---
title: "Multi-Class vs. Multi-Label BERT for CVE-to-CWE Mapping: How Taxonomy Structure Shapes the Errors"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.07573v1"
permalink: "https://feed.astralor.com/items/itm_97eaadf565495074a0ad6e19"
published: "2026-07-08T16:01:21.000Z"
score: 76
channel: "ai"
tags: ["BERT","CySecBERT","SecureBERT","Multi-label Classification","Multi-class classification","Vulnerability analysis"]
---

# Multi-Class vs. Multi-Label BERT for CVE-to-CWE Mapping: How Taxonomy Structure Shapes the Errors

## AI commentary

> What stands out in this paper is its well-designed experiments proving that taxonomy design impacts error patterns more than model choice. For researchers working on security knowledge graphs or automated vulnerability analysis, the proposal for hierarchy-relaxed evaluation may shift existing benchmarks. Security practitioners should note CySecBERT's advantage on cybersecurity texts.

## At a glance

This study treats CVE-to-CWE mapping as a text classification task, comparing multi-class and multi-label formulations. Three BERT variants (BERT Base, SecureBERT, CySecBERT) are evaluated on three label spaces (83, 47, 25 classes). Multi-class training achieves higher macro-F1 across all settings, though the gap narrows from 21 to 2 percentage points as label space shrinks. Confusion analysis reveals that dominant errors follow the CWE hierarchy and are highly correlated across encoders (Pearson r>0.92), indicating error structure is driven more by taxonomy design than encoder choice. Hierarchy-relaxed evaluation raises macro-F1 from ~81% to ~90%. CySecBERT achieves the strongest results overall.

## Key points

- Multi-class training achieves higher macro-F1 across all label spaces, but the gap to multi-label narrows as labels decrease.
- Over 80% of errors are within-family confusions (same parent CWE) rather than cross-hierarchy mistakes.
- Error patterns are highly similar across three BERT encoders, suggesting taxonomy design is the main error source.
- CySecBERT performs best overall, with statistically significant gains in the multi-label setting.

## Full text

Assigning Common Weakness Enumeration (CWE) categories to Common Vulnerabilities and Exposures (CVE) records remains an important but largely manual step in vulnerability analysis. We study this task as a text classification problem and compare two modelling choices: a \emph{multi-class} formulation that predicts a single CWE per CVE and a \emph{multi-label} formulation that allows multiple assignments. Three transformer encoders (BERT Base, SecureBERT, and CySecBERT) are evaluated on three nested label spaces (83, 47, and 25 classes). Multi-class training achieves higher macro-F1 across all settings, although the gap to multi-label narrows from 21 to 2 percentage points as the label space shrinks. Post-hoc threshold optimisation on the multi-label side closes this gap on the 25-class setting. Confusion analysis shows that the dominant misclassification patterns follow the CWE hierarchy and are shared across all three encoders (Pearson $r > 0.92$), which suggests that the error structure is driven more by taxonomy design than by encoder choice. A hierarchy-relaxed evaluation that forgives within-family confusions raises macro-F1 from ${\sim}$81\% to ${\sim}$90\%, indicating that strict metrics understate branch-level classifier quality. CySecBERT achieves the strongest results overall, with statistically significant gains concentrated in the multi-label setting.

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_97eaadf565495074a0ad6e19