Source code warning classification method based on prompt learning
By automatically generating adaptive prompts using a prompt learning-based framework and employing a prompt encoder with a BiLSTM and MLP combined structure, the problem of existing source code warning classification methods relying on manual rules and labeled data is solved, achieving high-accuracy automatic classification of source code warnings and improving the adaptability and efficiency of classification.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHINA UNIV OF GEOSCIENCES (WUHAN)
- Filing Date
- 2026-03-16
- Publication Date
- 2026-07-31
AI Technical Summary
Existing source code warning classification methods rely on manual rule design and a large amount of labeled data. They have weak semantic understanding capabilities, low classification accuracy, and poor adaptability and scalability, making it difficult to meet the warning classification needs of diverse source code static scanning tools.
We employ a cue-based learning framework, using a cue encoder that combines BiLSTM with a two-layer ReLU activated MLP structure to generate continuous cue embeddings. We then use a code-adaptive large language model to classify source code warnings, automatically generate adaptive cuees, and freeze the parameters of the large language model to reduce training costs.
It achieves high-accuracy automatic classification of source code warnings, reduces training costs, supports multiple static analysis tools and warning types, improves the accuracy and adaptability of classification results, helps developers quickly filter key warnings, and reduces the quality control costs of software development.
Smart Images
Figure CN122490145A_ABST
Abstract
Description
Technical Field
[0001] This application belongs to the field of software engineering, and more specifically, relates to a source code warning classification method based on prompting learning. Background Technology
[0002] Static code analysis, as a key quality assurance tool in software development, can detect potential defects, security vulnerabilities, and non-compliance with coding standards without executing the code, generating warning data containing defect type, location, and description information. As software size and complexity increase, the number of warnings generated by static code scanning tools increases dramatically, including a large number of duplicate, low-priority, or non-critical warnings. Developers need to spend a significant amount of time filtering and fixing critical warnings, severely impacting the usability of the tools.
[0003] Warning classification is the core technology for solving this problem. Its goal is to divide massive amounts of warnings into two categories: positive warnings and false alarms. Positive warnings indicate actual code defects that developers need to fix, while false alarms are those misjudged by tools and do not actually have code problems. This classification helps developers quickly filter false alarms and focus on the truly critical positive warnings that need fixing, improving problem-solving efficiency. Existing warning classification methods mainly fall into two categories: one is rule-based methods, which use manually defined regular expressions or logical rules to match keywords in the warning description to achieve classification; the other is based on traditional machine learning methods, which extract textual features from warnings (such as the bag-of-words model) and train a classifier (such as random forest) to complete the classification.
[0004] However, existing methods have obvious limitations: rule-based methods rely too heavily on manually designed rules, require professionals with deep domain knowledge, and have high rule maintenance costs, making it difficult to adapt to the diverse warning descriptions generated by different static analysis tools; traditional machine learning-based methods require a large amount of manually labeled training data, feature engineering is cumbersome, and the ability to understand the semantics of warning text is limited, resulting in low classification accuracy when dealing with warnings that are semantically similar but have different expressions.
[0005] Therefore, how to achieve high-accuracy automatic classification of source code warnings without relying on manual rule design and a large amount of labeled data is a problem that urgently needs to be solved. Summary of the Invention
[0006] To address the shortcomings of existing technologies, the purpose of this application is to provide a source code warning classification method based on prompting learning, which can achieve high-accuracy automatic classification of source code warnings without relying on manual rule design and a large amount of labeled data.
[0007] To achieve the above objectives, firstly, this application provides a source code warning classification method based on prompt learning, comprising the following steps: S10: Collect source code warning data and associated code snippets, and preprocess the warning descriptions and code snippets to obtain preprocessed input information; S20, construct a prompting learning framework that includes a prompting agent and a basic large language model; the core of the prompting agent is a prompting encoder, which adopts a BiLSTM combined with a two-layer ReLU activation MLP structure, with the input being... n A learnable pseudo-token; S30: Freeze the parameters of the basic large language model, use the preprocessed input information as training data, and train the prompting agent to generate continuous prompting embeddings; S40, input the preprocessed information of the warning to be classified into the word segmenter and input embedding layer of the basic large language model to generate the input embedding vector. At the same time, input the learnable pseudo token into the prompt agent trained in step S30 to generate the continuous prompt embedding. Then, fuse the input embedding vector with the continuous prompt embedding to obtain the fused embedding. S50, the fusion is embedded into the basic large language model, and the classification result is output.
[0008] As a further preferred option, in step S10, the collected source code warning data includes warning ID, warning description, defect-related code snippets, tool type, and manually annotated classification tags.
[0009] As a further preferred option, in step S10, the preprocessing includes: removing redundant symbols, standardizing capitalization, removing extra spaces, and filtering meaningless modifiers from the warning description to obtain a clean warning description; and removing comments, standardizing the format, and replacing meaningless variable names from the code snippet while retaining the core logical structure.
[0010] As a further preferred option, in step S20, the basic large language model is selected as a code-adaptive model, including any one of StarCoderBase and CodeGen-Multi.
[0011] As a further preferred embodiment, in step S20, the BiLSTM hidden layer dimension of the prompt encoder is 256, the hidden layer dimension of the two-layer MLP is 128, and the length of the learnable pseudo token is set to 100.
[0012] As a further preferred option, in step S30, during training, the input embedding vector and the cue embedding are fused using a backend concatenation mode, the loss value of the prediction result and the labeled label is calculated using the cross-entropy loss function, and the parameters of the cue agent are updated through backpropagation.
[0013] As a further preferred option, in step S30, the number of training rounds is controlled by the classification accuracy of the validation set, and an early stopping strategy is adopted, with the early stopping patience value set to 4.
[0014] As a further preferred option, in step S30, the batch size is set to 16, the learning rate is 5e-5, and the AdamW optimizer and linear learning rate scheduler are used.
[0015] As a further preferred step, in step S50, the basic large language model outputs the classification results and confidence scores, and warnings with confidence scores below 0.8 are marked as pending manual review.
[0016] Secondly, this application provides a source code warning classification system based on prompt learning, for implementing the method described in any one of the above, comprising: The data acquisition and preprocessing module is used to collect source code warning data and associated code snippets, and preprocess the warning descriptions and code snippets to obtain preprocessed input information; The cue learning framework building module is used to construct a cue learning framework that includes a cue agent and a basic large language model; the core of the cue agent is a cue encoder, which adopts a combination structure of BiLSTM and two layers of ReLU activation MLP, with the input being... n A learnable pseudo-token; The prompt agent training module is used to freeze the parameters of the basic large language model and use the preprocessed input information as training data to train the prompt agent to generate continuous prompt embeddings. The classification reasoning module is used to input the preprocessed information of the warning to be classified into the word segmenter and input embedding layer of the basic large language model to generate an input embedding vector. At the same time, the learnable pseudo token is input into the trained prompt agent to generate a continuous prompt embedding. The input embedding vector and the continuous prompt embedding are fused to obtain a fused embedding. The fused embedding is input into the basic large language model to output the classification result.
[0017] The beneficial effects of this application are: it solves the problems of existing warning classification methods relying on manual rules, weak semantic understanding ability, and high training costs; it automatically generates adaptive prompts through prompt learning, achieving high accuracy in source code warning classification; it has low training costs, requires no large amount of computing resources, and is easy to promote and apply; it supports multiple static analysis tools and warning types, and has strong versatility; the classification results can help developers quickly filter key warnings, improve the efficiency of code defect repair, and reduce the quality control costs of software development. Attached Figure Description
[0018] Figure 1 This is an overall flowchart provided in the embodiments of this application; Figure 2 This is a schematic diagram of the training process of the prompting learning framework provided in the embodiments of this application; Figure 3 This is a schematic diagram of the source code warning classification reasoning process provided in the embodiments of this application. Detailed Implementation
[0019] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.
[0020] The problem this invention aims to solve is that existing source code warning classification methods rely on manual rule design or a large amount of labeled data, have weak semantic understanding capabilities, low classification accuracy, and poor adaptability and scalability, making it difficult to meet the warning classification needs of diverse source code static scanning tools.
[0021] The technical solution of this application is: a source code warning classification method based on prompting learning, which is based on a prompting learning framework of a large language model. It automatically generates continuous prompts by training a prompting agent, inducing the large language model to complete source code warning classification. Specifically, it includes the following steps: Step 1: Warning Data Acquisition and Preprocessing: Collect source code warning data generated by different static source code scanning tools. Each warning data includes warning ID, warning description, defect-related code snippet, tool type, and manually annotated category tags; The warning description is preprocessed by removing redundant symbols, standardizing the text format (consistent capitalization, removing extra spaces), and extracting core semantic information (filtering meaningless modifiers) to obtain a clean warning description.
[0022] Step two, prompting you to build the learning framework: A prompting learning framework is constructed, including a prompting agent and a basic large language model. The basic large language model adopts a code-adaptive model to ensure the ability to understand code semantics. Cueing Agent Design: The core is the cueing encoder, which uses a combination of BiLSTM and a two-layer ReLU activated MLP structure. The input is... n A learnable pseudo-token (without actual semantics) is output as a continuous cue embedding; Training data construction: Using "cleaning warning description + preprocessed code snippet" as input and manually labeled classification labels as output, construct training data pairs <input information, classification labels> to train the prompt agent.
[0023] Step 3, prompt agent training: Freeze the parameters of the basic large language model and train only the parameters of the prompting agent to reduce the training resource requirements; Input information from the training data is fed into the word segmenter and input embedding layer of the basic large language model to generate input embedding vectors; The prompting agent receives pseudo-prompts, generates continuous prompting embeddings through the prompting encoder, and concatenates the input embedding vector with the prompting embeddings using a back-end concatenation mode to obtain the fused embedding. The module is integrated with the basic large language model to generate classification prediction results. The cross-entropy loss function is used to calculate the loss value between the prediction results and the manually labeled labels. The parameters of the prompt agent are iteratively updated through backpropagation until the model converges.
[0024] Step 4, Source Code Warning Categorization and Reasoning: For source code warnings to be categorized, perform the above preprocessing operations to obtain clean warning descriptions and preprocessed code snippets; The preprocessed input information is fed into the trained cue learning framework, and the cue agent automatically generates an adapted continuous cue embedding, which is then concatenated with the input embedding to form a fused embedding. The basic large language model outputs classification results based on fusion embedding to automatically classify source code warnings.
[0025] The features of this application are: (1) Automatically generate continuous prompts without the need for manual design of complex prompt words, reducing the dependence on domain knowledge; (2) The framework is non-intrusive to large language models, freezing the parameters of large language models and only training the prompt agent, resulting in low training cost and adaptability to various code-adaptive large language models; (3) Integrate the semantic information of warning descriptions and defect-related code fragments to improve the accuracy of classification, especially suitable for distinguishing semantically similar warnings.
[0026] The key technologies involved in this application are: a static source code scanning tool, a prompting learning framework, a code-adaptive large language model, a PyTorch deep learning framework, and a cross-entropy loss function. Specifically, the static source code scanning tool generates diverse source code warning data, covering different types of defects and warning description formats, providing data support for model training and testing. The prompting learning framework's core consists of a prompting agent and a basic large language model. It generates continuous prompts by training the prompting agent, inducing the large language model to complete classification tasks and freezing the large language model's parameters to reduce training costs. The code-adaptive large language model (StarCoderBase-3B), jointly released by Hugging Face and ServiceNow, is pre-trained on a large amount of code data, possessing powerful code semantic understanding capabilities to ensure classification accuracy. The PyTorch deep learning framework is used to implement the training and inference of the prompting agent, providing efficient model training and deployment support. The cross-entropy loss function is used to calculate the difference between the model's predicted results and the true labels, guiding the parameter updates of the prompting agent.
[0027] The beneficial effects of this application are: it solves the problems of existing warning classification methods relying on manual rules, weak semantic understanding ability, and high training costs; it automatically generates adaptive prompts through prompt learning, achieving high accuracy in source code warning classification; it has low training costs, requires no large amount of computing resources, and is easy to promote and apply; it supports multiple static analysis tools and warning types, and has strong versatility; the classification results can help developers quickly filter key warnings, improve the efficiency of code defect repair, and reduce the quality control costs of software development.
[0028] The following is a specific implementation example of this application: This embodiment selects a Java project as the experimental object, and uses the horusec source code static scanning tool to collect warning data to build training and test sets.
[0029] The experimental environment was: Ubuntu 20.04 LTS, 16GB RAM, Python 3.8, PyTorch 2.1.0.
[0030] The overall flow of this embodiment is shown in Figure 1, and the specific implementation steps are as follows: Step 1, Warning Data Acquisition and Preprocessing: Warning data is collected via horusec output files, and manually labeled with category tags. Preprocessing warning description: For example, "Possible null pointer dereference in method atline 120" is standardized to "possible null pointer dereference in method at line 120", extracting the core semantic "null pointer dereference". Table 1 shows an example of the comparison between warning data before and after preprocessing.
[0031] Table 1
[0032] Step 2, prompts for learning framework construction (e.g.) Figure 2 (as shown) StarCoderBase-3B was selected as the basic large language model to build a prompting learning framework that includes a prompting agent and a large language model; The prompting agent's prompt encoder uses BiLSTM (hidden layer dimension 256) + two layers of MLP (hidden layer dimension 128), and the pseudo-prompt length is set to 100. Construct training data pairs consisting of "cleaning warning description + preprocessed code snippet" and classification labels.
[0033] Step 3, prompting agent training: Freeze the parameters of StarCoderBase-3B, train only the cue agent, set the batch size to 16, the learning rate to 5e-5, and use the AdamW optimizer and linear learning rate scheduler. An early stopping strategy is adopted, with the classification accuracy on the validation set as the metric, and the early stopping patience value is set to 4 to avoid model overfitting. During training, the input information is processed by the large language model to generate input embeddings, and the prompting agent generates continuous prompt embeddings. The two are concatenated at the back end and then input into the large language model module. The parameters are optimized by the cross-entropy loss function, and the training rounds are 20.
[0034] Step 4, warning classification reasoning (e.g.) Figure 3 (as shown) Preprocessing is performed on warnings in the test set to obtain cleaned input information; Input information is fed into the trained framework, and the prompting agent automatically generates continuous prompts, which are then fused with the input embeddings and fed into the large language model. LLM outputs classification results and confidence levels. A warning mark indicates that a confidence level below 0.8 is pending manual review.
[0035] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the protection scope of this application.
Claims
1. A source code warning classification method based on cue learning, characterized in that, Includes the following steps: S10: Collect source code warning data and associated code snippets, and preprocess the warning descriptions and code snippets to obtain preprocessed input information; S20, constructing a prompting learning framework that includes a prompting agent and a basic large language model; The core of the prompting agent is the prompting encoder, which adopts a combination structure of BiLSTM and two layers of ReLU activated MLP, with the input being... n A learnable pseudo-token; S30: Freeze the parameters of the basic large language model, use the preprocessed input information as training data, and train the prompting agent to generate continuous prompting embeddings; S40, input the preprocessed information of the warning to be classified into the word segmenter and input embedding layer of the basic large language model to generate the input embedding vector. At the same time, input the learnable pseudo token into the prompt agent trained in step S30 to generate the continuous prompt embedding. Then, fuse the input embedding vector with the continuous prompt embedding to obtain the fused embedding. S50, the fusion is embedded into the basic large language model, and the classification result is output.
2. The source code warning classification method based on cue learning as described in claim 1, characterized in that, In step S10, the collected source code warning data includes warning ID, warning description, defect-related code snippets, tool type, and manually annotated category tags.
3. The source code warning classification method based on cue learning as described in claim 1, characterized in that, In step S10, the preprocessing includes: removing redundant symbols, standardizing capitalization, removing extra spaces, and filtering meaningless modifiers from the warning description to obtain a clean warning description; and removing comments, standardizing the format, and replacing meaningless variable names from the code snippet while retaining the core logic structure.
4. The source code warning classification method based on cue learning as described in claim 1, characterized in that, In step S20, the basic large language model is selected as a code-adaptive model, including any one of StarCoderBase and CodeGen-Multi.
5. The source code warning classification method based on cue learning as described in claim 1, characterized in that, In step S20, the BiLSTM hidden layer dimension of the prompt encoder is 256, the hidden layer dimension of the two-layer MLP is 128, and the length of the learnable pseudo token is set to 100.
6. The source code warning classification method based on cue learning as described in claim 1, characterized in that, In step S30, during training, the input embedding vector and the cue embedding are fused using a backend concatenation mode. The cross-entropy loss function is used to calculate the loss value of the prediction result and the labeled label. The parameters of the cue agent are updated through backpropagation.
7. The source code warning classification method based on cue learning as described in claim 1, characterized in that, In step S30, the number of training rounds is controlled by the classification accuracy of the validation set, and an early stopping strategy is adopted, with the early stopping patience value set to 4.
8. The source code warning classification method based on cue learning as described in claim 1, characterized in that, In step S30, the batch size is set to 16, the learning rate is 5e-5, and the AdamW optimizer and linear learning rate scheduler are used.
9. The source code warning classification method based on cue learning as described in claim 1, characterized in that, In step S50, the basic large language model outputs the classification results and confidence scores, and warnings with confidence scores below 0.8 are marked as pending manual review.
10. A source code warning classification system based on cue learning, characterized in that, To implement the method of any one of claims 1 to 9, comprising: The data acquisition and preprocessing module is used to collect source code warning data and associated code snippets, and preprocess the warning descriptions and code snippets to obtain preprocessed input information; The cue learning framework building module is used to construct a cue learning framework that includes a cue agent and a basic large language model; the core of the cue agent is a cue encoder, which adopts a combination structure of BiLSTM and two layers of ReLU activation MLP, with the input being... n A learnable pseudo-token; The prompt agent training module is used to freeze the parameters of the basic large language model and use the preprocessed input information as training data to train the prompt agent to generate continuous prompt embeddings. The classification reasoning module is used to input the preprocessed information of the warning to be classified into the word segmenter and input embedding layer of the basic large language model to generate an input embedding vector. At the same time, the learnable pseudo token is input into the trained prompt agent to generate a continuous prompt embedding. The input embedding vector and the continuous prompt embedding are fused to obtain a fused embedding. The fused embedding is input into the basic large language model to output the classification result.