Not All Adversarial Comments Are Equal
A ranked empirical study of twelve comment injection attacks against LLM-based code vulnerability detection. Published in the 2nd IEEE International Conference on Cyber-AI, September 2026, pages 779–784.
PUBLICATIONS
Papers and preprints
Research on how language models review code for security vulnerabilities, how comments can manipulate those reviews, and how to evaluate models against secure controls.
Analyze the Code, Not the Comments
Comment-stripped analysis fully defends LLM-based code vulnerability detectors against adversarial comment injection. Published in the 2nd IEEE International Conference on Cyber-AI, September 2026, pages 785–790.
Adversarial comments transfer across model sizes
Adversarial comments that defeat a robust model can transfer to weaker models in this study of comment injection against LLM-based code vulnerability detection.
When telling a model to distrust comments can backfire
A cautionary study of prompt-based defenses against adversarial comment injection in LLM-based code vulnerability detection.
Are LLM application repositories worse at container hygiene?
A matched study of Dockerfiles and Compose files in repositories that use large language models.
Detection Rate Is the Wrong Metric
Adversarial comment injection shifts the decision threshold of LLM code reviewers. The replication package includes verdict logs and scripts.
Known-Bad Names, Unknown-Bad Uses
What local code models detect when they review cryptographic API misuse.
Does Indirection Hurt?
Paired evidence on LLM review of indirectly written cryptographic API misuse.