---
source: arxiv
url: http://arxiv.org/abs/2604.00079v1
published_at: '2026-03-31T16:16:29'
authors:
- Noor Khalal
- Chakib Fettal
- Lazhar Labiod
- Mohamed Nadif
topics:
- code-vulnerability-detection
- label-efficient-learning
- systematic-mapping
- software-security
- llm-for-code
relevance_score: 0.76
run_id: materialize-outputs
language_code: en
---

# When Labels Are Scarce: A Systematic Mapping of Label-Efficient Code Vulnerability Detection

## Summary
This paper is a systematic mapping study of label-efficient machine learning methods for code vulnerability detection. It organizes the field around how systems reduce dependence on expensive vulnerability labels and where current evaluation practice blocks fair comparison.

## Problem
- Code vulnerability detection needs labeled vulnerable code, but those labels are expensive, noisy, uneven across projects, languages, and CWE types, and often inconsistent in public datasets.
- Existing surveys mostly group work by model type or representation, which leaves a practical gap: when labels are scarce, it is hard to compare available methods, label budgets, compute cost, and deployment trade-offs.
- Weak reporting on split design, leakage control, label-budget definition, granularity, and compute assumptions makes many claimed gains hard to verify or compare.

## Approach
- The paper performs a systematic mapping of label-efficient code vulnerability detection studies, with searches across Google Scholar, ACM Digital Library, Scopus, and ScienceDirect, covering January 2006 to September 2025.
- It screens studies using explicit inclusion and exclusion criteria and builds two corpora: 46 Main-set code vulnerability detection studies and 64 Inspiration-set studies from adjacent software engineering tasks.
- It groups the literature into five paradigm families: semi-/self-supervised learning, contrastive learning, few-shot/meta-learning, prompt tuning, and LLM-based prompting or parameter-efficient adaptation.
- It tracks how these methods interact with four representation families: token-based, graph/flow-based, hybrid, and knowledge-based representations.
- It synthesizes evidence through a Design Map and a constraint-first Practitioner Decision Guide, with emphasis on label budgets, dataset setup, compute or operational cost, leakage risk, and failure modes.

## Results
- The search process started from 9,983 records, reduced to 1,994 after de-duplication and a precision-oriented filter, then to 121 full-text candidates; 69 studies were retained from full-text review, and snowballing added 47 more.
- The final dataset contains 110 studies in total: 46 Main-set CVD studies and 64 Inspiration-set studies.
- The paper claims this is the first structured mapping focused on label-efficient CVD, with an explicit label-budget lens rather than a model-family lens.
- The main concrete result is a taxonomy and evidence synthesis, not a new detector benchmark score. The excerpt does not report aggregate performance numbers such as F1, accuracy, AUC, or improvements over a common baseline.
- It identifies recurring comparison problems across studies: missing budget-performance curves, heterogeneous budget definitions such as labeled fraction, K-shot, or positives-only supervision, incomplete compute reporting, and split or leakage issues.
- It releases a public repository with curated papers, extracted metadata, and scripts used to generate figures and tables.

## Link
- [http://arxiv.org/abs/2604.00079v1](http://arxiv.org/abs/2604.00079v1)