SPI (security patch identification)

Gemma 2 27B 53% Only in system cards

Models decide whether code commits from open-source projects are security patches.

Dataset from SPI: Automated Identification of Security Patches via Commits, ACM TOSEM 2021. Google reports accuracy.

Made by Zhou et al. Released Jan 2021 Finding and exploiting real bugs All tasks public Last in a system card Jul 2024 Last model added Jul 2024

Level: Expert Specialists with years of training, often over hours of work
Scored: Checked automatically A program checks the result against an answer key, unit tests or the expected final state.
Answers: Multiple choice

Paper

Model scored in lab cards

System card reports it, from 1 lab

Gemma 2 27B leads with 53%

Best score per model as labs report them in their own cards. Labs pick their own settings, so these compare less cleanly than independent runs.

Bars Table

53.0 Gemma 2 27B

1 Gemma 2 27B 53%

#	Model	Score	Setting	Date	Source
1	Gemma 2 27B	53%		Jul 2024	Model card

Scores over time

All the scores we have, one dot each, so a model tested at several settings appears more than once.

Reported by the lab in its model card

Labs report it only in system cards

We read the headline results of 479 launch posts from 51 labs, and none of them list this benchmark. Some system cards do, below.

One system card reports it

Besides launch posts, we read the system cards, model cards and technical reports labs publish with a release. They report far more, including safety and frontier-risk tests.

Date	Document	Score	As the document writes it	Section
31 Jul 2024	Gemma 2 27B technical report	53	SPI, accuracy (Table 20)	Cyber risk

Gemma 2 27B leads with 53%

Scores over time

Labs report it only in system cards

One system card reports it

More in Cybersecurity