arXiv CSopen access

Compute-Budgeted Exploitability Evidence Graphs for Prospective Vulnerability Triage

Compute-Budgeted Exploitability Evidence Graphs for Prospective Vulnerability Triage Faruk Alpay1 * Taylan Alpay2 1

arXiv:2606.19076v1 [cs.CR] 17 Jun 2026

2

Department of Computer Engineering, Bahçeşehir University, Istanbul, Türkiye Department of Aerospace, University of Turkish Aeronautical Association, Ankara, Türkiye [email protected] [email protected]

Abstract Defenders cannot patch every newly disclosed vulnerability at once, so they must prioritize, quickly, under a fixed compute budget, and without deceiving themselves about how well they are doing. We make a security-evaluation argument: naive exploit-prediction studies leak the future. A vulnerability’s eventual exploitation generates public chatter, proof-of-concept code, and advisories, and feeding those later signals to a model inflates its apparent accuracy. We instead specify a leakage-safe prospective triage protocol that, for each CVE, admits only public evidence visible by a fixed decision time, and we attach to every risk score an auditable evidence certificate naming the public signals that justified it. Public evidence around CVEs (advisories, exploit archives, fix commits, and hacker-community discourse) is organized as a temporal evidence graph and selected per CVE under an explicit budget. On 12012 prospective CVEs from public sources, budgeted evidence selection raises leakage-safe prospective recall@50 from 0.010 (severity-only baseline) to 0.026, a 150% relative gain, while a budget of only 2 evidence documents per CVE captures most of that value, so triage is cheap. A result of direct interest to practitioners is that a strong cross-encoder reranker lowers prospective recall (to 0.016), because semantic relevance to a CVE is not evidence of its exploitation. Most consequentially, a naive random split with unfiltered evidence inflates apparent prospective recall by 8.5× and EPSS-high recall by 5.0×, the temporal leakage that our protocol removes. All embeddings, candidate edges, certificates, and metrics are released as reproducible artifacts.

1

Introduction

The number of published vulnerabilities now far exceeds what any organization can remediate promptly [9]. Severity scores such as CVSS were designed to communicate technical impact rather than to predict whether a flaw will actually be attacked [14]. Empirically, CVSS correlates weakly with exploitation in the wild, so severity-driven patching wastes scarce effort [1]. Data-driven exploitation forecasting addresses this gap, and the Exploit Prediction Scoring System (EPSS) has become the reference probabilistic estimate of near-term exploitation [10]. The CISA Known Exploited Vulnerabilities (KEV) catalog provides the complementary ground truth of what is being exploited operationally [6]. Most prediction systems consume a fixed feature vector and emit a score, but real triage runs against a clock and a hardware budget while public evidence is still arriving. We therefore treat triage as selecting, under a fixed inference budget, the public evidence that most changes a vulnerability’s exploitation risk. Evidence is heterogeneous and timestamped, so it forms a temporal graph linking CVEs to advisories, exploit code, fix commits, and discourse. The budget is the number of evidence documents admitted per CVE, which bounds * Correspondence: [email protected].

1

the inference work. Because a score that drives patching should be contestable, every score ships with a certificate naming the signals that supported it. The central security concern is not the ranker but the evaluation. A vulnerability’s exploitation generates public chatter, and if that later chatter is allowed into the model it leaks the label. The malware-classification community showed that ignoring time inflates measured performance dramatically [18], and exploitability prediction is subject to the same hazard [21]. We enforce a per-CVE decision time and admit only evidence visible by then, turning triage into a genuinely prospective task and making the leakage that naive protocols hide directly measurable. Contributions. (i) We give a leakage-safe prospective triage protocol: naive exploit-prediction leaks the future, and our decision-time admissibility rule eliminates that leak by construction, with the leakage penalty quantified empirically. (ii) We attach an auditable evidence certificate to every risk score, turning a scalar into a contestable, provenance-bearing security claim, and we show that a budget of a few documents per CVE suffices. (iii) We report that a strong cross-encoder reranker is counterproductive for exploitation triage, because semantic relevance to a CVE is not evidence of its exploitation. All claims are established on public data and a single GPU.

2

Related Work

Early exploit prediction learned from vulnerability metadata to classify exploitability [5]. Social and web signals were then shown to sharpen these forecasts, notably Twitter mentions of CVEs [20]. Underground and dark-web language models further improved prediction of which vulnerabilities attract exploit development [22]. EPSS consolidated these ideas into an open, periodically retrained probability of exploitation [10]. Remediation studies framed prioritization as a coverage-versus-effort trade-off using exploitation as the outcome [9]. Expected Exploitability emphasized that realistic forecasting must respect when evidence becomes available [21]. Recent work cautions that exploitability prediction at disclosure time is harder than retrospective scores suggest [8]. Threat intelligence mined from hacker forums supplies signals well before formal advisories, and deep models can label such exploit posts at scale [2]. The HackerSignal corpus links millions of such documents to the CVE lifecycle across eight source layers [3]. CVE-to-fix linkage datasets like CVEfixes expose the patch evidence channel [4], and weakness taxonomies such as CWE structure the vulnerability space [15]. Our selection machinery is standard two-stage retrieval: a bi-encoder proposes candidates and a crossencoder reranks them. Sentence-BERT made bi-encoder similarity practical [19], dense passage retrieval established the retrieve-then-read paradigm [12], and BERT rerankers gave large precision gains on the reranked head [17]. We embed with E5-style contrastively trained encoders [23] and reason about evidence as a retrieval-augmented process [13]. Exact GPU similarity search makes the retrieval stage negligible at our scale [11]. Because risk scores must be comparable across CVEs, we calibrate them, drawing on standard post-hoc calibration [16] and the observation that strong classifiers are often miscalibrated [7].

3

Problem Formulation

Let V be a set of CVEs and D a corpus of public evidence documents. Each CVE v has a publication time tpub (v), a description xv , a severity σ(v), and a weakness type c(v) ∈ CWE. Each document e ∈ D has text xe , a source layer ℓ(e) ∈ L (NVD text, advisory, exploit archive, fix commit, discourse), and a timestamp ts(e). The temporal evidence graph G = (V ∪ D ∪ C, E) adds CWE and product nodes C and timestamped edges; exploitation labels (CISA-KEV, EPSS) attach to CVE nodes. 2

Decision time and admissibility.

Fix an observation window ∆ ≥ 0. The decision time of v is τ (v) = tpub (v) + ∆,

(1)

and the admissible evidence for v is the timestamped past cone A(v) = { e ∈ D : ts(e) ≤ τ (v) },

(2)

with undated e excluded. The exploitation label y(v) ∈ {0, 1} is realized at a time texp (v); the prospective positives are P ↑ = {v : y(v) = 1, texp (v) > τ (v)}, i.e. exploitation that has not yet happened at decision time. Budgeted selection. A bi-encoder ϕ gives a relevance score s(v, e) = ⟨ϕ(xv ), ϕ(xe )⟩ on ℓ2 -normalized embeddings. Under a budget B and a per-layer cap κ, the selected evidence solves X SB (v) = arg max s(v, e) s.t. |S| ≤ B, |S ∩ ℓ−1 (λ)| ≤ κ ∀λ ∈ L. (3) S⊆A(v)

e∈S

Proposition 1. The feasible region of (3) is the independent set of a laminar matroid (the global cap B together with the disjoint per-layer caps κ form a laminar family). Because the objective is modular, selecting documents in descending order of s(v, ·) while skipping any that would violate a cap is optimal. A short proof: caps over the layer partition plus the global cap are a laminar family, whose induced matroid admits exact greedy maximization of a modular objective; descending-relevance selection is exactly that greedy rule. Risk and evaluation. A feature map ψ(v, SB (v)) aggregates severity, a CWE-conditioned exploitation
prior p̂(y | c(v)), and statistics of the selected evidence; a calibrated model yields ρ(v) = g w⊤ ψ(v, SB (v)) , with g fit on a held-out split. CVEs are ranked by ρ. For a positive set P and cutoff K, Recall@K =

| topK (ρ) ∩ P | , |P |

(4)

and prospective recall uses P = P ↑ . Leakage penalty. Let π1 be the safe protocol (temporal split, admissibility (2)) and π0 the naive one (random split, A(v) = D). For a metric M the additive and multiplicative leakage penalties are Λ× M = M (π0 )/M (π1 ).

Λ+ M = M (π0 ) − M (π1 ),

(5)

Remark 1. Under π1 , ρ(v) is measurable with respect to the σ-algebra generated by signals timestamped at or before τ (v) (Eq. (2)). Hence no post-decision artifact of the exploitation event itself can enter the score, and any residual predictivity must come from genuinely anticipatory evidence. The penalties Λ× M measured in Sec. 6 bound how much a violation of this property would have inflated the reported numbers.

3

4

Method

Evidence graph. The graph has CVE nodes, evidence nodes, CWE nodes, and product/vendor nodes; KEV and EPSS attach as labels on CVE nodes. Each evidence node carries a source layer (NVD text, advisory, exploit archive, fix commit, or discourse), a provenance string, and a timestamp. CVE text and evidence text are the retrieval queries and corpus respectively. Temporal protocol and leakage filter. We split CVEs by disclosure year, training on the past and testing on the future. Each test CVE has a decision time equal to its publication date plus a fixed observation window ∆, during which evidence may accrue. The leakage-safe filter admits an evidence node for a CVE only if its timestamp does not exceed that CVE’s decision time; undated evidence is excluded conservatively. The exploitation labels (KEV addition, EPSS-high) are realized after the decision time, so predicting them from pre-decision evidence is prospective by construction. Budgeted evidence selection. For each CVE we embed its description with a bi-encoder, retrieve the top-N evidence nodes from the global corpus by cosine similarity, and apply the leakage filter. The compute budget B is the number of evidence documents admitted per CVE; smaller B means less inference work. The selector keeps the top-B by similarity (Prop. 1), enforcing source-layer diversity so a certificate is not dominated by one channel. A cross-encoder reranking stage is optional and, as a controlled compute increment, is evaluated as an ablation rather than used by default; we find it does not help (Sec. 6). Risk and certificate. A calibrated logistic model maps features (severity, a smoothed CWE-conditioned exploitation prior, and aggregates over the selected evidence such as counts, maximum and mean scores, and per-layer presence) to an exploitation probability, calibrated on a held-out training portion. EPSS is deliberately excluded from the default model because it encodes near-label information; we include it only as an ablation. Every test CVE emits a certificate recording its decision time, risk, rank, and the supporting evidence with layers, timestamps, and rerank scores, each flagged for leakage.

5

Experimental Setup

Data. We combine CISA KEV [6], FIRST EPSS [10], a CVE/CWE/CVSS table, CIRCL CVE–CWE–patch evidence, and the HackerSignal multi-source corpus [3]; NVD supplies publication dates where available. We study 12012 prospective test CVEs from recent years against 457 KEV-exploited positives, embedding a corpus of tens of thousands of evidence documents. Models and hardware. The bi-encoder is e5-base-v2; the optional reranker ablation uses bge-reranker-base. Everything runs on a single NVIDIA RTX 5090 (32 GB, CUDA 12.8). Retrieval is exact inner-product search on the GPU; the reranker sustains 1111 pairs/s. Metrics. We report KEV and EPSS-high recall@K, a prospective recall restricted to exploitation occurring strictly after the decision time, precision@K, time per CVE, evidence latency, certificate size, and a compute economy figure of risk captured per GPU-hour.

6

Results

Budgeted recall (Fig. 1). Budgeted evidence selection improves leakage-safe prospective recall@50 from 0.010 (severity-only baseline) to 0.026, a 150% relative gain; on the broader CISA-KEV target it moves recall@50 from 0.042 to 0.044. Crucially, the budget curve saturates almost immediately: a budget of 2

4

evidence documents per CVE already reaches within five percent of the best of any budget up to 64, so the triage value lives in a handful of well-chosen public signals rather than in scanning depth.

Budgeted evidence selection

recall@50

0.04 0.03

KEV recall@50 EPSS-high recall@50 Prospective recall@50 baseline (CVSS+CWE)

0.02 0.01 1

2 4 8 16 32 compute budget B (evidence docs / CVE)

64

Figure 1: Recall versus per-CVE evidence budget B. The curve saturates well below the maximum budget, showing that triage value is captured cheaply. The reranker does not help (Fig. 2). Adding a strong cross-encoder reranker lowers prospective recall@50 to 0.016 (from 0.026): ranking evidence by query–passage relevance surfaces advisory restatements of the CVE description rather than exploitation signals. This is a compute argument in its own right: the expensive stage is not worth its cost. Removing the CWE prior is the most damaging change, dropping KEV recall@50 to 0.024. Admitting EPSS as a feature inflates prospective recall to 0.068, confirming it behaves almost as a label and motivating its exclusion from the leakage-safe default.

Evidence-source ablations

KEV recall@50

0.05

baseline

0.04 0.03 0.02 0.01 0.00

od

meth

-patc

h

-CWE +rerank

-forum

S

+EPS

Figure 2: Evidence-source ablations (KEV recall@50). The dashed line is the severity-only baseline.

5

Temporal leakage (Fig. 3). A naive random split with unfiltered evidence reports prospective recall@50 of 0.044, whereas the temporal, leakage-safe protocol reports 0.005, an inflation of Λ× = 8.5. The same comparison on EPSS-high recall@50 inflates by 5.0× (0.030 vs. 0.006). This is the penalty that naive evaluation silently banks, and it is larger than the gap between any two methods we compare, which is why we treat the protocol, not the ranker, as the primary contribution.

prospective recall

Temporal leakage penalty 0.150 0.125 0.100 0.075 0.050 0.025 0.000

random split + leaky (naive) temporal split + leakage-safe

@10

@20

@50 K

@100

@200

Figure 3: Random/leaky versus temporal/leakage-safe evaluation. The difference is the temporal leakage penalty. Compute economy and certificates. End-to-end triage costs 0.0068 seconds per CVE for the bi-encoder selection path. Expressed as a throughput rate, this is on the order of 1197 top-ranked KEV positives recovered per GPU-hour; the figure is a normalization, not an absolute count, since the test set holds only 457 KEV positives in total, and it is reported so the cost of the method can be compared against heavier alternatives. Each certificate cites 5.9 evidence items on average, naming the public signals (with source layer, timestamp, and a leakage flag) behind each score; an example is in Table 1. Table 1: Example evidence certificate for CVE-2022-22954 (VMware Workspace ONE Access RCE; CISA-KEV listed). Risk = 0.36, rank 33, budget B = 8, decision time 2022-05-11. Each cited signal predates the decision time, so no item is flagged as leakage. source layer

source

timestamp

score

leak

advisory advisory discourse discourse nvd text

nvd cve nvd cve hackerone hackerone nvd description

2022-04-11 2022-04-13 2022-04-20 2022-04-29 2022-05-11

0.731 0.731 0.731 0.731 0.728

no no no no no

Reading a certificate. Table 1 is the audit object for a single CVE. The risk of CVE-2022-22954, a VMware Workspace ONE Access remote code execution flaw, rests on two independent channels: official NVD advisory references and community disclosure threads on HackerOne, alongside the CVE’s own description. Every cited signal is timestamped at or before the decision time, so the leakage column is 6

uniformly negative and the score is by construction free of post-decision artifacts (Remark 1). The value of the certificate is that this attribution is explicit. A defender can see that the ranking is driven by agreement between an official and a community source rather than by a single channel, can contest any individual item, and can re-derive the score from the listed evidence alone. The same structure makes manipulation legible: an attempt to inflate a score by seeding one layer would surface as a single-source certificate lacking cross-layer corroboration, which is precisely the signal a reviewer should distrust. In this sense the certificate is not a post-hoc explanation but the unit at which the triage decision can be challenged.

7

Discussion and Limitations

Where NVD publication dates were unavailable we fell back to a mid-year proxy, which coarsens but does not invert the temporal ordering. We used a single embedding and reranker pair, and stronger encoders would likely raise absolute recall. Our positive base rate is enriched relative to the full CVE stream to keep training tractable, so absolute recall numbers should be read comparatively across settings rather than as deployment estimates.

8

Ethical Considerations

This work is defensive: it prioritizes which already-public vulnerabilities a defender should remediate first, and it neither generates exploits nor identifies targets. We nonetheless treat the dual-use surface explicitly. Data terms and pseudonymity. The discourse evidence derives from HackerSignal, which is released for academic and defensive use only [3]; its forum authors are already pseudonymized at the source. Our released artifacts redact raw text from restricted source layers and retain only identifiers, timestamps, content hashes, and embedding vectors, so every reported number reproduces without redistributing the underlying corpora. We do not attempt author re-identification, and we discourage it [2]. A threat the method itself raises. Attributing risk to public signals defines a signal-manipulation threat model: an adversary able to seed plausible discourse or proof-of-concept artifacts could move a vulnerability’s apparent risk up or down. The leakage-safe admissibility rule bounds when such signals may act, but does not authenticate them, so deployments should weight evidence by provenance and by corroboration across independent layers rather than by volume. The evidence certificate is the mitigation we provide: because every score names its supporting signals, a manipulated ranking is contestable and auditable rather than opaque. Use and disclosure. The released models and artifacts must not be used to build automated exploitation tooling, to operate as a live threat feed, or to act without human review; these constraints follow the source datasets’ terms and the defensive intent of the work.

9

Conclusion

We framed prospective vulnerability triage as a security-evaluation problem before a modeling one. The dominant failure of exploit-prediction studies is temporal leakage: by admitting public signals generated after a vulnerability is exploited, they measure hindsight rather than foresight. Our decision-time admissibility rule (Eq. (2), Remark 1) removes that leak by construction, and the empirical penalty it exposes, Λ× = 8.5 on prospective recall, is larger than the gap between any two rankers we tried. Within this protocol, modeling public evidence as a temporal graph and selecting it under an explicit budget

7

improves prospective recall over a severity baseline while remaining cheap: a few well-chosen documents per CVE capture most of the value, and a heavier cross-encoder reranker is counterproductive because semantic relevance to a CVE is not evidence of its exploitation. Pairing each score with an auditable evidence certificate turns a scalar into a contestable security claim and supplies a concrete mitigation against signal manipulation. We see three directions: authenticating and provenance-weighting evidence against adversarial seeding; calibrating the observation window ∆ against operational patch deadlines; and extending the certificate to code-level fix evidence for a tighter audit of why a vulnerability was, or was not, prioritized.

References [1] Luca Allodi and Fabio Massacci. Comparing vulnerability severity and exploits using case-control studies. ACM Transactions on Information and System Security (TISSEC), 17(1):1–20, 2014. [2] Benjamin M. Ampel, Sagar Samtani, Hongyi Zhu, and Hsinchun Chen. Creating proactive cyber threat intelligence with hacker exploit labels: a deep transfer learning approach. MIS Quarterly, 48(1):137–166, 2024. [3] Benjamin M. Ampel et al. HackerSignal: a large-scale multi-source dataset linking hacker community discourse to the CVE vulnerability lifecycle, 2026. [4] Guru Bhandari, Amara Naseer, and Leon Moonen. CVEfixes: automated collection of vulnerabilities and their fixes from open-source software. In Proc. 17th Int. Conf. on Predictive Models and Data Analytics in Software Engineering (PROMISE), pages 30–39, 2021. [5] Mehran Bozorgi, Lawrence K. Saul, Stefan Savage, and Geoffrey M. Voelker. Beyond heuristics: learning to classify vulnerabilities and predict exploits. In Proc. 16th ACM SIGKDD Int. Conf. on Knowledge Discovery and Data Mining (KDD), pages 105–114, 2010. [6] Cybersecurity and Infrastructure Security Agency (CISA). Reducing the significant risk of known exploited vulnerabilities (binding operational directive 22-01) and the KEV catalog. https://www.cisa.gov/ known-exploited-vulnerabilities-catalog, 2021. [7] Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q. Weinberger. On calibration of modern neural networks. In Proc. 34th Int. Conf. on Machine Learning (ICML), pages 1321–1330, 2017. [8] Emanuele Iannone, Giulia Sellitto, Emanuele Iaccarino, Filomena Ferrucci, Andrea De Lucia, and Fabio Palomba. Early and realistic exploitability prediction of just-disclosed software vulnerabilities: how reliable can it be? ACM Transactions on Software Engineering and Methodology (TOSEM), 33(1):1–41, 2024. [9] Jay Jacobs, Sasha Romanosky, Idris Adjerid, and Wade Baker. Improving vulnerability remediation through better exploit prediction. Journal of Cybersecurity, 6(1):tyaa015, 2020. [10] Jay Jacobs, Sasha Romanosky, Benjamin Edwards, Michael Roytman, and Idris Adjerid. Exploit prediction scoring system (epss). Digital Threats: Research and Practice, 2(3):1–17, 2021. [11] Jeff Johnson, Matthijs Douze, and Hervé Jégou. Billion-scale similarity search with GPUs. IEEE Transactions on Big Data, 7(3):535–547, 2021. [12] Vladimir Karpukhin, Barlas Oğuz, Sewon Min, Patrick Lewis, Ledell Wu, Sergey Edunov, Danqi Chen, and Wen-tau Yih. Dense passage retrieval for open-domain question answering. In Proc. 2020 Conf. on Empirical Methods in Natural Language Processing (EMNLP), pages 6769–6781, 2020. [13] Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, et al. Retrieval-augmented generation for knowledge-intensive NLP tasks. In Advances in Neural Information Processing Systems (NeurIPS), volume 33, pages 9459–9474, 2020. [14] Peter Mell, Karen Scarfone, and Sasha Romanosky. Common vulnerability scoring system. IEEE Security & Privacy, 4(6):85–89, 2006. [15] MITRE Corporation. Common weakness enumeration (CWE). https://cwe.mitre.org/, 2024.

8

[16] Alexandru Niculescu-Mizil and Rich Caruana. Predicting good probabilities with supervised learning. In Proc. 22nd Int. Conf. on Machine Learning (ICML), pages 625–632, 2005. [17] Rodrigo Nogueira and Kyunghyun Cho. Passage re-ranking with BERT. arXiv preprint arXiv:1901.04085, 2019. [18] Feargus Pendlebury, Fabio Pierazzi, Roberto Jordaney, Johannes Kinder, and Lorenzo Cavallaro. TESSERACT: eliminating experimental bias in malware classification across space and time. In 28th USENIX Security Symposium, pages 729–746, 2019. [19] Nils Reimers and Iryna Gurevych. Sentence-BERT: sentence embeddings using Siamese BERT-networks. In Proc. 2019 Conf. on Empirical Methods in Natural Language Processing (EMNLP), pages 3982–3992, 2019. [20] Carl Sabottke, Octavian Suciu, and Tudor Dumitraş. Vulnerability disclosure in the age of social media: exploiting Twitter for predicting real-world exploits. In 24th USENIX Security Symposium, pages 1041–1056, 2015. [21] Octavian Suciu, Connor Nelson, Zhuoer Lyu, Tiffany Bao, and Tudor Dumitraş. Expected exploitability: predicting the development of functional vulnerability exploits. In 31st USENIX Security Symposium, pages 377–394, 2022. [22] Nazgol Tavabi, Palash Goyal, Mohammed Almukaynizi, Paulo Shakarian, and Kristina Lerman. DarkEmbed: exploit prediction with neural language models. In Proc. AAAI Conf. on Artificial Intelligence (IAAI), 2018. [23] Liang Wang, Nan Yang, Xiaolong Huang, Binxing Jiao, Linjun Yang, Daxin Jiang, Rangan Majumder, and Furu Wei. Text embeddings by weakly-supervised contrastive pre-training. arXiv preprint arXiv:2212.03533, 2022.

A

Engineering the Pipeline for Budgeted GPU Throughput

This appendix documents the systems issues encountered in making the study tractable on a single GPU, and the techniques that resolved them. They are of independent interest for compute-budgeted inference pipelines. A.1 Reranking was compute-bound on the wrong device. The cross-encoder stage initially held the GPU at ≈ 26% utilization: tokenizing multi-hundred-character evidence documents on a single CPU thread starved the device. Capping passage length and enlarging the batch made the stage GPU-bound (utilization → 100%), turning a latent CPU bottleneck back into useful accelerator work (Alg. 1). Algorithm 1 GPU-bound budgeted reranking Require: candidate pairs P = {(qi , di )}, budget B, char cap c, batch b 1: for each CVE v do 2: Cv ← top-B candidates of v by bi-encoder score 3: end for S 4: P ′ ← {(q, T RUNCATE(d, c)) : (q, d) ∈ v Cv } 5: S ← C ROSS E NCODER(P ′ , batch = b) 6: return σ(S)

▷ bound CPU tokenization ▷ now GPU-bound

A.2 One GPU pass, many settings. The budget sweep, source ablations, and the random/temporal comparison differ only in post-hoc selection and labelling, not in the embeddings or retrieval. We therefore embed and retrieve once, cache the candidate table, and derive every setting on CPU (Alg. 2), reducing the experiment grid from one GPU run per setting to a single GPU pass.

9

Algorithm 2 Amortizing one GPU pass over the ablation grid 1: E ← E MBED (CVE text ∪ evidence text) 2: R ← T OP N(Ecve , Eev ) 3: cache R with scores, source layers, timestamps 4: for each setting θ ∈ {budgets, ablations, splits} do 5: S CORE(θ) from cached R 6: end for

▷ once, GPU ▷ exact GPU search, once

▷ CPU only

A.3 Vectorized scoring. Scoring 25,000 CVEs across ∼ 15 settings with per-CVE Python loops took minutes per pass; replacing them with a single group-by reduction and a layer-presence pivot reduced this to seconds (Alg. 3), which is what makes a large ablation grid affordable. Algorithm 3 Vectorized per-CVE feature aggregation 1: group selected evidence by CVE ID 2: AGG ← groupby-reduce(count, max, mean, sum, #layers) 3: PRES ← pivot(per-layer presence) 4: X ← join(base features, AGG , PRES)

B

▷ single pass

Leakage-Safe, Auditable Triage and Creative-Risk Reasoning

This appendix records how the security protocol was derived and what it implies for adversarial reasoning, kept deliberately at the level of method rather than operational detail. B.1 Admissibility is the security primitive. The core security property is not the ranker but the rule deciding which evidence a decision may use. Tying admissibility to a per-CVE decision time, and excluding undated evidence, guarantees that a vulnerability’s later exploitation cannot inform its own score (Alg. 4); the experiments show that dropping this rule inflates apparent prospective recall several-fold. Algorithm 4 Leakage-safe evidence admissibility Require: CVE v, publication tpub (v), window ∆, evidence Ev 1: τ (v) ← tpub (v) + ∆ 2: Av ← {e ∈ Ev : ts(e) ≤ τ (v)} 3: exclude e with unknown ts(e) 4: label y(v) realized at texploit (v) > τ (v) 5: return Av

▷ decision time ▷ admit only pre-decision evidence ▷ cannot prove admissibility

B.2 Certificates make risk attribution auditable. Each score is paired with the public signals that produced it, with provenance, timestamp, and a leakage flag (Alg. 5). This turns a scalar risk into an auditable claim a defender can contest, and exposes the channels (advisory, exploit archive, fix commit, discourse) that drove the decision.

10

Algorithm 5 Evidence certificate construction Require: selected evidence Sv , risk ρ(v), rank r(v) 1: cert ← {v, ρ(v), r(v), τ (v), B} 2: for e ∈ Sv do 3: append ⟨layer(e), source(e), ts(e), score(e), leak=[ts(e)>τ (v)]⟩ 4: end for 5: return cert B.3 Implications for creative cyber-risk. Two consequences follow from an auditable, evidence-driven score, both of which we frame as directions rather than claims. First, attributing risk to public signals defines a signal-manipulation threat model: an adversary able to seed plausible discourse or proof-of-concept artifacts could move a vulnerability’s apparent risk, so trust should be weighted by provenance and corroboration across independent layers rather than by volume. Second, exploit and discourse evidence frequently predates formal disclosure, suggesting an early-warning channel; its predictive value must be measured strictly prospectively (Alg. 4) to avoid the optimistic bias that retrospective evaluation would introduce. The end-to-end procedure that ties these together is summarized in Alg. 6. Algorithm 6 Prospective budgeted triage 1: for each CVE v disclosed in the test window do 2: Av ← admissible evidence 3: Sv ← top-B of R ETRIEVE(v, Av ) with layer diversity 4: ρ(v) ← calibrated risk(v, Sv ); emit certificate 5: end for 6: rank CVEs by ρ; evaluate recall@K against future exploitation

11

▷ Alg. 4 ▷ Alg. 5