highlights
- Uses fix commits to build groups holding a vulnerable function, its patched version, and up to two unchanged functions from the same file.
- One shared model learns two tasks: classifying functions from labeled reference data and ranking the vulnerable function above its group members.
- An ensemble of five fine-tuned Qwen3.5-4B models reaches 0.814 AUROC on a test benchmark of 7,270 functions.
- Jev 1.13 scores 0.743 AUROC on the same benchmark.
- At Jev's 4,031-alert review budget it misses 16 of 322 vulnerable functions instead of 39.
Questions about this entry
Short answers drawn from the linked project or page.
Cyber-JEV is a fine-tuning method for single-pass source-code vulnerability scoring. It trains an open-weight model to give each code function a vulnerability probability, so security teams can rank many functions for review without generating written explanations.
It uses fix commits to turn vulnerability records into comparison groups. Each group holds a vulnerable function, its patched version, and up to two unchanged functions from the same file, so the model sees the change that removed a recorded defect.
The reported setup fine-tunes Qwen3.5-4B models and evaluates an ensemble of five of them. One shared model learns both the classification task on labeled reference data and the ranking task within comparison groups.
On a test benchmark of 7,270 functions, the ensemble of five fine-tuned Qwen3.5-4B models reaches an area under the receiver operating characteristic curve of 0.814, compared with 0.743 for Jev 1.13.
Using the 4,031 alerts of Jev as the review budget, Cyber-JEV misses 16 of 322 vulnerable functions, while the comparison figure for Jev 1.13 is 39 missed vulnerable functions.
At test time the input is a single code function and the output is a vulnerability score. No written explanation is generated, which is what allows many functions to be ranked in a single pass.
The scores can order the changed functions of a pull request or a release for review under a fixed budget, letting a security team spend a limited number of alerts on the highest-scoring functions first.
Reactions & coverage
Posts, threads, and videos about this entry from around the web.
X: Standard One SH (StandardThinking)
YouTube: Kubernetes admission control with a decision model, fail-closed.
LinkedIn: What multimodal decision models actually change, and what they do not.
LinkedInJevDirectory.org
Hacker News: Decision Index 0.2.1 scores open reproductions of Jev on a frozen suite.
jackbravo4 pointsDecision Index 0.2.1 – 70 open reproductions of TypeSafe Jev's Decision ModelRead the thread on Hacker NewsFrom the Jev guides
Original write-ups on what this entry is for.
From the Jev AI model community
Posts from builders shipping with Jev right now.