# LLM-based Vulnerable Code Augmentation: Generate or Refactor?

arXiv: https://arxiv.org/abs/2512.08493 · HTML: https://mlsanity.com/paper/2512.08493/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 8 of its 13 references that are in the map.
- First posted on arXiv 9 Dec 2025.

## Builds on (most cited first, 8 of 8)

- [Large Language Models for Code: Security Hardening and Adversarial Testing](https://mlsanity.com/paper/2302.05319/) (2023)
- [Self-Supervised Bug Detection and Repair](https://mlsanity.com/paper/2105.12787/) (2021)
- [VGX: Large-Scale Sample Generation for Boosting Learning-Based Software Vulnerability Analyses](https://mlsanity.com/paper/2310.15436/) (2023)
- [Boosting Source Code Learning with Text-Oriented Data Augmentation: An Empirical Study](https://mlsanity.com/paper/2303.06808/) (2023)
- [Enhancing Code Vulnerability Detection via Vulnerability-Preserving Data Augmentation](https://mlsanity.com/paper/2404.09599/) (2024)
- [MIXCODE: Enhancing Code Classification by Mixup-Based Data Augmentation](https://mlsanity.com/paper/2210.03003/) (2022)
- [Source Code Data Augmentation for Deep Learning: A Survey](https://mlsanity.com/paper/2305.19915/) (2023)
- [Enhancing Pre-Trained Language Models for Vulnerability Detection via Semantic-Preserving Data Augmentation](https://mlsanity.com/paper/2410.00249/) (2024)

## Abstract (arXiv)

Vulnerability code-bases often suffer from severe imbalance, limiting the effectiveness of Deep Learning-based vulnerability classifiers. Data Augmentation could help solve this by mitigating the scarcity of under-represented vulnerability types. In this context, we investigate LLM-based augmentation for vulnerable functions, comparing controlled generation of new vulnerable samples with semantics-preserving refactoring of existing ones. Using Qwen2.5-Coder to produce augmented data and CodeBERT as a classifier on the SVEN dataset, we find that our approaches are indeed effective in enriching vulnerable code-bases through a simple process and with reasonable quality, and that a hybrid strategy best boosts vulnerability classifiers' performance. Code repository is available here : https://github.com/DynaSoumhaneOuchebara/LLM-based-code-augmentation-Generate-or-Refactor-