微调让 7B 代码模型在安全审查中准确率从 4.8% 升至 96.6%
Making Small Code LLMs More Efficient for Secure Code Review with Neuro-Symbolic Fine-Tuning
想让本地小模型做代码安全审查的可以看看，Qwen2.5-Coder-7B 微调后准确率从 4.8% 干到 96.6%，还开源了带 1993 个样本的数据集。
arXiv 论文提出 secSemScan 框架，把静态分析器与本地部署的小型开源模型结合，让模型生成带程序位置、CWE 分类和可解析结论的安全审查说明。配套的 OGSM 数据集包含 1,993 个 C/C++ 函数，覆盖 22 类污点与生命周期相关的 CWE。两阶段微调后，Qwen2.5-Coder-7B 在 355 条测试记录上的结论准确率从 4.8% 提升到 96.6%，引用的 Tier 1 证据位置覆盖率达 87.5%。DeepSeek-Coder-6.7B 达到 78.9%，StarCoder2-7B 为 43.7%。评测提示中已给出结论和证据，结果衡量的是模型整合证据的能力，而非独立检测漏洞的能力。
Making Small Code LLMs More Efficient for Secure Code Review with Neuro-Symbolic Fine-Tuning
As AI coding assistants generate more code, the need to review it for security flaws grows. Existing approaches leave a gap: static analyzers identify program sites but offer little explanation, while language-model explanations can be difficult to verify. Small open-weight code models could make security review available without sending proprietary code to a hosted service. We study whether fine-tuning helps these models turn security evidence into explanations that developers and tools can check. We present secSemScan, which pairs a static analyzer with a locally deployable model that writes a schema-constrained security monologue naming program sites, assigning a CWE, and giving a machine-parseable verdict. We also introduce OGSM (Oracle-Grounded Security Monologue), a dataset of 1,993 C/C\texttt{++} functions covering 22 CWEs in the taint and lifetime families. Each record pairs a function with analyzer-derived or fix-diff-derived evidence and a monologue. We fine-tune three open-weight code models in two stages, first on the output format and then on the monologue content. Because evaluation prompts supply the verdict and evidence, our results measure how well models use that information, not whether they detect vulnerabilities independently. On 355 test records, fine-tuning raised Qwen2.5-Coder-7B's verdict accuracy from 4.8\% to 96.6\%; DeepSeek-Coder-6.7B reached 78.9\%, and StarCoder2-7B reached 43.7\%. Qwen2.5-Coder-7B cited 87.5\% of Tier~1 oracle sites, and every line it cited belonged to the oracle evidence. The results suggest that fine-tuning helps small models produce more structured, evidence-linked security reasoning.