arXiv cs.AI· Georgios Alexopoulos, Nikolaos Alexopoulos, Diomidis Spinellis, Dimitris Mitropoulos·· 4 小时前精选AI 评分66
研究提出 LLM 辅助偏差注入攻击，可在 97% 的案例中操纵自动化代码审查的安全判断
When AI Agrees Too Much: Manipulating Automated Code Review via Bias Injection
AI 导读
arXiv 论文 2603.18740 研究框架效应对 LLM 自动化代码审查漏洞检测的影响，发现 6 个 LLM 均存在系统性框架效应。
推荐理由
论文给出真实 ACR 管线上的攻击实验数据和攻防不对称机制，对理解 LLM 代码审查的安全风险有具体参考价值。
正文 · 原文
Abstract:Automated Code Review (ACR) systems integrating Large Language Models (LLMs) are increasingly adopted in software development workflows, ranging from interactive assistants to autonomous agents in CI/CD pipelines. In this paper, we study how LLM-based vulnerability detection in ACR is affected by the framing effect: the tendency to let the presentation of information override its semantic content in forming judgments. We examine whether adversaries can exploit this through contextual-bias injection (crafting PR metadata to bias ACR security judgments) as a supply-chain attack vector against real-world ACR pipelines. To this end, we first conduct a large-scale exploratory study across 6 LLMs under five framing conditions, establishing the framing effect as a systematic and widespread phenomenon in LLM-based vulnerability detection.
We then design a realistic and controlled experimental environment, evaluating 33 CVEs across 20 real-world projects and two popular ACR pipelines (Claude Code and CodeRabbit), to assess the susceptibility of real-world ACR pipelines to vulnerability re-introduction attacks. We employ two attack strategies: a template-based attack inspired by prior related work, and a novel LLM-assisted refinement attack. We find that template-based attacks are ineffective and may even backfire, as direct biasing attempts raise suspicions. Our refinement attack, on the other hand, is successful in 32/33 (97%) cases, exploiting a fundamental asymmetry: attackers can iteratively refine attacks against a local clone of the review pipeline, while defenders have only one chance to detect them. Overall, our findings highlight the dangers of over-relying on ACR and stress the importance of human oversight and contributor trust in the development process.
| Comments: | To appear at the 49th International Conference on Software Engineering (ICSE 2027) |
| Subjects: | Software Engineering (cs.SE); Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR) |
| Cite as: | arXiv:2603.18740 [cs.SE] |
| (or arXiv:2603.18740v5 [cs.SE] for this version) | |
| https://doi.org/10.48550/arXiv.2603.18740 arXiv-issued DOI via DataCite |
Submission history
From: Georgios Alexopoulos [view email]
[v1]
Thu, 19 Mar 2026 10:40:27 UTC (350 KB)
[v2]
Thu, 23 Apr 2026 15:04:19 UTC (466 KB)
[v3]
Sat, 12 Sep 2026 16:58:07 UTC (513 KB)
[v4]
Wed, 23 Sep 2026 12:12:39 UTC (513 KB)
[v5]
Tue, 27 Oct 2026 14:45:00 UTC (508 KB)
来源：arXiv cs.AI · arxiv.org