How Code Representation Format Shapes False Positives in Cross-Language LLM Vulnerability Detection

arXiv·low signalXBlueskyLinkedInCopy link

Systematically varies training intensity and code representation format (raw source text vs. pruned ASTs) to measure false positive behavior in LLM-based vulnerability detection across programming languages. Finds that representation format has a larger effect on false positive rates than model size or training duration, with pruned ASTs significantly reducing spurious alerts. For anyone building or deploying AI-powered SAST/code security tools, choice of code representation is the highest-leverage knob for reducing noise.