mlsanityData to 7 Oct 2026

Measuring and Exploiting Contextual Bias in LLM-Assisted Security Code Review

arXiv 2603.18740 ↗First posted 19 Mar 2026cs.SE cs.AI cs.CRcited by 3

Not on the map. Why?

Abstract (arXiv)

Automated Code Review (ACR) systems integrating Large Language Models (LLMs) are increasingly adopted in software development workflows, ranging from interactive assistants to autonomous agents in CI/CD pipelines. In this paper, we study how LLM-based vulnerability detection in ACR is affected by the framing effect: the tendency to let the presentation of information override its semantic content in forming judgments. We examine whether adversaries can exploit this through contextual-bias injection (crafting PR metadata to bias ACR security judgments) as a supply-chain attack vector against real-world ACR pipelines. To this end, we first conduct a large-scale exploratory study across 6 LLMs under five framing conditions, establishing the framing effect as a systematic and widespread phenomenon in LLM-based vulnerability detection. We then design a realistic and controlled experimental environment, evaluating 33 CVEs across 20 real-world projects and two popular ACR pipelines (Claude Code and CodeRabbit), to assess the susceptibility of real-world ACR pipelines to vulnerability re-introduction attacks. We employ two attack strategies: a template-based attack inspired by prior related work, and a novel LLM-assisted refinement attack. We find that template-based attacks are ineffective and may even backfire, as direct biasing attempts raise suspicions. Our refinement attack, on the other hand, is successful in 32/33 (97%) cases, exploiting a fundamental asymmetry: attackers can iteratively refine attacks against a local clone of the review pipeline, while defenders have only one chance to detect them. Overall, our findings highlight the dangers of over-relying on ACR and stress the importance of human oversight and contributor trust in the development process.

Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Builds on 45 of its 93 references that are in the map. First posted on arXiv 19 Mar 2026.

Builds on

45 of 93 references.

References · 45

  1. 2021Calibrate Before Use: Improving Few-Shot Performance of Language Modelscited by 1,371
  2. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  3. 2023Towards Understanding Sycophancy in Language Modelscited by 988
  4. 2022Discovering Language Model Behaviors with Model-Written Evaluationscited by 805
  5. 2022A Survey on In-context Learningcited by 717
  6. 2023Formalizing and Benchmarking Prompt Injection Attacks and Defensescited by 328
  7. 2022Do Users Write More Insecure Code with AI Assistants?cited by 186
  8. 2024SecAlign: Defending Against Prompt Injection with Preference Optimizationcited by 179
  9. 2023Large Language Models for Code: Security Hardening and Adversarial Testingcited by 149
  10. 2025SycEval: Evaluating LLM Sycophancycited by 101
  11. 2022Automating Code Review Activities by Large-Scale Pre-trainingcited by 98
  12. 2022Using Pre-Trained Models to Boost Code Review Automationcited by 63
33 more
  1. 2024We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMscited by 61
  2. 2021Towards Automating Code Review Activitiescited by 54
  3. 2022VulBERTa: Simplified Source Code Pre-Training for Vulnerability Detectioncited by 51
  4. 2024From Yes-Men to Truth-Tellers: Addressing Sycophancy in Large Language Models with Pinpoint Tuningcited by 51
  5. 2023Data Quality for Software Vulnerability Datasetscited by 49
  6. 2018Spectre Attacks: Exploiting Speculative Executioncited by 47
  7. 2023LLaMA-Reviewer: Advancing Code Review Automation with Large Language Models through Parameter-Efficient Fine-Tuningcited by 47
  8. 2022An Empirical Study of Deep Learning Models for Vulnerability Detectioncited by 44
  9. 2024Large Language Model for Vulnerability Detection: Emerging Results and Future Directionscited by 44
  10. 2025LLMs in Software Security: A Survey of Vulnerability Detection Techniques and Insightscited by 44
  11. 2024Anchoring Bias in Large Language Models: An Experimental Studycited by 37
  12. 2024A Comprehensive Evaluation of Cognitive Biases in LLMscited by 32
  13. 2023Uncovering the Limits of Machine Learning for Automatic Vulnerability Detectioncited by 30
  14. 2025Benchmarking LLMs and LLM-based Agents in Practical Vulnerability Detection for Code Repositoriescited by 29
  15. 2024Securing Large Language Models: Addressing Bias, Misinformation, and Prompt Attackscited by 24
  16. 2024Fine-Tuning and Prompt Engineering for Large Language Models-based Code Review Automationcited by 23
  17. 2025Benchmarking Adversarial Robustness to Bias Elicitation in Large Language Models: Scalable Automated Assessment with LLM-as-a-Judgecited by 23
  18. 2025BitsAI-CR: Automated Code Review via LLM in Practicecited by 22
  19. 2025Let the Trial Begin: A Mock-Court Approach to Vulnerability Detection using LLM-Based Agentscited by 20
  20. 2025Don't Judge Code by Its Cover: Exploring Biases in LLM Judges for Code Evaluationcited by 18
  21. 2025Challenging the Evaluator: LLM Sycophancy Under User Rebuttalcited by 18
  22. 2019CORE: Automating Review Recommendation for Code Changescited by 14
  23. 2024DLAP: A Deep Learning Augmented Large Language Model Prompting Framework for Software Vulnerability Detectioncited by 13
  24. 2025Rethinking Code Review Workflows with LLM Assistance: An Empirical Studycited by 10
  25. 2025ASTRAL: Automated Safety Testing of Large Language Modelscited by 7
  26. 2024An Insight into Security Code Review with LLMs: Capabilities, Obstacles, and Influential Factorscited by 6
  27. 2024LLM-Based Misconfiguration Detection for AWS Serverless Computingcited by 5
  28. 2025Uncovering Systematic Failures of LLMs in Verifying Code Against Natural Language Specificationscited by 5
  29. 2026STELLAR: A Search-Based Testing Framework for Large Language Model Applicationscited by 5
  30. 2023On the Effect of Transitivity and Granularity on Vulnerability Propagation in the Maven Ecosystemcited by 4
  31. 2025Adversarial Bug Reports as a Security Risk in Language Model-Based Automated Program Repaircited by 4
  32. 2025Bugdar: AI-Augmented Secure Code Review for GitHub Pull Requestscited by 3
  33. 2025Adversarial Attack Classification and Robustness Testing for Large Language Models for Codecited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 3.

3 papers.

  1. 2026SEVRA-BENCH: Social Engineering of Vulnerabilities in Review Agentscited by 1
  2. 2026Are Frontier LLMs Ready for Cybersecurity? Evidence for Vertical Foundation Models from Dual-Mode Vulnerability Benchmarkscited by 0
  3. 2026ALIBI: Adaptive Agentic Attacks on LLM-Based Vulnerability Detectors via Adversarial Code Commentscited by 0