Fine-Tuned LLMs Fake Security Smarts: Calibration Without Comprehension

In the year of our algorithm, 2024, a new study drops CWE-Trace—a framework built from 834 hand-picked Linux kernel samples spanning 74 CWEs. This is effectively a temporal firing range: a strict pre-2025 historical set and a post-cutoff leakage-free set, with context-aware vulnerable–patched pairs. It’s a rigorous evaluation of fine-tuned models, much like when we observed the shift from analog to digital warfare in the 1990s—the tools change, but the failure modes remain.

The central finding? Fine-tuning produces what the authors call “calibration without comprehension.” The output distributions shift to match training data, but the underlying security reasoning is absent. It’s like a trader who learns to mimic market patterns without understanding risk. The output threshold shifts, but the decision policy stays static. Evidence: stable systematic failure modes, with the Directional Failure Index (DFI) ranging from -85.5 to +94.8 percentage points, persisting from historical to post-cutoff data, resisting correction. The market was bleeding red like a bruised arm.

Data contamination provides no measurable advantage. Function-level analysis shows that 84% of nominally contaminated samples carry no usable memorization signal: vulnerable functions are absent or cross-mapped across datasets, and ~31% of contaminated samples carry CWE misclassification. The best detection score reaches only 52.1% (+2.1 pp above chance); exact CWE ranking remains below 1.3% Top-1 accuracy. This confirms that current LLMs lack reliable security reasoning for systems software, regardless of fine-tuning strategy. It’s like short-selling truth—the yield on compliance just went ex-dividend.

Interestingly, the weakest backbone at binary detection (DeepSeek-R1) gains the most in coarse CWE classification, revealing that detection and understanding are decoupled capabilities. Improving one metric does not imply improvement in the other. This is a classic market inefficiency: you can pump the numbers without fixing the fundamentals.

These findings have direct implications for AI×crypto applications. On-chain vulnerability oracles relying on fine-tuned LLMs to audit smart contracts inherit the same failure modes, potentially missing nearly half of vulnerabilities. MEV and consensus-layer security tools using LLM-based agents may be evaded by adversarial inputs that exploit backbone directional priors. Zero-knowledge proof auditing, which requires precise classification of cryptographic bugs, is undermined by the <1.3% Top-1 CWE accuracy. Decentralized AI inference markets cannot infer reasoning quality from benchmark performance alone, as detection and understanding are decoupled. Finally, token-incentivized data-labeling markets cannot reliably price contamination risk, since contaminated samples carry weak memorization signals and frequent misclassifications. The interface was cold, the latency on that script was zero; it hit the target.