When Labels Are Scarce: A Systematic Mapping of Label-Efficient Code Vulnerability Detection

2026-03-31

AI Summary

This work addresses the critical challenges in code vulnerability detection—namely, the scarcity of high-quality labels, substantial noise, and imbalanced data distributions—all of which heavily rely on costly manual annotation. The study presents the first systematic mapping framework for label-efficient vulnerability detection, organizing existing approaches into five paradigm families: weak supervision, self-supervision, transfer learning, and others. It further links these paradigms to diverse code representations, including token-based, graph-based, hybrid, and knowledge-enhanced forms. By introducing a design taxonomy and a constraint-prioritized decision guide, the paper clarifies the applicability and failure modes of each method, exposes key obstacles such as inconsistent evaluation protocols, and establishes a unified perspective for evaluating and selecting techniques under label-scarce conditions.

Technology Category

Computer Vision: Adversarial Attacks & RobustnessMachine Learning: Multi-class/Multi-label Learning & Extreme ClassificationReasoning under Uncertainty: Uncertainty Representations

Application Category

Search and Retrieval-Augmented AI: Web evaluation methodologies and metricsGraph Algorithms and Modeling for the Web: Representation, reconstruction, and subgraph or motif discovery in Web-related graphsWeb Mining and Content Analysis: Robustness and generalizability of Web mining methods

Abstract

Machine-learning-based code vulnerability detection (CVD) has progressed rapidly, from deep program representations to pretrained code models and LLM-centered pipelines. Yet dependable vulnerability labeling remains expensive, noisy, and uneven across projects, languages, and CWE types, motivating approaches that reduce reliance on human labeling. This survey maps these approaches, synthesizing five paradigm families and the mechanisms they use. It connects mechanisms to token, graph, hybrid, and knowledgebased representations, and consolidates evaluation and reporting axes that limit comparison (label-budget specification, compute/cost assumptions, leakage, and granularity mismatches). A Design Map and constraintfirst Decision Guide distill trade-offs and failure modes for practical method selection.

Problem

• code vulnerability detection
• label scarcity
• label efficiency
• vulnerability labeling
• machine learning

Innovation

• label-efficient learning
• code vulnerability detection
• systematic mapping
• pretrained code models
• evaluation standardization