SunnyRESEARCH FOCUS
I study whether language models can reliably review code for security flaws when the code itself contains misleading comments, indirect API use, or secure examples that should not be flagged.
A comment written by the code author can claim that a risky operation was already validated. My experiments measure how different comment strategies affect LLM vulnerability detection, and which strategies work best.
In the comment-stripping study, detection on attacked code fell from 90.0% on clean code to 75.2%. Removing comments brought detection back to 90.0% in the tested models, without retraining.
Matched vulnerable and secure Python snippets help test whether a model can distinguish an actual cryptographic API misuse from correct code that looks unfamiliar.
Datasets, verdict logs, scripts, and paper links are published so readers can inspect the examples and reproduce the headline analyses.