arXiv cs.LGPaper
Trusting the Tool: Asymmetric Deference of LLM Vulnerability Auditors to Static-Analysis Evidence
LLMs conducting security audits using static-analysis output show asymmetric credulity: they're highly vulnerable to false negatives if the tool falsely claims something is safe, but resistant to false positives. This is the wrong asymmetry for security. If you're building LLM-plus-static-analyzer pipelines for vulnerability scanning, you need explicit confirmation logic and out-of-band verification of any safety claim, not just model-level confidence.