Review PRs one at a time, not in a batch window: LLM auditor detection drops from 50–60% to 16–22% when benign and malicious diffs share the review context

arXiv 2608.02693·high signalXBlueskyLinkedInCopy link

PRWeaver runs 208 execution-validated attacks from ten real repositories through three PR-auditing agents across six auditor-model systems, in 832 matched review renderings. Splitting an attack across commits barely helps the attacker (≤5 points), but interleaving it across concurrent PRs costs detection 5–13 points and fusing it into a change whose stated purpose plausibly explains the malicious diff costs 10–18 points. The concrete configuration lesson: giving your auditor a wider window is actively harmful — whole-window review at N=24 detects 16–22% versus 50–60% under per-PR review, so repository history is not the missing ingredient, review isolation is.