Vulnerability detectors flag half of patched code as vulnerable on unfamiliar projects, and whitened mid-layer distances mark the danger zone in advance

A vulnerability detector's reliability falls as code moves away from its training distribution, and whitened intermediate-layer embedding distance turns that fall into a readable continuous signal. Earlier evaluations mostly relied on in-distribution test sets sharing projects, coding styles and time periods with training, so high scores hid degradation under distribution shift. On a strictly paired vulnerable-patch dataset, splitting test samples into ten equal-frequency distance bins shows accuracy falling from 0.834 in the lowest-distance bin to 0.479 in the highest, a drop of more than 35 percentage points, while the patch false-positive rate rises from 0.167 to 0.631.

The method whitens the encoder's intermediate-layer representation and then measures how far a sample sits from the training distribution using nearest-neighbour cosine distance. Raw contextual embeddings are anisotropic and cluster in a few dominant directions, so surface syntax and project naming drown out the subtle semantic delta of the repair itself. Across a grid of CodeBERT layers 0 to 12 and several distance settings, raw embeddings with cosine nearest neighbours reach a best mean OOD AUROC of 0.710, whitening raises it to 0.739, a diagonal Mahalanobis baseline reaches only 0.547, and the signal is strongest with a single nearest neighbour and degrades monotonically as the neighbourhood grows.

A patch being flagged as vulnerable is directly tied to how close it sits to vulnerable training neighbourhoods in the embedding space. Aggregate metrics report overall correctness but cannot explain why false alarms concentrate on already-repaired code. On the patched-only test subset, false positives have 51.1% vulnerable training samples among their top ten neighbours versus 46.0% for correctly classified patches, with an AUROC of 0.636 for the distance ratio, and the patch false-positive rate climbs from 9.4% in the lowest proximity decile to 58.8% in the highest.

The diagnostic targets seven memory and resource-safety weakness classes in C and C++, evaluated on strictly paired vulnerable and patched functions that retain project, temporal and patch-diff-cluster metadata for partition assignment. Distance scores come from a frozen intermediate-layer encoder representation, so an existing scanner can be stratified by risk without gradient updates, routing geometrically distant or entangled functions to human review.

The paired design excludes the arbitrary benign code common in deployment, and real tools must scan whole functions without knowing the vulnerability location, whereas this setup uses pair-aligned multi-hunk extraction. Patch-diff clusters are an automated proxy for fix categories rather than a manually validated semantic taxonomy, and the source datasets may contain label noise or non-security refactoring. Evaluation is limited to CodeBERT and Qwen2.5-Coder-7B, specific held-out projects and a 2024 temporal cutoff.