Combining SetFit and LLMs for Explainable Security Bug Report Prediction

Sammanfattning

Security bug reports (SBRs) describe software defects with potential security implications and require timely identification during bug triage. However, SBR predictionis challenging because security-related reports are rare, imbalanced, and sometimes mislabeled as ordinary bug reports due to a lack of security domain knowledge. While automated baseline classifiers like SetFit can efficiently address few-shot text classification, their black-box nature hinders real-world adoption by practitioners who require transparent interpretations to trust automated triage outcomes. This thesis investigates an explainable SBR prediction pipeline that combines SetFit-based classification, post-hoc feature attribution (LIME and SHAP), and LLM-assisted explanation generation. The quantitative empirical evaluation across four stratified open-source project datasets – Ambari, Camel, Derby, and Wicket – incorporates cross-fold standard deviations to directly capture model predictive stability. The technical faithfulness results demonstrate that LIME provides more faithful explanations than SHAP for fine-tuned sentence encoders. To bridge the interpretability gap of raw keyword-weight representations, a constrained deepseekv4-flash model was implemented as a narrative generator. Backed by an automated semantic audit framework, the pipeline converted technical evidence into natural summaries, achieving an empirical pass rate of 98.46% in preventing out-of-domain factual hallucinations. Expert evaluation confirms that the audited LLM-generated narratives enhance the practical usefulness and perceived trust of AI decisions for software engineers. This research contributes a validated framework for turning automated classification predictions into reliable explanations.