vuteco-ct5p-fnd is a fine-tuned CodeT5+ that classifies JUnit test methods into two classes:
Witnessing if it is testing for a vulnerability.
Unknown if it is unclear whether it is testing for a vulnerability.
Model Details
Model Description
VuTeCo is a framework for finding vulnerability-witnessing test cases in Java repositories (Finding) and match them with the right known vulnerability (Matching).
More info in its GitHub repository.
This model (vuteco-ct5p-fnd) is a fine-tuned CodeT5+ with a classification head on top of it.
This model is used in VuTeCo for the "Finding" task, which can classify JUnit test methods into two classes (it actually returns a probability, with 0.5 used as a classification threshold):
Witnessing if it is testing for a vulnerability.
Unknown if it is unclear whether it is testing for a vulnerability.
The model input is the tokenized raw text of a JUnit test method, with no preprocessing.
The model can be used right away to classify specific types of vulnerability-witnessing tests, e.g., distinguishing the exact vulnerability types that is tested.
Downstream Use [optional]
The model can be further fine-tuned to classify specific types of vulnerability-witnessing tests, e.g., distinguishing the exact vulnerability types that is tested.
It could also be fine-tuned for other testing frameworks (beyond JUnit) and programming languages (Python).
Out-of-Scope Use
N/A
Bias, Risks, and Limitations
The model predictions may be inaccurate (misclassified test methods).
In particular, the reported performance show the model has limited recall, so it often says Unknown (i.e., returns low probability scores).
Recommendations
Manually validate the predictions made by the model.
This model was fine-tuned on Java repositories and vulnerabilities from Vul4J.
Please refer to VuTeCo's GitHub repository for loading the dataset in the correct way.
Please, refer to the MSR'26 paper for an overview of the main evaluation results.
The complete raw results can be found in the paper's online appendix on Zenodo.
Model Examination [optional]
[More Information Needed]
Environmental Impact
N/A
Citation
If you use this model, please cite the MSR'26 paper (the publisher's reference will be available soon):
BibTeX:
@misc{iannone2026matchheavenaidrivenmatching,
title={A Match Made in Heaven? AI-driven Matching of Vulnerabilities and Security Unit Tests},
author={Emanuele Iannone and Quang-Cuong Bui and Riccardo Scandariato},
year={2026},
eprint={2502.03365},
archivePrefix={arXiv},
primaryClass={cs.SE},
url={https://arxiv.org/abs/2502.03365},
}
