Vulnerability detectors flag half of patched code as vulnerable on unfamiliar projects, and whitened mid-layer distances mark the danger zone in advance
On strictly paired vulnerable and patched C/C++ functions, whitened CodeBERT layer-3 embeddings with nearest-neighbour distance separate unfamiliar samples from familiar ones at a mean OOD AUROC of 0.739, and expose a cross-project patch false-positive rate as high as 0.507.