Text Classification
Transformers
Safetensors
English
roberta
security
vulnerability
cve
mitre-attack
cti
multi-label-classification
negative-result
Generated from Trainer
Eval Results (legacy)
text-embeddings-inference
Instructions to use CIRCL/vulnerability-attack-technique-classification-roberta-base-llm-expanded with libraries, inference providers, notebooks, and local apps. Follow these links to get started.
- Libraries
- Transformers
How to use CIRCL/vulnerability-attack-technique-classification-roberta-base-llm-expanded with Transformers:
# Use a pipeline as a high-level helper from transformers import pipeline pipe = pipeline("text-classification", model="CIRCL/vulnerability-attack-technique-classification-roberta-base-llm-expanded")# Load model directly from transformers import AutoTokenizer, AutoModelForSequenceClassification tokenizer = AutoTokenizer.from_pretrained("CIRCL/vulnerability-attack-technique-classification-roberta-base-llm-expanded") model = AutoModelForSequenceClassification.from_pretrained("CIRCL/vulnerability-attack-technique-classification-roberta-base-llm-expanded", device_map="auto") - Notebooks
- Google Colab
- Kaggle
Update citation: paper published on arXiv (2607.25572)
Browse files
README.md
CHANGED
|
@@ -60,8 +60,8 @@ into the 972 expert-labeled training rows.
|
|
| 60 |
|
| 61 |
The paper
|
| 62 |
[*Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and
|
| 63 |
-
the Limits of LLM-Assisted Label Expansion*](https://
|
| 64 |
-
uses this pair of checkpoints to answer the question "can LLM-assisted
|
| 65 |
labeling extend a small expert gold set?" — and the answer is **no, not at
|
| 66 |
this agreement level**: no reliable ranking improvement at any expansion
|
| 67 |
size from 100 to 984 CVEs, and measurable degradation of rare-technique
|
|
@@ -230,17 +230,20 @@ The following hyperparameters were used during training:
|
|
| 230 |
| Gold dataset (1,207 CVEs, CTID-curated labels) | [CIRCL/vulnerability-attack-techniques](https://huggingface.co/datasets/CIRCL/vulnerability-attack-techniques) | [10.57967/hf/9621](https://doi.org/10.57967/hf/9621) |
|
| 231 |
| LLM expansion dataset (984 LLM-labeled CVEs) | [CIRCL/vulnerability-attack-techniques-llm-scaling](https://huggingface.co/datasets/CIRCL/vulnerability-attack-techniques-llm-scaling) | [10.57967/hf/9622](https://doi.org/10.57967/hf/9622) |
|
| 232 |
| Code | [vulnerability-lookup/VulnTrain](https://github.com/vulnerability-lookup/VulnTrain) | — |
|
| 233 |
-
| Paper
|
|
|
|
| 234 |
|
| 235 |
## Citation
|
| 236 |
|
| 237 |
```bibtex
|
| 238 |
-
@misc{
|
| 239 |
-
|
| 240 |
-
|
| 241 |
-
|
| 242 |
-
|
| 243 |
-
|
|
|
|
|
|
|
| 244 |
}
|
| 245 |
```
|
| 246 |
|
|
|
|
| 60 |
|
| 61 |
The paper
|
| 62 |
[*Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and
|
| 63 |
+
the Limits of LLM-Assisted Label Expansion*](https://arxiv.org/abs/2607.25572)
|
| 64 |
+
(arXiv:2607.25572) uses this pair of checkpoints to answer the question "can LLM-assisted
|
| 65 |
labeling extend a small expert gold set?" — and the answer is **no, not at
|
| 66 |
this agreement level**: no reliable ranking improvement at any expansion
|
| 67 |
size from 100 to 984 CVEs, and measurable degradation of rare-technique
|
|
|
|
| 230 |
| Gold dataset (1,207 CVEs, CTID-curated labels) | [CIRCL/vulnerability-attack-techniques](https://huggingface.co/datasets/CIRCL/vulnerability-attack-techniques) | [10.57967/hf/9621](https://doi.org/10.57967/hf/9621) |
|
| 231 |
| LLM expansion dataset (984 LLM-labeled CVEs) | [CIRCL/vulnerability-attack-techniques-llm-scaling](https://huggingface.co/datasets/CIRCL/vulnerability-attack-techniques-llm-scaling) | [10.57967/hf/9622](https://doi.org/10.57967/hf/9622) |
|
| 232 |
| Code | [vulnerability-lookup/VulnTrain](https://github.com/vulnerability-lookup/VulnTrain) | — |
|
| 233 |
+
| Paper | [arXiv:2607.25572](https://arxiv.org/abs/2607.25572) | — |
|
| 234 |
+
| Paper LaTeX source + trainer logs | [vulnerability-lookup/cve-attack-mapping-paper](https://github.com/vulnerability-lookup/cve-attack-mapping-paper) | — |
|
| 235 |
|
| 236 |
## Citation
|
| 237 |
|
| 238 |
```bibtex
|
| 239 |
+
@misc{bonhomme2026mappingcvesmitreattck,
|
| 240 |
+
title={Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion},
|
| 241 |
+
author={Cédric Bonhomme and Alexandre Dulaunoy},
|
| 242 |
+
year={2026},
|
| 243 |
+
eprint={2607.25572},
|
| 244 |
+
archivePrefix={arXiv},
|
| 245 |
+
primaryClass={cs.CR},
|
| 246 |
+
url={https://arxiv.org/abs/2607.25572},
|
| 247 |
}
|
| 248 |
```
|
| 249 |
|