一句话：系统实证研究代码语言模型漏洞检测中的不确定性估计，揭示校准与不确定性增强方法的有效性依赖模型规模与标签条件建模。
代码语言模型（CLM）正被广泛用于漏洞检测，但其预测何时可信仍缺乏依据。本文是一篇经验论文，对基于 CLM 的漏洞检测中的不确定性估计进行了系统性实证研究：在 1,050 个真实项目上，覆盖 8 个 2B–16B 参数规模的模型，评估 4 种校准方法与 2 类不确定性驱动的增强框架，并分别在分布内与分布外设置下考察。研究发现：(1) 校准效果依赖模型规模——温度缩放与集成方法稳定有效，而 Monte Carlo Dropout 与贝叶斯低秩适配反向传播仅对约 6B–7B 的中等规模模型有益；(2) 基于不确定性的纠错必须采用标签条件建模才有效，在分布外数据上最多提升 12% Macro-F1，而全局策略效果可忽略；(3) 课程学习未能超越标准微调，因为基于不确定性的难度排序与模型学到的决策边界不一致，导致训练不稳定或收益甚微。这些结果挑战了不确定性方法可普遍迁移的假设，并为部署不确定性感知的漏洞检测提供了实践指南。
Code Language Models (CLMs) are increasingly adopted for vulnerability detection, yet knowing when to trust their predictions remains an open challenge. Uncertainty estimation has improved reliability in traditional discriminative models, but whether these benefits transfer to the generative paradigm of CLMs is unclear. This experience paper presents a systematic empirical study of uncertainty estimation in CLM-based vulnerability detection, evaluating four calibration methods and two uncertainty-driven enhancement frameworks across eight models (2B--16B parameters) under both in-distribution and out-of-distribution settings on 1,050 real-world projects. Our study reveals that: (1) calibration effectiveness is model-scale dependent: temperature scaling and ensembles deliver consistent gains, while Monte Carlo Dropout and Bayesian Low-Rank Adaptation by Backpropagation only benefit medium-scale models (approximately 6B--7B parameters); (2) uncertainty-based correction requires label-conditional modeling to be effective (up to 12% Macro-F1 improvement on out-of-distribution data), as global strategies show negligible effects; (3) curriculum learning fails to improve upon standard fine-tuning, as uncertainty-based difficulty ordering does not align with the learned decision boundary, causing training instability or negligible gains. These findings challenge assumptions about the universal transferability of uncertainty methods and provide practical guidelines for deploying uncertainty-aware vulnerability detection.
@inproceedings{paperbot12198,
title = {Harnessing Uncertainty in Code Language Models: Lessons from Vulnerability Detection},
author = {Haodong Li and Xiao Cheng and Xudong Wang and Zhihao Guo and Haoyu Wang},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3837465}
}