Detector checkpoints for the main measurement of a study on formatting changes and missed detections

The three fine-tuned vulnerability detectors used in the main measurement of the accompanying paper, released so that its checkpoint-to-score chain can be checked rather than taken on trust. Re-scoring the study's inputs with these weights reproduces all 93,375 released score rows with no prediction change, including the headline 2,259/15,599. Contents. graphcodebert.tar.gz (config, tokenizer, weights), 12heads_linevul_model.bin, vulberta.tar.gz (config, weights). p4_checkpoint_manifest.json lists every file with its size and SHA-256; verify_checkpoints.py checks a download against them using only the standard library. Provenance. These are third-party artifacts: the GraphCodeBERT classifier distributed with the Risse and Böhme USENIX Security 2024 artifact, LineVul (Fu and Tantithamthavorn, MSR 2022), and VulBERTa (Hanif and Maffeis, IJCNN 2022). Consult each project's own terms before redistributing further. Not included. The checkpoint used for the placement comparison, whose digest begins d70f5a29, is deliberately absent; the verifier rejects it if supplied in place of a main one. What is in this record, and where each part comes from This record mirrors third-party model checkpoints alongside files produced by this study. Nothing here supersedes an upstream project's own terms: the licence field is set to Other (Open) because the record is a compilation, and each component below remains under the licence of the project that released it. Please cite the upstream work when you use these weights. FileOrigin graphcodebert.tar.gz Fine-tuned GraphCodeBERT distributed with the Risse and Böhme USENIX Security 2024 artifact. Not trained here. 12heads_linevul_model.bin LineVul checkpoint (Fu and Tantithamthavorn), scored through the authors' own linevul_model.py wrapper over microsoft/codebert-base. Not trained here. vulberta.tar.gz VulBERTa-MLP checkpoint (Hanif and Maffeis). Not trained here. placement_seed20260731.tar.gz Fine-tuned for this study. It belongs to the placement comparison only, and the artifact's verifier rejects it if supplied in place of one of the three above. code_llm_manifest.json, verify_code_llms.py Produced by this study. Per-shard SHA-256 digests and a checker for three public code LLMs (Qwen2.5-Coder-7B, DeepSeek-Coder-6.7B, CodeLlama-7B). Those weights are not deposited here; each is published in its own repository, and the digests exist so a replicator can confirm identical bytes first. llm_scope_tables.tar.gz, p4_checkpoint_manifest.json, verify_checkpoints.py, README.md Produced by this study. No source code from BigVul, DiverseVul or PrimeVul is redistributed here; those datasets remain under their own terms and must be obtained from their original sources.