False assurances in static-analysis evidence cause LLM auditors to miss real vulnerabilities
The claim
LLMs give asymmetric deference to static-analysis evidence, with false assurances reducing vulnerability detection accuracy by up to 19 points
Published as: “Trusting the Tool: Asymmetric Deference of LLM Vulnerability Auditors to Static-Analysis Evidence”
So what
Pipelines that feed static-analysis output to LLM auditors should verify the analyser's guarantees before relying on them, as false assurances can substantially degrade security judgments.
The five-minute version
False assurances in static-analysis notes cause LLM auditors to miss real vulnerabilities by up to 19 points, while false alarms do not significantly hurt accuracy and are often disputed. True evidence barely helps (+0.02 accuracy). A verification step that checks each claim separately recovers 12 accuracy points under false assurances (p = 0.002). The effect varies across models, with some (e.g., deepseek-flash, qwen-plus) not misled by false assurances.
What they found 3
- False assurances lower vulnerability detection by up to 19 points, while false alarms never significantly lower accuracy.
“False evidence acted asymmetrically: relative to true notes about the same operations, false assurances lowered the detection of real vulnerabilities by up to 19 points, whereas false alarms never significantly lowered accuracy and were disputed far more often.”
- True static-analysis evidence provides essentially no accuracy gain.
“True evidence barely improved accuracy (+0.02).”
- Separately verifying each claim and showing refuted claims improves accuracy under false assurances by 12 points without harming performance under true evidence.
“Verifying each claim in a separate call and showing the refuted claims raised accuracy under false assurances by 12 points in a pre-specified test (p = 0.002) without loss under true evidence; for a second model the gain was smaller and not significant.”
What undercuts it the paper’s own results
- The reasoning variant of deepseek-flash and qwen-plus are not misled (+0.04 and -0.01).
- When the notes on a patched function claim that a check is missing (C5), accuracy does not fall; it rises, from 0.67 to 0.79 for deepseek-chat (0/8 discordant pairs, p = 0.008) and from 0.37 to 0.55 for deepseek-flash (p = 0.008).
What’s new here 4
- Matches true and false notes on the same code operations, enabling direct attribution of effects to evidence truth.
- Includes false evidence in both directions (assurances and alarms) rather than only safety claims.
- Introduces a direction-aware measure of deference to capture asymmetric effects.
- Evaluates mitigation strategies (e.g., separate verification) with a pre-specified test on held-out data.
Artifacts & methods 5
- intraprocedural C/C++ obligation analysersystem
- six evidence conditions (C0-C5)primitive
- direction-aware deference measuretheory
- verify-show mitigation (separate claim checking)system
- PrimeVul vulnerability datasetdataset