AI Learns to Read Code in Context to Predict Bugs Across Software Projects

Software bugs cost the global economy billions of dollars every year, and one of the most stubborn obstacles to catching them early has always been data scarcity. Machine learning models that flag defective code need labeled examples of past failures, but brand-new projects rarely have enough of their own. A promising workaround is cross-project defect prediction, in which a model trained on one mature, well-documented codebase is applied to a different project that lacks training data. The catch is that different projects speak subtly different dialects of code, and models trained on one often stumble when transplanted to another. A new study published in the International Journal of Machine Learning and Cybernetics reports a method that tackles both sides of the problem at once: it teaches the model to understand the contextual meaning of code tokens while simultaneously erasing the statistical differences that separate one project’s data distribution from another’s.

The research team, led by Qing Shen, Jing Xu, Maonian Wu, Jungang Lou, Jiacheng Fei, and Shaojun Zhu of Huzhou University, working with the Zhejiang Key Laboratory of Intelligent Education Technology and Application, argues that existing approaches have been leaving crucial information on the table. Many earlier systems convert source code into flat sequences of tokens or into hand-crafted metrics such as lines of code, cyclomatic complexity, or object-oriented measures like the Chidamber-Kemerer suite. Those representations capture something, but they lose the local context in which each token appears. In programming languages, the same identifier or keyword can carry very different meanings depending on its surroundings, and a model that cannot see those surroundings cannot reliably distinguish a dangerous construct from a harmless one. The authors also point out that even when deep networks do learn rich semantic features, the mismatch between the distribution of the source project’s data and that of the target project remains a barrier that simple retraining cannot overcome.

To address the semantic side of the problem, the researchers begin by representing source code from both the source and target projects as tree structures rather than flat text. Abstract syntax trees preserve the hierarchical, nested nature of programs, so the relationship between a function call and its arguments, or between a conditional and the block it guards, is encoded structurally rather than inferred. From these trees the team extracts token vectors and feeds them into a continuous bag-of-words model, a word-embedding technique borrowed from natural language processing that learns vector representations of tokens by predicting each token from its neighbors. The result is a word vector table in which tokens that appear in similar contexts end up with similar vectors, giving the downstream network a vocabulary of code in which meaning is grounded in usage.

On top of those embeddings, the architecture employs bidirectional gated recurrent units, a type of recurrent neural network that reads sequences in both forward and reverse directions. The bidirectional design matters because the significance of a code token often depends on what comes after it as well as what came before: a variable may look innocuous until a later statement reveals how it is used. By scanning each sequence from both ends and concatenating the resulting hidden states, the network builds a representation of every token that reflects its full contextual environment. Fully connected layers then consolidate these recurrent representations into higher-level feature vectors suitable for classification. In effect, the pipeline moves from raw syntax, to context-aware embeddings, to a learned summary of each code unit’s defect-relevant semantics.

The second half of the method confronts the domain gap directly, using domain adversarial learning, an idea that descends from generative adversarial networks. In this scheme, the feature extractor is trained in a competitive game against a domain classifier. The classifier’s job is to look at a feature vector and guess whether it came from the source project or the target project. The feature extractor’s job is to produce features so project-agnostic that the classifier fails at that guessing task, while still remaining informative enough that a separate defect predictor can classify code as defective or clean. As training proceeds, the two components push against each other until the extracted features occupy a shared space in which project identity has been scrubbed away but defect-relevant signal has been retained. This is what allows defect knowledge accumulated on one project to transfer meaningfully to another.

The team evaluated the approach on six publicly available real-world projects, using each in turn as a target while training on the others, a standard cross-project protocol. Performance was measured with F1-score, which balances precision and recall, and with overall accuracy. On average, the proposed method improved F1-score by 6 to 10 percent and accuracy by 4.7 to 8.1 percent compared with baseline methods, a margin the authors describe as demonstrating both effectiveness in addressing the core challenges of cross-project prediction and potential for practical deployment in real-world software engineering workflows. The experiments also drew on established validation practices from the defect prediction literature, which has long emphasized rigorous model validation because naive evaluation can dramatically overstate a predictor’s real-world value.

The significance of the result lies in what it says about how machines should read code. Defect prediction has evolved through several generations: first hand-crafted metrics rooted in Halstead’s software science and McCabe’s complexity measure, then classical machine learning over those metrics, then deep learning over raw or lightly processed code, and now transfer learning and adversarial adaptation across projects. Each generation has traded some interpretability for representational power. What this study adds is evidence that contextual semantics and domain adaptation are not competing priorities but complementary ones. A model that understands tokens in context has richer features to align, and a model that aligns domains adversarially can move those rich features across project boundaries without destroying them.

There are also broader implications for how development teams might use such tools. In an ideal workflow, a company launching a new service could borrow the defect history of a mature internal project, or even of an open-source codebase with similar characteristics, and immediately begin triaging its own code for likely trouble spots, long before enough of its own labeled bug data accumulates. Because the method operates on source code structure and learned embeddings rather than proprietary process data, it fits naturally into continuous integration pipelines, where it could flag high-risk modules for closer review by human engineers. The authors note that the approach is designed for exactly these practical defect prediction tasks, and they report that the relevant data will be supplied in response to reasonable requests, which opens the door to independent replication.

Caveats remain, as they do in any empirical software engineering study. The evaluation covers six public projects, and performance on radically different languages, domains, or codebases will require further testing. Adversarial training is also notoriously sensitive to hyperparameters, and the authors’ contribution statements indicate that experiment design was a deliberate, dedicated effort rather than an afterthought. Still, the reported gains are consistent across the evaluation, and the underlying ideas, context-aware embeddings of code plus adversarial domain alignment, are general enough to be combined with other advances such as transformer-based code models or attention mechanisms. The work was supported by the Pioneer and Leader + X Plan Project of Zhejiang Province, the Natural Science Foundation of Zhejiang Province, and a postgraduate research and innovation project at Huzhou University.

For a field that has spent two decades chasing the dream of predicting bugs before they ship, the message of this study is quietly encouraging. The barriers that made cross-project prediction unreliable, shallow representations of code and mismatched data distributions, are not immutable facts of software engineering but engineering problems in their own right, and they yield to the same tools that have transformed machine translation and image recognition. If models can learn to read code the way experienced developers do, sensitive to context and portable across codebases, then the scarce resource that has limited defect prediction all along, labeled failure data, may finally stop being the bottleneck. The next generation of software could be audited by systems that arrive already fluent in the language of code, having learned its failure patterns everywhere else.

Subject of Research: Cross-project software defect prediction using contextual code semantics and domain-adversarial learning

Article Title: Considering contextual semantics in domain-adversarial cross-project software defect prediction

Article References: Shen, Q., Xu, J., Wu, M., Lou, J., Fei, J., & Zhu, S. (2026). Considering contextual semantics in domain-adversarial cross-project software defect prediction. International Journal of Machine Learning and Cybernetics, 17(10), Article 471. https://doi.org/10.1007/s13042-026-03220-3

Image Credits: AI Generated

DOI: 10.1007/s13042-026-03220-3

Keywords: software defect prediction, cross-project prediction, domain adversarial learning, contextual semantics, bidirectional gated recurrent units, continuous bag-of-words, transfer learning, machine learning, source code analysis, software engineering, abstract syntax trees, deep learning