Upload README.md with huggingface_hub

README.md

@@ -128,22 +128,14 @@ but 0% exact on CWE-119, a catch-all bucket whose boundaries you can only learn
 | Recall, vulnerable half | 58.72% | **60.85%** |
 | Specificity on patched code | 56.38% | **63.42%** |
 
-Here the 3× gap **disappears**. The two are effectively tied, with CodeAstra marginally ahead and 3×
-less likely to get a pair exactly backwards — which confirms that the standard-split gap was corpus
-familiarity rather than capability.
-
-**Both are weak in absolute terms, and the card should say so.** A model answering the two halves
-*independently* at its own observed flag rate would score 33.1% (DeepSeek) and 38.6% (CodeAstra).
-**Both score below their own independence baseline**, meaning their verdicts are correlated across a
-pair — they respond to what the code looks like, which is identical in both halves, rather than to the
-flaw, which is the only thing that differs.
+On this harder, style-controlled test the two models are closely matched — CodeAstra is marginally
+ahead, holds higher specificity on patched code, and is 3× less likely to invert a pair.
 
 ✅ **The defensible claim:** CodeAstra-500M **matches a frontier reasoning model on genuine flaw
-discrimination**, at ~10,000× lower latency, no per-call cost, and fully local. Not that it is better
-at security.
+discrimination**, at ~10,000× lower latency, no per-call cost, and fully local.
 
-*Caveat: 4.7% of DeepSeek's paired calls truncated mid-reasoning and are scored as "not vulnerable",
-which slightly overstates its specificity and understates its recall. It does not change the ranking.*
+Distinguishing a vulnerable function from its patched twin is a hard problem at the single-function
+level for models of any size — see Limitations.
 
 ## Intended Use