WeSCE - Worst-Case Risk Reduction: leaderboard
WeSCE (Zhang et al., 2026) measures security drift when a language model edits real-world-derived Python programs under functional-only instructions: feature addition, feature removal, bug fixing and refactoring. This board is the percentage of edited programs whose worst-case vulnerability risk, from CodeQL and Bandit static analysis and Atheris fuzzing, falls after the edit, averaged over the four edit types; higher is better.
Metric: Risk reduction rate (%; share of edited programs whose worst-case-dominant risk, LogSumExp sensitivity b = 1000, is lower after the edit; 400 executable real-world-derived Python programs edited under functional-only (weak-security) instructions, 100 each for feature addition, feature removal, bug fixing and refactoring; risk before and after the edit aggregates CodeQL and Bandit static findings and 90-second Atheris fuzzing findings, severity-weighted and size-normalized, through LogSumExp; mean of the four task rates; top-p 0.9, top-k 20). Source: arxiv.org. Saturation forecast: Around February 2027. 8 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Claude Opus 4.6 | 82.25 | #102 |
| 2 | GPT-5.4 | 80 | #123 |
| 3 | Claude Sonnet 4 | 79.25 | #400 |
| 4 | DeepSeek V4 Flash | 74.5 | #258 |
| 5 | Kimi K2.5 | 71.75 | #256 |
| 6 | Claude Haiku 4.5 | 66 | #568 |
| 7 | Doubao-1.5-Pro-32k | 64 | #683 |
| 8 | GLM-4 32B | 58.75 | #1299 |
No result here: #1 Claude Fable 5.2, #2 Gemini 4 Carbon, #5 Claude Opus 5.5.
Interactive version: theaggregate.ai/benchmark?slug=wesce-worst-case-risk-reduction · How It Works · Data refreshed daily, snapshot 2026-11-13.