| --- |
| library_name: transformers |
| license: cc-by-4.0 |
| base_model: roberta-base |
| metrics: |
| - accuracy |
| tags: |
| - generated_from_trainer |
| - text-classification |
| - classification |
| - nlp |
| - vulnerability |
| model-index: |
| - name: vulnerability-severity-classification-roberta-base |
| results: [] |
| datasets: |
| - CIRCL/vulnerability-scores |
| --- |
| |
|
|
| # VLAI: A RoBERTa-Based Model for Automated Vulnerability Severity Classification |
|
|
| # Severity classification |
|
|
| This model is a fine-tuned version of [roberta-base](https://huggingface.co/roberta-base) on the dataset [CIRCL/vulnerability-scores](https://huggingface.co/datasets/CIRCL/vulnerability-scores). |
|
|
| The model was presented in the paper [VLAI: A RoBERTa-Based Model for Automated Vulnerability Severity Classification](https://huggingface.co/papers/2507.03607) [[arXiv](https://arxiv.org/abs/2507.03607)]. |
|
|
| **Abstract:** VLAI is a transformer-based model that predicts software vulnerability severity levels directly from text descriptions. Built on RoBERTa, VLAI is fine-tuned on over 600,000 real-world vulnerabilities and achieves over 82% accuracy in predicting severity categories, enabling faster and more consistent triage ahead of manual CVSS scoring. The model and dataset are open-source and integrated into the Vulnerability-Lookup service. |
|
|
| You can read [this page](https://www.vulnerability-lookup.org/user-manual/ai/) for more information. |
|
|
|
|
| ## Model description |
|
|
| It is a classification model and is aimed to assist in classifying vulnerabilities by severity based on their descriptions. |
|
|
| ## How to get started with the model |
|
|
| ```python |
| from transformers import AutoModelForSequenceClassification, AutoTokenizer |
| import torch |
| |
| labels = ["low", "medium", "high", "critical"] |
| |
| model_name = "CIRCL/vulnerability-severity-classification-roberta-base" |
| tokenizer = AutoTokenizer.from_pretrained(model_name) |
| model = AutoModelForSequenceClassification.from_pretrained(model_name) |
| model.eval() |
| |
| print("Model revision:", model.config._commit_hash) |
| |
| test_description = "SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries \ |
| that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system." |
| inputs = tokenizer(test_description, return_tensors="pt", truncation=True, padding=True) |
| |
| # Run inference |
| with torch.no_grad(): |
| outputs = model(**inputs) |
| predictions = torch.nn.functional.softmax(outputs.logits, dim=-1) |
| |
| # Print results |
| print("Predictions:", predictions) |
| predicted_class = torch.argmax(predictions, dim=-1).item() |
| print("Predicted severity:", labels[predicted_class]) |
| ``` |
|
|
| ## Training procedure |
|
|
| ### Training hyperparameters |
|
|
| The following hyperparameters were used during training: |
| - learning_rate: 3e-05 |
| - train_batch_size: 32 |
| - eval_batch_size: 32 |
| - seed: 42 |
| - optimizer: Use OptimizerNames.ADAMW_TORCH_FUSED with betas=(0.9,0.999) and epsilon=1e-08 and optimizer_args=No additional optimizer arguments |
| - lr_scheduler_type: linear |
| - num_epochs: 5 |
| |
| It achieves the following results on the evaluation set: |
| - Loss: 2.0378 |
| - Accuracy: 0.8152 |
| - F1 Macro: 0.7487 |
| - Low Precision: 0.6544 |
| - Low Recall: 0.5105 |
| - Low F1: 0.5736 |
| - Medium Precision: 0.8440 |
| - Medium Recall: 0.8653 |
| - Medium F1: 0.8545 |
| - High Precision: 0.8110 |
| - High Recall: 0.8111 |
| - High F1: 0.8111 |
| - Critical Precision: 0.7619 |
| - Critical Recall: 0.7493 |
| - Critical F1: 0.7556 |
| |
| ### Training results |
| |
| | Training Loss | Epoch | Step | Validation Loss | Accuracy | F1 Macro | Low Precision | Low Recall | Low F1 | Medium Precision | Medium Recall | Medium F1 | High Precision | High Recall | High F1 | Critical Precision | Critical Recall | Critical F1 | |
| |:-------------:|:-----:|:-----:|:---------------:|:--------:|:--------:|:-------------:|:----------:|:------:|:----------------:|:-------------:|:---------:|:--------------:|:-----------:|:-------:|:------------------:|:---------------:|:-----------:| |
| | 2.3504 | 1.0 | 17926 | 2.6006 | 0.7357 | 0.6372 | 0.5440 | 0.3233 | 0.4056 | 0.7788 | 0.8171 | 0.7975 | 0.7123 | 0.7369 | 0.7244 | 0.6738 | 0.5764 | 0.6213 | |
| | 2.4658 | 2.0 | 35852 | 2.3303 | 0.7636 | 0.6543 | 0.7435 | 0.2598 | 0.3850 | 0.7912 | 0.8500 | 0.8195 | 0.7377 | 0.7716 | 0.7543 | 0.7336 | 0.5973 | 0.6585 | |
| | 2.0186 | 3.0 | 53778 | 2.1500 | 0.7856 | 0.7041 | 0.6568 | 0.3937 | 0.4923 | 0.8148 | 0.8526 | 0.8333 | 0.7805 | 0.7728 | 0.7767 | 0.7146 | 0.7138 | 0.7142 | |
| | 1.7673 | 4.0 | 71704 | 2.0545 | 0.8046 | 0.7352 | 0.5998 | 0.5178 | 0.5558 | 0.8334 | 0.8602 | 0.8466 | 0.8018 | 0.7995 | 0.8007 | 0.7623 | 0.7150 | 0.7379 | |
| | 1.2162 | 5.0 | 89630 | 2.0378 | 0.8152 | 0.7487 | 0.6544 | 0.5105 | 0.5736 | 0.8440 | 0.8653 | 0.8545 | 0.8110 | 0.8111 | 0.8111 | 0.7619 | 0.7493 | 0.7556 | |
| |
| |
| ### Framework versions |
| |
| - Transformers 5.14.1 |
| - Pytorch 2.13.0+cu130 |
| - Datasets 4.8.5 |
| - Tokenizers 0.22.2 |
| |
