A small model helps rank leads to C and C++ memory bugs

In plain words

The research

What the evidence shows

• Separate search from judgment

  The vulnerability-search harness is a system that selects candidate functions in open-source C and C++ projects, ranks them for review, and leaves the finding decision to later verification. This division matters because most functions are not vulnerable, while investigating each one in depth is costly.

  Deterministic code and history checks narrow the search; a small open model helps decide what reviewers read first.

• The hard comparison is the fix

  AUC measures how often the model scores a randomly chosen vulnerable function above a comparison function.

  Intern-Decision-4B scored 0.731 against unrelated benign functions but 0.564 against each vulnerable function’s own patched version, showing that broad separation did not mean it reliably recognized the change that fixed a specific function.

• Ranking helps on a separate sample

  In this separate sample, ranking put more known fixes within a review budget of 25 functions per repository than random ordering of the same candidate lists.

  It did so for 16 of 75 public cases, compared with 11.1 expected at random, suggesting a benefit after candidate generation; this is not recall for the campaign as a whole.

• The full system found bugs

  The campaign confirmed 187 memory-safety findings across more than 4,000 projects. Each finding reproduced as a crash under AddressSanitizer, a runtime checker that detects certain memory errors when a program runs, and reproduced again on a hardened build before human sign-off.

  This is the outcome of the full search and verification system; it cannot be attributed to the decision model alone.

• Coverage and verification set limits

  The model’s role is therefore prioritization inside a larger process, not standalone detection. The known-CVE test lost most cases before scoring, and separate stronger coding agents and human review verified leads.

  The campaign’s within-queue ranking control also has a selection bias because it used only queues already known to contain findings. These conditions bound what the results say about the harness.