# PatchCon: Patch-aware Weighted Supervised Contrastive Learning for Vulnerability Detection

DevFeed: [PatchCon: Patch-aware Weighted Supervised Contrastive Learning for Vulnerability Detection](<https://devfeed.tech/articles/patchcon-patch-aware-weighted-supervised-contrastive-learning-for-vulnerability-detection-118083.md>)

Original publisher: [Read original article](<https://arxiv.org/abs/2611.06583>)

Author: Chaomeng Lu, Pooya Rostami Mazrae, Bert Lagaisse

Published: 2026-11-05T05:00:00Z

Content type: article

Language: en

Sources: [arXiv: Software Engineering](<https://devfeed.tech/sources/arxiv-software-engineering.md>)

Topics: [Machine learning](<https://devfeed.tech/topics/machine-learning.md>), [Large Language Model](<https://devfeed.tech/topics/llm.md>), [generalization in machine learning](<https://devfeed.tech/topics/generalization-in-machine-learning.md>), [Hyperparameter optimization](<https://devfeed.tech/topics/hyperparameter-optimization.md>)

Tags: [ablation](<https://devfeed.tech/tags/ablation.md>), [analysis](<https://devfeed.tech/tags/analysis.md>), [classification](<https://devfeed.tech/tags/classification.md>), [comparisons](<https://devfeed.tech/tags/comparisons.md>), [cs-se](<https://devfeed.tech/tags/cs-se.md>), [detection](<https://devfeed.tech/tags/detection.md>), [experiments](<https://devfeed.tech/tags/experiments.md>), [learning](<https://devfeed.tech/tags/learning.md>), [patch](<https://devfeed.tech/tags/patch.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [vulnerability-detection](<https://devfeed.tech/tags/vulnerability-detection.md>)

## AI overview

PatchCon combines vulnerability classification with supervised contrastive learning in a CodeBERT-based model. It gives vulnerable functions and their patched counterparts higher contrastive weight as hard negatives, aiming to distinguish subtle changes introduced by fixes. On PairVul-Linux, it outperforms the evaluated pretrained code models and contrastive baselines on classification and pairwise measures; pairwise accuracy rises from 0.2060 for the strongest reproduced baseline to 0.3264. The abstract reports pairwise accuracy comparable to a GPT-4o-based method at substantially lower cost, and the highest pairwise accuracy among reproduced models on unseen-CVE and newly disclosed vulnerability test pairs. Evaluation also includes ablations, sensitivity and significance analyses, and breakdowns by CWE type, function length, and patch size.

## Source excerpt

arXiv:2611.06583v1 Announce Type: new Abstract: Automated vulnerability detection is critical for securing modern software systems, yet existing learning-based approaches often treat functions as independent samples and underuse the supervision provided by vulnerability-fixing patches. In this paper, we propose PatchCon, a CodeBERT-based patch-aware contrastive learning model for function-level vulnerability detection. PatchCon jointly optimizes vulnerability classification and supervised contrastive learning, and treats vulnerable-patched function pairs as hard negatives with larger contrastive weights to capture subtle security-relevant differences introduced by fixes. To evaluate patch-level discrimination, we use two pairwise metrics that measure whether a model can correctly distinguish vulnerable functions from their patched counterparts. We evaluate PatchCon on PairVul-Linux through extensive experiments, including state-of-the-art comparisons, ablation studies, hyperparameter sensitivity analysis, and statistical significance testing. We also conduct fine-grained analyses by Common Weakness Enumeration (CWE) type, function length, and patch size, and further evaluate PatchCon on Linux kernel vulnerabilities disclosed after the training data cutoff. On PairVul-Linux, PatchCon outperforms representative pretrained code models and contrastive learning baselines on both classification and pairwise metrics, improves pairwise accuracy over the strongest reproduced baseline from 0.2060 to 0.3264, and achieves pairwise accuracy comparable to that of a GPT-4o-based large language model (LLM) method at a substantially lower cost. Among the reproduced models, PatchCon also achieves the highest pairwise accuracy on test pairs from Common Vulnerabilities and Exposures (CVE) entries unseen during training and on newly disclosed vulnerabilities.