Preprint Shows Fine-Tuned 3.8B Phi-3.5-mini Predicts CVSS and CWE from CVE Text
An arXiv preprint released October 16 2026 finds that a small language model fine-tuned with LoRA in 2.5 hours on an Apple M5 Pro reaches 69.9 percent severity-tier accuracy…
- Fine-tuned 3.8B Phi-3.5-mini matches official CVSS vectors exactly for 48.8 percent of 36,325 test CVEs and beats TF-IDF logistic regression by 2.8-4.7 accuracy points.
- Ensembling the fine-tuned model with the TF-IDF baseline yields correct severity tier for 75.8 percent of cases because their errors affect different CVEs.
- Small locally runnable models can help close the CVE labeling gap created by NIST's post-April 2026 policy of enriching only high-priority entries.
NIST Labeling Policy Change
Until April 2026 the National Vulnerability Database labeled nearly every CVE with a CVSS v3.1 vector, severity tier and CWE type. NIST now enriches only high-priority entries, leaving many new vulnerabilities without the standardized metadata security teams use for patch triage.
This arXiv preprint, whose abstract is the sole evidence available, examines whether small language models can generate those missing labels from CVE description text alone.
Experimental Design
To prevent leakage between near-duplicate descriptions, all systems were trained only on CVEs published in 2022 and 2023. Evaluation covered the full set of 36,325 usable 2024 CVEs from a pinned NVD snapshot.
The eight base CVSS vector components are predicted directly, the base score and severity tier are then derived with the official formula, and CWE is classified separately.
Model Performance
A 3.8-billion-parameter Phi-3.5-mini model fine-tuned with LoRA on a single Apple M5 Pro chip in 2.5 hours achieved 69.9 percent severity accuracy, 70.9 percent CWE accuracy and an exact official vector match on 48.8 percent of test CVEs.
It outperformed a TF-IDF logistic-regression baseline by 2.8 to 4.7 points on all accuracy metrics according to zero-exclusion paired bootstrap intervals. The untuned base model reached only 20.8 percent severity accuracy in a 2,000-CVE zero-shot sample.
Ensemble Benefits
Deriving severity scores from predicted vectors increased the critical recall of the TF-IDF baseline from 50.7 percent to 73.3 percent at no extra cost.
Because the fine-tuned model and TF-IDF baseline make errors on different CVEs, at least one system matches the correct severity tier for 75.8 percent of the 2024 test cases.
