一句话：系统重评代码语言模型检测安全补丁的能力，发现模型规模增益有限且代码上下文无可靠提升。
针对漏洞修复提交（VFC）自动检测对及时部署安全补丁至关重要、但公告数据库严重滞后且许多修复无公告的问题，本文重新评估代码语言模型能否仅从代码变更识别安全修复。作者构建统一框架，整合20个碎片化数据集、超过18万次提交，并训练125M至80B参数的270个模型。在按组分层的仅代码评估下，隔离代码信号，并考察模型容量与从过程内增强到跨过程仓库上下文的额外代码上下文影响。结果表明：模型容量带来清晰但不足的增益；在严格假阳性预算下，所评估的上下文信号未提供可靠提升。
Automated detection of vulnerability-fixing commits (VFCs) is critical for timely security patch deployment, as advisory databases lag patch releases by a median of 25 days and many fixes never receive advisories. Code language models are increasingly adopted for identifying , yet whether they can recognize a security fix from the code change itself remains unclear, as reported performance is shaped by commit messages, project-level data leakage, and uncertain data quality. We present a rigorous re-evaluation that jointly controls these factors through a unified framework consolidating 20 fragmented datasets spanning more than 180000 commits. Training 270 models from 125M to 80B parameters, we isolate the code signal under group-stratified code-only evaluation and assess the impact of model capacity and additional code context, ranging from intra-procedural enrichment to inter-procedural repository context. Model capacity yields clear but insufficient gains, and the evaluated context signals provide no reliable improvement under strict false positive budgets. At a false positive rate of 0.5
@inproceedings{paperbot12452,
title = {A Comprehensive Evaluation of Code Language Models for Security Patch Detection},
author = {Nils Loose and Joseph Bienhüls and Kristoffer Hempel and Felix Mächtle and Thomas Eisenbarth},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3837538}
}