@inproceedings{melo-etal-2026-models,
title = "When Models Know but Can{'}t Say: Relational Encoding Limits Linear Vulnerability Classification in Code {LLM}s",
author = "Melo, Rui and
Catarino, Andre and
Mamede, Claudia and
Pasareanu, Corina S. and
Abreu, Rui",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {EMNLP} 2026",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.findings-emnlp.1252/",
pages = "26461--26497",
ISBN = "979-8-89176-462-0",
abstract = "Large language models can detect vulnerable code, yet whether their internal representations encode vulnerability information in a form accessible to standard classifiers remains unresolved. We analyze 8 code models on C programs using three datasets (DELTASECOMMITS, SVEN, and PRECISE BUGS). LLMs represent vulnerability relational encoding {---}code B is more vulnerable than code A{---}rather than categorically, making the information inaccessible to standard classification probes. We find 87{--}88{\%} per-pair alignment across layers L3-L23, yet this direction produces limited categorical accuracy because vulnerable and secure samples form overlapping distributions. This structural property{---}relational rather than categorical encoding{---}explains the difficulty of categorical classification in pretrained, general-purpose code LLMs, and motivates ranking and preference-learning approaches as more natural for vulnerability assessment."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="melo-etal-2026-models">
<titleInfo>
<title>When Models Know but Can’t Say: Relational Encoding Limits Linear Vulnerability Classification in Code LLMs</title>
</titleInfo>
<name type="personal">
<namePart type="given">Rui</namePart>
<namePart type="family">Melo</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Andre</namePart>
<namePart type="family">Catarino</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Claudia</namePart>
<namePart type="family">Mamede</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Corina</namePart>
<namePart type="given">S</namePart>
<namePart type="family">Pasareanu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Rui</namePart>
<namePart type="family">Abreu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-462-0</identifier>
</relatedItem>
<abstract>Large language models can detect vulnerable code, yet whether their internal representations encode vulnerability information in a form accessible to standard classifiers remains unresolved. We analyze 8 code models on C programs using three datasets (DELTASECOMMITS, SVEN, and PRECISE BUGS). LLMs represent vulnerability relational encoding —code B is more vulnerable than code A—rather than categorically, making the information inaccessible to standard classification probes. We find 87–88% per-pair alignment across layers L3-L23, yet this direction produces limited categorical accuracy because vulnerable and secure samples form overlapping distributions. This structural property—relational rather than categorical encoding—explains the difficulty of categorical classification in pretrained, general-purpose code LLMs, and motivates ranking and preference-learning approaches as more natural for vulnerability assessment.</abstract>
<identifier type="citekey">melo-etal-2026-models</identifier>
<location>
<url>https://aclanthology.org/2026.findings-emnlp.1252/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>26461</start>
<end>26497</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T When Models Know but Can’t Say: Relational Encoding Limits Linear Vulnerability Classification in Code LLMs
%A Melo, Rui
%A Catarino, Andre
%A Mamede, Claudia
%A Pasareanu, Corina S.
%A Abreu, Rui
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F melo-etal-2026-models
%X Large language models can detect vulnerable code, yet whether their internal representations encode vulnerability information in a form accessible to standard classifiers remains unresolved. We analyze 8 code models on C programs using three datasets (DELTASECOMMITS, SVEN, and PRECISE BUGS). LLMs represent vulnerability relational encoding —code B is more vulnerable than code A—rather than categorically, making the information inaccessible to standard classification probes. We find 87–88% per-pair alignment across layers L3-L23, yet this direction produces limited categorical accuracy because vulnerable and secure samples form overlapping distributions. This structural property—relational rather than categorical encoding—explains the difficulty of categorical classification in pretrained, general-purpose code LLMs, and motivates ranking and preference-learning approaches as more natural for vulnerability assessment.
%U https://aclanthology.org/2026.findings-emnlp.1252/
%P 26461-26497
Markdown (Informal)
[When Models Know but Can’t Say: Relational Encoding Limits Linear Vulnerability Classification in Code LLMs](https://aclanthology.org/2026.findings-emnlp.1252/) (Melo et al., Findings 2026)
ACL