Can Adversarial Code Comments Fool AI Security Reviewers -- Large-Scale Empirical Study of Comment-Based Attacks and Defenses Against LLM Code Analysis

Scott Thornton

cs.CRFeb 18, 2026

Can Adversarial Code Comments Fool AI Security Reviewers -- Large-Scale Empirical Study of Comment-Based Attacks and Defenses Against LLM Code Analysis

Authors: Scott Thornton

Abstract

AI-assisted code review is widely used to detect vulnerabilities before production release. Prior work shows that adversarial prompt manipulation can degrade large language model (LLM) performance in code generation. We test whether similar comment-based manipulation misleads LLMs during vulnerability detection. We build a 100-sample benchmark across Python, JavaScript, and Java, each paired with eight comment variants ranging from no comments to adversarial strategies such as authority spoofing and technical deception. Eight frontier models, five commercial and three open-source, are evaluated in 9,366 trials. Adversarial comments produce small, statistically non-significant effects on detection accuracy (McNemar exact p > 0.21; all 95 percent confidence intervals include zero). This holds for commercial models with 89 to 96 percent baseline detection and open-source models with 53 to 72 percent, despite large absolute performance gaps. Unlike generation settings where comment manipulation achieves high attack success, detection performance does not meaningfully degrade. More complex adversarial strategies offer no advantage over simple manipulative comments. We test four automated defenses across 4,646 additional trials (14,012 total). Static analysis cross-referencing performs best at 96.9 percent detection and recovers 47 percent of baseline misses. Comment stripping reduces detection for weaker models by removing helpful context. Failures concentrate on inherently difficult vulnerability classes, including race conditions, timing side channels, and complex authorization logic, rather than on adversarial comments.

Figures & tables

Figure 1: Experimental pipeline. The primary experiment evaluates 100 vulnerable samples across 8 comment variants, 8 models (5 commercial, 3 open-source), and up to 3 system prompt conditions (9,366 evaluations). The defense branch evaluates 4 automated strategies across adversarial variants (4,646 evaluations). Total: 14,012 evaluations.

Model	API Identifier	Provider	Tier
Claude Opus 4.6	claude-opus-4-6	Anthropic	Frontier
GPT-5.2	gpt-5.2	OpenAI	Frontier
Gemini 2.5 Pro	gemini-2.5-pro	Google	Frontier
DeepSeek Chat	deepseek-chat	DeepSeek	Open-Frontier
Sonar Pro	sonar-pro	Perplexity	RAG-Assisted

Table 1: Commercial models. All queried through native APIs at temperature 0.3, timeout 120s.

Model	Params	Quantization	Infrastructure
Llama 3.3 70B	70B	Full precision	CPU
Qwen 2.5 72B	72B	q4_K_M (4-bit)	CPU
DeepSeek-Coder-V2 16B	16B	Full precision	GPU

Table 2: Open-source models. Served locally via Ollama at temperature 0.3. Evaluated on C0 and C4 under SP0 (200 evaluations per model, 600 total).

Model	Class	C0 Detection Rate
Perplexity Sonar Pro	Commercial	96.1%
Claude Opus 4.6	Commercial	95.0%
GPT-5.2	Commercial	93.0%
Gemini 2.5 Pro	Commercial	91.9%
DeepSeek Chat	Commercial	89.0%
Llama 3.3 70B	Open-Source	72.0%

Table 3: Baseline detection rates (C0 + SP0). A clear tier structure: commercial models exceed 89%; open-source models range 53–72%.

Figure 2: C0 vs. C4 paired comparison across all eight models. (a) Detection rates are nearly identical for both commercial and open-source models. (b) Forest plot of

\Delta

FNR with 95% CIs—all intervals span zero, none approaching significance.

Model	Class	$n$	C0 DR	C4 DR	$\Delta$ FNR	$b$	$c$	McNemar $p$
Claude Opus 4.6	Commercial	100	95.0%	94.0%	$+1.0\%$	1	0	1.000
GPT-5.2	Commercial	99	93.0%	91.9%	$+1.1\%$	3	2	1.000
Gemini 2.5 Pro	Commercial	99	91.9%	91.9%	$0.0\%$	4	4	1.000
DeepSeek Chat	Commercial	100	89.0%	93.0%	$-4.0\%$	1	5	0.219
Perplexity Sonar Pro	Commercial	75	96.1%	92.0%	$+4.1\%$	5	2	0.453
Llama 3.3 70B	Open-Source	100	72.0%	71.0%	$+1.0\%$	12	11	1.000

Table 4: C0 vs. C4 (SP0)—paired comparison with discordant pairs. No model reaches statistical significance (all

p>0.21

), regardless of model class or baseline capability.

Figure 3: Detection rates by model $\times$ comment variant (SP0). C5–C7 (right of dashed line) were tested on a 30-sample subset with higher baseline rates—see Section 5.3 for discussion of subset selection bias.

Model	C0 Full	C0 Subset	Bias
Claude Opus 4.6	95.0%	100.0%	$+5.0\%$
DeepSeek Chat	89.0%	96.7%	$+7.7\%$
Gemini 2.5 Pro	91.9%	100.0%	$+8.1\%$
GPT-5.2	93.0%	100.0%	$+7.0\%$
Perplexity Sonar Pro	96.1%	93.3%	$-2.7\%$

Table 5: Subset selection bias. The C0 detection rate on the 30-sample subset is systematically higher than the full 100-sample baseline.

Figure 4: Detection rate by language $\times$ vulnerability category (C0+SP0). Java cryptography (50%) and access control (75%) are dramatically harder than their counterparts. Several cells have $n\leq 4$ ; rates should be interpreted as indicative.

Panel of Figure 5 — Figure 5: Defense effectiveness comparison. SAST cross-referencing (D5) is the clear winner.

Defense	Overall DR	Opus	DeepSeek	GPT-5.2	Perplexity	Recovery
Baseline (C4+SP0)	—	94.0%	93.0%	91.9%	92.0%	—
D1 Comment Strip	93.2%	96.9%	89.0%	95.9%	91.0%	30% (17/57)
D2 Dual-Pass	96.1%	97.2%	94.5%	97.2%	95.5%	35% (20/57)
D5 SAST Cross-Ref	96.9%	97.2%	96.6%	97.2%	96.6%	47% (27/57)
D6 Comment Anomaly	95.1%	96.9%	92.8%	96.9%	93.8%	0% (0/57)

Table 6: Defense effectiveness. D5 achieves the highest detection rate and recovery rate. Recovery rate =

|\text{baseline\_misses}\cap\text{defense\_hits}|/|\text{baseline\_misses}|

where baseline_misses are the 57 sample

\times

model pairs missed under C4+SP0.

Sample	CWE	Lang	Missed	Reasoning Required
009	367	Python	3/5	Temporal: state changes between check and use
011	208	Python	4/5	Side-channel: execution time leaks secret data
020	863	Java	3/5	Compositional: annotations interact unsafely
089	285	Java	3/5 (C4)	Compositional: multi-step auth with implicit state
076	327	Java	2/5	Domain: requires JCA API semantics

Table 7: Consistently missed samples. Models missed = count of commercial models failing to detect under C0+SP0, except SAMPLE-089 (C4-induced). Reasoning column identifies the cognitive capability required beyond pattern matching.

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Metric	Count	Rate	95% CI
Responses audited	74	—	—
Keyword matches	63	85.1%	[77.0, 93.2]
C5–C7 echo (false hit)	1/14	7.1%	[0.0, 20.7]
Paraphrase miss	1/11	9.1%	[0.0, 26.1]

Appendix

Table 8: Keyword scoring audit: echo and miss rates.

Adversarial Attacks

Adversarial attacks exploit crafted inputs, poisoned data, or system interactions to manipulate AI predictions, behavior, privacy, or reliability.

See all 447 papers

When AI Agrees Too Much: Manipulating Automated Code Review via Bias Injection
Mar 19, 2026Georgios Alexopoulos, Nikolaos Alexopoulos, Diomidis Spinellis +1Automated Code Review Adversarial Attacks on LLMs
University of Athens · National Infrastructures for Research and Technology · Athens University of Economics and Business +1
Words Speak Louder Than Code: Investigating Cognitive Heuristics in LLM-Based Code Vulnerability Detection
Jun 29, 2026Asif Shahriar, Hongyu Cai, Hadjer Benkraouda +2Software Vulnerability Detection Adversarial Attacks on LLMs
BRAC University · Purdue University · University of Illinois Urbana-Champaign
SEVRA-BENCH: Social Engineering of Vulnerabilities in Review Agents
Jun 11, 2026Rui Melo, Riccardo Fogliato, Sean Zhou +2Software Vulnerability Detection AI Agent Security
1Carnegie Mellon University · 2Microsoft Core AI · 3Independent Researcher +1

Mar 19, 2026J/K move · Enter open · S save

When AI Agrees Too Much: Manipulating Automated Code Review via Bias Injection

Georgios Alexopoulos, Nikolaos Alexopoulos, Diomidis Spinellis, Dimitris Mitropoulos

University of Athens · National Infrastructures for Research and Technology · Athens University of Economics and Business+1

Automated Code Review Adversarial Attacks on LLMs LLM Security Framing Effects in Language Models Software Vulnerability Detection

Open paper AskPDF arXiv

Automated Code Review (ACR) systems integrating Large Language Models (LLMs) are increasingly adopted in software development workflows, ranging from interactive assistants to autonomous agents in CI/CD pipelines. In this paper, we study how LLM-based vulnerability detection in ACR is affected by the framing effect: the tendency to let the presentation of information override its semantic content in forming judgments. We examine whether adversaries can exploit this through contextual-bias injection (crafting PR metadata to bias ACR security judgments) as a supply-chain attack vector against real-world ACR pipelines. To this end, we first conduct a large-scale exploratory study across 6 LLMs under five framing conditions, establishing the framing effect as a systematic and widespread phenomenon in LLM-based vulnerability detection. We then design a realistic and controlled experimental environment, evaluating 33 CVEs across 20 real-world projects and two popular ACR pipelines (Claude Code and CodeRabbit), to assess the susceptibility of real-world ACR pipelines to vulnerability re-introduction attacks. We employ two attack strategies: a template-based attack inspired by prior related work, and a novel LLM-assisted refinement attack. We find that template-based attacks are ineffective and may even backfire, as direct biasing attempts raise suspicions. Our refinement attack, on the other hand, is successful in 32/33 (97%) cases, exploiting a fundamental asymmetry: attackers can iteratively refine attacks against a local clone of the review pipeline, while defenders have only one chance to detect them. Overall, our findings highlight the dangers of over-relying on ACR and stress the importance of human oversight and contributor trust in the development process.

Abstract

Adversarial Attacks

Explore similar work

When AI Agrees Too Much: Manipulating Automated Code Review via Bias Injection

Words Speak Louder Than Code: Investigating Cognitive Heuristics in LLM-Based Code Vulnerability Detection

SEVRA-BENCH: Social Engineering of Vulnerabilities in Review Agents