CASEY: Security, Geometry, and Beyond

• CASEY is a large-language-model-based security triage system that automates CWE classification and severity assessment, achieving 68.0% CWE and 73.6% severity accuracies.
• CASEY also denotes a geometric theorem with a higher-dimensional reformulation using Gram-matrix determinants and features in spectroscopy and astrophysics data pipelines.
• The term 'Casey' is polysemous, requiring careful disambiguation across domains such as computer security, geometry, plasma physics, astrophysics, and physics education research.

Searching arXiv for the provided CASEY-related papers to ground the article in the cited literature. CASEY most directly denotes a large-language-model approach to security vulnerability triage that automates Common Weakness Enumeration (CWE) identification and severity assessment from vulnerability records (Torkamani et al., 31 Jan 2025). In contemporary arXiv literature, however, the term also appears in several distinct senses: as the eponym of Casey’s theorem in geometry, as a constructed faculty persona in physics education research, and as the surname attached to experimental measurements, data-driven pipelines, and astrophysical predictions in other domains [(Lewis et al., 22 May 2026); (Hamdan et al., 2024); (Olivares-Pilón et al., 2024); (Holtzman et al., 2018); (Casey et al., 24 May 2025); (Zheng et al., 2013)]. The dominant uppercase usage is the security-triage system; the other usages are homonymous rather than conceptually unified.

1. CASEY as a security-vulnerability triage system

CASEY is presented as a method for bug triaging for security vulnerabilities, with two explicit tasks: classifying a newly reported bug into a CWE category and assigning it a severity level such as LOW, MEDIUM, HIGH, or CRITICAL (Torkamani et al., 31 Jan 2025). The system leverages LLMs and employs prompt engineering techniques together with contextual information at varying levels of granularity. Its evaluation is based on an augmented version of the National Vulnerability Database (NVD), and the reported headline results are a CWE identification accuracy of 68%, a severity identification accuracy of 73.6%, and a combined accuracy of 51.2% for identifying both (Torkamani et al., 31 Jan 2025).

The underlying motivation is operational rather than purely classificatory. Manual triage is described as slow and inconsistent and as unable to keep pace with the volume of new CVE records or fuzz-found crashes. Within that framing, CWE provides the vulnerability-type taxonomy, while CVSS provides both a numeric score in the range $0$–$10$ and a categorical label. CASEY therefore addresses the two most common outputs required in practical triage workflows: type and priority (Torkamani et al., 31 Jan 2025).

The paper treats CWE identification as a multi-label classification problem and severity assessment as a regression-plus-label problem. In the notation used there, given input $x$, the system predicts a set $\hat{Y}_{CWE}$ and a score-label pair $(\hat{y}_{score}, \hat{y}_{label})$. This formulation is significant because it makes explicit that severity is not only a discrete class decision; it is also a score prediction whose tolerance can be evaluated separately from the label (Torkamani et al., 31 Jan 2025).

2. Pipeline, prompting, and formal evaluation

CASEY’s architecture is modular. The pipeline includes an Input Reader, Date Checker, Validity Checker, CVSS Extractor, CWE Extractor, Severity Extractor, Inference Component, Formatter, and Evaluator (Torkamani et al., 31 Jan 2025). The Input Reader processes one CVE record at a time from the evaluation dataset. The Date Checker discards any record whose commit date is less than or equal to the model cutoff $2021$-$09$-$01$, thereby ensuring unseen evaluation examples. The Validity Checker requires non-empty ground-truth CWEs and severity, supported file languages, non-empty buggy code or hunks, and a token count below GPT-3’s limit (Torkamani et al., 31 Jan 2025).

The Inference Component formats two separate LLM calls, one for CWE and one for severity. The contextual inputs are organized into four variants, in increasing code granularity: <Description>, <Description> + <BuggyFile>, <Description> + <BuggyMethods>, and <Description> + <BuggyHunks> (Torkamani et al., 31 Jan 2025). Buggy methods are extracted via tree_sitter and AST diff, while hunks are the raw diff hunks. This separation matters because the paper explicitly compares how different context granularities affect type prediction and severity estimation (Torkamani et al., 31 Jan 2025).

Prompt engineering is central to the method. For CWE identification, the system prompt specifies an expert persona in software vulnerability classification and requires two outputs: PerfectMatchCWEs and Top5CWECandidates. For severity, the prompt specifies vulnerability severity scoring and instructs the model to return a numeric SeverityScore together with a SeverityLabel, or default values when the answer is unknown (Torkamani et al., 31 Jan 2025). The Formatter then checks that the returned structure conforms to these schemas before evaluation.

The paper defines three principal metrics:

$$Acc_{CWE} = \frac{\#\{i:\hat{Y}_{CWE}^{(i)} = Y_{CWE}^{(i)}\}}{N},$$

$$Acc_{sev} = \frac{\#\{i:\hat{y}_{label}^{(i)} = y_{label}^{(i)}\}}{N},$$

$10$0

For CWE evaluation the study also uses Prediction Equality (PE), Prediction Coverage (PC), and Ground truth Coverage (GC) (Torkamani et al., 31 Jan 2025). In the combined setting, a record is treated as correct only if both tasks satisfy their respective correctness criteria; the paper gives as an example a perfect CWE match together with a severity score within $10$1 of ground truth (Torkamani et al., 31 Jan 2025).

The dataset construction is unusually explicit. The source is the NVD JSON feed, yielding 6,032 CVEs from GitHub commits after $10$2-$10$3-$10$4. Filtering reduces this to 1,155 records for fine-tuning. Prompt expansion produces approximately 8,085 prompt records, of which 7,933 are retained for CWE and 7,894 for severity after token-limit filtering. The resulting splits are 5,949 train and 1,984 test for CWE fine-tuning, 5,920 train and 1,974 test for severity fine-tuning, plus an evaluation dataset of 3,016 held-out records, from which 500 distinct CVEs are sampled for end-to-end evaluation with four prompt variants each (Torkamani et al., 31 Jan 2025).

3. Empirical performance, failure modes, and methodological limits

The reported quantitative performance is differentiated by task. For the evaluated system, CWE perfect-match accuracy reaches 68.0%; severity label accuracy reaches 61.2%; severity score accuracy within $10$5 reaches 73.6%; and combined CWE-plus-severity accuracy, defined as CWE perfect match together with severity score within $10$6, reaches 51.2% (Torkamani et al., 31 Jan 2025). The baseline is off-the-shelf GPT-3.5 with the same prompts and no fine-tuning. Relative to that baseline, the paper reports approximately 50.0% CWE perfect-match accuracy, approximately 34.4% severity label accuracy, approximately 48.6% severity score accuracy, and approximately 17.0% combined accuracy (Torkamani et al., 31 Jan 2025).

The context-granularity study is one of the more informative results. “Description only” gives the best CWE perfect accuracy at 68.0%, whereas adding full files tends to distract the model and lowers performance to approximately 62.8% (Torkamani et al., 31 Jan 2025). By contrast, “Description + hunks” gives the best severity results, which the paper attributes to the focused context provided by the diff hunks. This asymmetry suggests that the information needed for weakness taxonomy and the information needed for practical severity judgment are not identical. A plausible implication is that vulnerability type often depends on abstract semantic cues already present in the NVD description, whereas severity benefits from the localized implementation context captured by hunks.

The paper also reports qualitative failure modes. Ambiguous or overly terse descriptions lead to generic CWE predictions such as CWE-20 rather than more specific classes such as CWE-248. Entire-file inputs can mislead the model through noise. Hierarchical misclassification is common, with the model predicting a parent or sibling CWE instead of the precise child CWE (Torkamani et al., 31 Jan 2025). The study notes a successful example in which the baseline predicts CWE-266 while the fine-tuned model predicts the correct CWE-269, illustrating that fine-tuning can improve resolution within closely related weakness classes (Torkamani et al., 31 Jan 2025).

The system’s limits are stated plainly. CASEY relies on NVD’s template descriptions; token-window limits can force context reduction; it contains no explicit modeling of the CWE hierarchy; and it provides no uncertainty estimation or human-in-the-loop fallback (Torkamani et al., 31 Jan 2025). The paper also reports no confidence intervals or significance tests. Future work is framed around open-source LLMs, hierarchical loss or post-processing, retrieval-augmented prompts, and user studies with triage analysts (Torkamani et al., 31 Jan 2025). In methodological terms, CASEY is therefore better understood as a prompt-engineered, fine-tuned triage assistant than as a complete replacement for expert adjudication.

4. Casey’s theorem and its higher-dimensional reformulation

A separate and older mathematical use of the name appears in “Casey’s theorem,” which Lewis and Short place into a unified Lorentzian framework together with Penner’s theorem and Ptolemy’s theorem (Lewis et al., 22 May 2026). Their setting is the Lorentzian model of hyperbolic space $10$7, equipped with inner product

$10$8

with hyperbolic distance defined by

$10$9

The unifying device is a Gram-matrix criterion: for vectors $x$0, the determinant of the Gram matrix $x$1 vanishes if and only if the vectors lie in a codimension $x$2 subspace (Lewis et al., 22 May 2026).

For the Casey analogue, the paper associates to co-oriented hyperplanes $x$3 with spacelike unit normals $x$4 the matrix

$x$5

Theorem C states that hyperplanes $x$6 in $x$7 admit co-orientations so that $x$8 if and only if exactly one of three geometric alternatives holds: they share a common tangent hyperplane at infinity; they share a common ideal point; or they are all orthogonal to one hyperplane and equally inclined to another (Lewis et al., 22 May 2026). The paper emphasizes that this yields a full converse.

In the Euclidean plane, the same formalism recovers a version of Casey’s theorem for four co-oriented circles $x$9. Writing $\hat{Y}_{CWE}$0 for the usual Casey-matrix entry, the statement becomes

$\hat{Y}_{CWE}$1

if and only if one of three alternatives holds: the circles share a common tangent circle or line, they share a common intersection point, or they are all orthogonal to one circle or line and equally inclined to another (Lewis et al., 22 May 2026). In the classical cyclic configuration this reduces to the familiar relation

$\hat{Y}_{CWE}$2

Lewis and Short further state that their plane version with a full converse, involving three geometric alternatives, had not previously been recorded to their knowledge (Lewis et al., 22 May 2026).

5. Casey in physical science and astronomy

In plasma physics, Casey appears as the lead name in the paper to which Zheng and Bonasera respond in their comment on inertial confinement fusion implosions (Zheng et al., 2013). Casey et al. had interpreted anomalously low $\hat{Y}_{CWE}$3 proton yield and high $\hat{Y}_{CWE}$4 neutron yield relative to $\hat{Y}_{CWE}$5 fusion in OMEGA implosions as evidence for fuel stratification. Zheng and Bonasera instead propose that, during the compression stage, the fuel is far from thermal equilibrium and that ions of all species are inward accelerated to a common speed $\hat{Y}_{CWE}$6 (Zheng et al., 2013). In their monoenergetic model,

$\hat{Y}_{CWE}$7

so that the yield ratio becomes proportional to a ratio of cross-sections evaluated at the same velocity,

$\hat{Y}_{CWE}$8

They also present a Hubble-type implosion model $\hat{Y}_{CWE}$9 with Gaussian density profile $(\hat{y}_{score}, \hat{y}_{label})$0, arguing that non-Maxwellian velocity distributions can reproduce the observed yield anomalies without invoking changing D/T concentration in the hot spot (Zheng et al., 2013).

In molecular spectroscopy, Casey appears in the experimental source “Casey-Leopold (1993),” whose Rydberg-Klein-Rees turning points are used as mid-$(\hat{y}_{score}, \hat{y}_{label})$1 anchor points in a global two-point Padé fit to the ground-state $(\hat{y}_{score}, \hat{y}_{label})$2 potential of the chromium dimer $(\hat{y}_{score}, \hat{y}_{label})$3 (Olivares-Pilón et al., 2024). The 2024 study reports that Casey and Leopold measured 29 vibrational transitions and extracted 29 pairs of inner and outer turning points over $(\hat{y}_{score}, \hat{y}_{label})$4 a.u. (Olivares-Pilón et al., 2024). Combined with exact small-$(\hat{y}_{score}, \hat{y}_{label})$5 and large-$(\hat{y}_{score}, \hat{y}_{label})$6 asymptotics, these data support a zero-less two-point Padé approximant of order $(\hat{y}_{score}, \hat{y}_{label})$7, whose solution through the radial Schrödinger equation via the Lagrange-mesh method yields 19,694 strongly bound and 218 weakly bound rovibrational levels (Olivares-Pilón et al., 2024). The paper states that the fit reproduces 29 RKR energies to within 3–4 decimal digits and that vibrational energies $(\hat{y}_{score}, \hat{y}_{label})$8 for $(\hat{y}_{score}, \hat{y}_{label})$9 agree with experiment to 3–4 decimal digits (Olivares-Pilón et al., 2024).

In stellar spectroscopy, “Casey” refers to Andrew Casey’s implementation of The Cannon, incorporated into APOGEE DR14 and compared with the APOGEE Stellar Parameters and Chemical Abundances Pipeline (ASPCAP) (Holtzman et al., 2018). The Cannon models pseudo-continuum-normalized flux at each pixel as a low-order polynomial in stellar labels and is trained in DR14 on 1,464 giant stars covering $2021$0, $2021$1, and $2021$2 (Holtzman et al., 2018). A central distinction is between uncensored fitting, in which all pixels are available for all labels, and censored fitting, in which each elemental abundance label is restricted to the same line windows ASPCAP uses for that element. The paper reports that censored Cannon and ASPCAP abundances agree to $2021$3 dex in their medians, but that element-by-element scatter differs: Ca becomes noisier in censored Cannon, whereas Ni remains tighter than ASPCAP even in censored mode (Holtzman et al., 2018).

In high-redshift galaxy studies, Caitlin Casey is the authorial reference point for predictions and observations of Little Red Dots (LRDs) (Casey et al., 24 May 2025). The 2025 ALMA study follows the prediction that compact LRDs with modest $2021$4 should have dust masses as low as $2021$5 (Casey et al., 24 May 2025). It reports 1.3 mm continuum observations of 60 LRDs, no individual detections at an average depth of $2021$6, and a stacked non-detection with

$2021$7

corresponding to a $2021$8 upper limit of $2021$9 in dust mass and $09$0 in total dust luminosity (Casey et al., 24 May 2025). The paper concludes that the results are consistent either with compact but modest dust reservoirs producing $09$1, or with a dust-free interpretation in which extreme Balmer breaks are generated by dense gas with $09$2 around a central black hole (Casey et al., 24 May 2025).

6. Casey as a faculty persona and as a cross-domain label

In physics education research, Casey is neither a person nor a theorem but one of four personas derived from $09$3 semi-structured interviews with physics faculty (Hamdan et al., 2024). “Casey, the Cautious Sharer” occupies an intermediate position between proactive identity sharing and strict separation of personal and professional life. The persona is motivated by a wish to foster an environment in which students feel “people first, not just physics students,” yet is constrained by concerns about alienation, discomfort, and professional repercussions, including the explicit statement that “it wouldn’t be smart for my career to speak about my religion in class” (Hamdan et al., 2024).

The study identifies several mechanisms characteristic of this persona: selective disclosure, student-prompted sharing, message framing and boundary setting, and avoidance of risky humor (Hamdan et al., 2024). Public or visible identities such as being a parent or alumnus are more readily disclosed; religion, political views, and culturally specific humor are kept private or are surfaced only when directly prompted. The persona emerged in 10 of 19 interviews. The paper further reports that, among the faculty interviewed, 15 who were explicitly open about their identities reported that students approached them with personal issues, whereas Casey’s guarded style appears correlated with fewer such student approaches (Hamdan et al., 2024). Within the Yu and Chou empathetic pathway framework, this cautiousness reduces the contextual information available for cognitive or affective empathy (Hamdan et al., 2024).

Because the term spans unrelated literatures, disambiguation is often necessary.

Usage of “Casey” or “CASEY”	Domain	Source
LLM-based vulnerability triage system	Software security	(Torkamani et al., 31 Jan 2025)
Casey’s theorem with higher-dimensional converse	Geometry	(Lewis et al., 22 May 2026)
“Casey, the Cautious Sharer” persona	Physics education research	(Hamdan et al., 2024)
Casey-Leopold RKR turning points	Molecular spectroscopy	(Olivares-Pilón et al., 2024)
The Cannon (Casey 2016) in APOGEE DR14	Stellar spectroscopy	(Holtzman et al., 2018)
Caitlin Casey’s LRD dust predictions and ALMA limits	Extragalactic astronomy	(Casey et al., 24 May 2025)
Casey et al. interpretation challenged in ICF comment	Plasma physics	(Zheng et al., 2013)

Taken together, these usages show that “CASEY” is not a stable cross-disciplinary concept but a polysemous label. In computing it denotes a concrete LLM-based triage architecture; in geometry it denotes an eponymous determinant theorem; in education research it functions as a persona name; and in several physical-science papers it marks authorial provenance or data lineage rather than a standalone concept. The practical consequence is bibliographic: interpretation depends almost entirely on disciplinary context.