Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Measuring and Exploiting Confirmation Bias in LLM-Assisted Security Code Review

Dimitris Mitropoulos, Nikolaos Alexopoulos, Georgios Alexopoulos, Diomidis Spinellis

Abstract

Security code reviews increasingly rely on systems integrating Large Language Models (LLMs), ranging from interactive assistants to autonomous agents in CI/CD pipelines. We study whether confirmation bias (i.e., the tendency to favor interpretations that align with prior expectations) affects LLM-based vulnerability detection, and whether this failure mode can be exploited in software supply-chain attacks. We conduct two complementary studies. Study 1 quantifies confirmation bias through controlled experiments on 250 CVE vulnerability/patch pairs evaluated across four state-of-the-art models under five framing conditions for the review prompt. Framing a change as bug-free reduces vulnerability detection rates by 16-93%, with strongly asymmetric effects: false negatives increase sharply while false positive rates change little. Bias effects vary by vulnerability type, with injection flaws being more susceptible to them than memory corruption bugs. Study 2 evaluates exploitability in practice mimicking adversarial pull requests that reintroduce known vulnerabilities while framed as security improvements or urgent functionality fixes via their pull request metadata. Adversarial framing succeeds in 35% of cases against GitHub Copilot (interactive assistant) under one-shot attacks and in 88% of cases against Claude Code (autonomous agent) in real project configurations where adversaries can iteratively refine their framing to increase attack success. Debiasing via metadata redaction and explicit instructions restores detection in all interactive cases and 94% of autonomous cases. Our results show that confirmation bias poses a weakness in LLM-based code review, with implications on how AI-assisted development tools are deployed.

Measuring and Exploiting Confirmation Bias in LLM-Assisted Security Code Review

Abstract

Security code reviews increasingly rely on systems integrating Large Language Models (LLMs), ranging from interactive assistants to autonomous agents in CI/CD pipelines. We study whether confirmation bias (i.e., the tendency to favor interpretations that align with prior expectations) affects LLM-based vulnerability detection, and whether this failure mode can be exploited in software supply-chain attacks. We conduct two complementary studies. Study 1 quantifies confirmation bias through controlled experiments on 250 CVE vulnerability/patch pairs evaluated across four state-of-the-art models under five framing conditions for the review prompt. Framing a change as bug-free reduces vulnerability detection rates by 16-93%, with strongly asymmetric effects: false negatives increase sharply while false positive rates change little. Bias effects vary by vulnerability type, with injection flaws being more susceptible to them than memory corruption bugs. Study 2 evaluates exploitability in practice mimicking adversarial pull requests that reintroduce known vulnerabilities while framed as security improvements or urgent functionality fixes via their pull request metadata. Adversarial framing succeeds in 35% of cases against GitHub Copilot (interactive assistant) under one-shot attacks and in 88% of cases against Claude Code (autonomous agent) in real project configurations where adversaries can iteratively refine their framing to increase attack success. Debiasing via metadata redaction and explicit instructions restores detection in all interactive cases and 94% of autonomous cases. Our results show that confirmation bias poses a weakness in LLM-based code review, with implications on how AI-assisted development tools are deployed.
Paper Structure (61 sections, 3 figures, 6 tables)

This paper contains 61 sections, 3 figures, 6 tables.

Table of Contents

  1. Introduction
  2. First systematic study of confirmation bias in LLM-based vulnerability detection.
  3. Differential impact of confirmation bias across vulnerability types.
  4. Demonstration of practical supply-chain attack exploitability.
  5. Evaluation of debiasing strategies and deployment guidance.
  6. Publicly accessible artifacts for advancing research.
  7. Background
  8. Interactive Review Assistants.
  9. Autonomous Review Agents.
  10. Metadata in Code Review Context.
  11. Research Questions
  12. Adversary Model.
  13. Research Questions.
  14. Methodology
  15. Study 1: Controlled Bias Experiment
  16. ...and 46 more sections

Figures (3)

  • Figure 1: Supply-chain attack threat model: adversary crafts malicious PR with bias-inducing metadata to reintroduce known vulnerabilities in projects using LLM-based review.
  • Figure 2: Overview of our controlled bias experiment.
  • Figure 3: Refinement attack ( Biased-2): the Variant-2 adversary refines the PR description based on review feedback, with the review system re-evaluating each iteration. The process stops upon PR approval (attack success) or after $t$ refinements (attack failure). In our experiments, $t=3$ (4 reviews total).