Extracting Recurring Vulnerabilities from Black-Box LLM-Generated Software

Amit Levi; Avi Mendelson; Maayan Yamin; Noam Benzimra; Tomer Kordonsky

REVIEW 4 major objections 5 minor 1 cited by

A black-box attacker who knows which LLM generated an app can predict hidden backend vulnerabilities from visible frontend features, with reported attack success up to 94% and coverage up to 93% even when the target domain was excluded from

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Frontend features of LLM-generated apps can predict hidden backend vulnerabilities that a given model tends to reproduce, enabling black-box attack triage.

T0 review reviewed 2026-08-03 challenge →

load-bearing objection The core idea is worth taking seriously, but the headline cross-domain attack numbers are arithmetically impossible under the paper's own 5-program held-out protocol, so the central quantitative claim needs a major correction before the work can be cited. the 4 major comments →

arxiv 2602.04894 v4 pith:S4ROCWX6 submitted 2026-02-02 cs.CR cs.AI

Extracting Recurring Vulnerabilities from Black-Box LLM-Generated Software

Tomer Kordonsky , Amit LeVi , Maayan Yamin , Noam Benzimra , Avi Mendelson This is my paper

classification cs.CR cs.AI

keywords FSTabvulnerability recurrenceblack-box attackLLM-generated codefeature-security mappingcross-domain transferstatic analysisweb application security

verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Code-generation LLMs are so template-driven that the same security flaws recur across the programs they write, and the paper argues this persistence makes hidden vulnerabilities predictable. It introduces FSTab, a table built per model that links 59 observable frontend features—login forms, search boxes, file uploads—to the backend weakness types most likely to accompany them. In the paper's evaluation, the table predicts real vulnerabilities on unseen programs with up to 94% attack success and 93% coverage, and the numbers barely drop when the target application domain is excluded from training. Four new metrics measure how persistently each model repeats a vulnerability across rephrasings and domains, and they reveal a 'universality gap': vulnerabilities transfer across domains more strongly than they recur within one. If the claim holds, LLM-generated software carries a stable, model-specific attack surface that can be exploited without any source-code access.

Core claim

The paper's central discovery is that observable software features can act as black-box predictors of hidden vulnerabilities in LLM-generated programs. Concretely: given a program's visible frontend features and knowledge of the source model, an FSTab constructed from other programs written by that same model returns a prioritized list of backend vulnerability types, and the paper reports that this prediction matches static-analysis ground truth on held-out programs at up to 94% attack success and 93% vulnerability coverage. Even when all programs from the target domain are excluded from the table's construction, performance remains high, which the authors take as evidence that recurring vul

What carries the argument

The central object is the Feature–Security Table (FSTab): a per-model lookup table mapping 59 standardized frontend features to the most likely backend vulnerability types. Associations are scored by pointwise mutual information, log(P(r|f)/P(r)), with Laplace smoothing, and a greedy selection step applies a diversity penalty so a few globally common weaknesses do not dominate every feature. At attack time the query is simply the union of the top-k lists for the observed features in the model's table. The companion metrics FVR, RVP, DVR, and CDT measure feature-level, rephrasing-level, and domain-level recurrence, plus cross-domain transfer, all defined over feature–security-rule pairs.

Load-bearing premise

The whole enterprise assumes that the automated feature extractor used to build FSTab—which reads source code—sees the same things a real attacker sees from the UI, and that the static analyzers' flags match genuinely exploitable vulnerabilities; if either assumption breaks, the reported attack numbers overstate what a real black-box attacker would achieve.

What would settle it

Run FSTab with features collected purely by clicking through a deployed UI and sending network requests (never parsing source) on a held-out set of apps generated by the same models; if attack success and coverage collapse to chance, the reported results are an artifact of source-derived feature extraction rather than true black-box prediction.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

An attacker who knows the generating model can turn a few minutes of UI reconnaissance into a short, prioritized list of where to look for exploitable weaknesses, sharply reducing the cost of finding a live vulnerability in an LLM-built web app.
Security evaluation of code generators should become model-centric: measure how often a model repeats the same vulnerability across rephrasings and domains, not only whether individual generations are vulnerable.
Because cross-domain transfer is high, a single FSTab built for one model on one domain can be used to attack apps the model generates in other domains, so a model profiled once becomes a reusable exploit resource.
The observed universality gap (cross-domain transfer higher than within-domain recurrence) indicates that recurring insecure templates are intrinsic to the model, so defenses must target generation behavior rather than per-domain filtering.
Countermeasures that reduce template rigidity—such as security-aware post-generation rewriting or feature-conditioned regression tests on high-recurrence features—would directly shrink what FSTab can predict.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

The same feature→vulnerability fingerprinting idea is portable to other structured artifact classes beyond web apps—mobile APIs, microservices, infrastructure-as-code—wherever a model generates both a visible interface and hidden logic; if the recurrence mechanism is general, the attack surface is broader than web frontends.
Because ground truth comes from static analyzers, FSTab's coverage is bounded by what those analyzers can express; a label set built from dynamic analysis or manual auditing could uncover additional recurring patterns the current table silently misses.
The attack assumes the model's identity is known; a natural stress test is measuring how much attack success survives when the attacker uses the wrong model's table, since the paper's own results show models converging on similar patterns for many features.
The strong link between recurrence metrics and attack success suggests rephrasing persistence could serve as a cheap, no-attack-needed screening indicator of how exploitable a newly released code model's output is likely to be.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Desk Editor's Note

The core idea is worth taking seriously, but the headline cross-domain attack numbers are arithmetically impossible under the paper's own 5-program held-out protocol, so the central quantitative claim needs a major correction before the work can be cited.

read the letter

First thing to know: the attack idea is genuinely interesting and the paper is worth reading, but the headline numbers don't survive contact with the stated protocol. Table 1's cross-domain ASR values like 76.47%, 88.24%, and 93.75% are arithmetically impossible if each domain has 5 held-out programs, since each program contributes 1/5 = 20%. The paper also reports 1050 total programs in Section 5.1, 900 in Appendix B.1, and Table 4 implies 175 per model — none of these reconciles with the denominators in the table. So the 'up to 94% attack success' claim in the abstract is unsupported as reported.

What's genuinely new is framing observable frontend features as black-box predictors of hidden backend vulnerabilities. Prior work established that LLMs have persistent vulnerabilities and identifiable fingerprints; this paper extends that to a specific predictive mapping across domains. The FSTab construction itself — a PMI lookup table with a diversity penalty — is reasonable and the pipeline is unusually well documented: cost breakdown, hyperparameter sensitivity, scanner-precision audit, and a concrete case study all appear in the appendix. The recurrence metrics (FVR/RVP/DVR/CDT) give the field a useful vocabulary for model-centric security evaluation.

The soft spots are real but uneven. The arithmetic issue is load-bearing: even with perfect feature extraction and perfect labels, the reported values cannot be regenerated from the paper's own split and metric definitions. Then the black-box premise rests on an unvalidated proxy — features are extracted from source code via AST heuristics, not from actual UI observation, and the authors themselves only call it a 'high-fidelity proxy.' Scanner labels are only ~75% precise for CodeQL and ~63% for Semgrep, so the measured recurrence partially reflects scanner artifacts rather than pure model behavior. Finally, the 'Universality Gap' compares CDT (a fraction of distinct vulnerability types shared across domains) with DVR (a fraction of recurrent vulnerabilities within a domain) — those are different quantities, and claiming CDT > DVR as evidence of architectural bias doesn't follow. These are acknowledged to varying degrees in the paper, but the arithmetic problem is more fundamental than the limitations they list.

Who this is for: people working on LLM code security, model fingerprinting, or black-box reconnaissance will find the framing useful and the framework a good starting point. I would not cite it as evidence until the evaluation is corrected. But it deserves a serious referee — the idea is important enough that a major revision with regenerated numbers and a validation of the feature-extraction proxy is worth chasing.

Referee Report

4 major / 5 minor

Summary. The paper proposes FSTab, a per-LLM lookup table that maps observable frontend features (e.g., login, file upload) to likely backend vulnerability rule IDs using PMI-based co-occurrence statistics computed over programs generated by the same model. The authors claim a black-box attack achieving up to 94% attack success and 93% vulnerability coverage across held-out domains, and introduce four recurrence metrics (FVR, RVP, DVR, CDT) to quantify vulnerability persistence. The paper includes extensive appendices with model-specific FSTab tables, a cost analysis, a case study, and a public code release.

Significance. The idea that LLM-generated code carries model-specific, feature-conditioned vulnerability fingerprints is timely and plausible, and the paper has clear strengths: a full pipeline (feature extraction, PMI scoring, diversity selection), public code, and an honest acknowledgment that scanner labels have roughly 63-75% precision (Appendix G). If the quantitative claims were reproducible, the work would make a useful contribution to LLM code security. However, the headline attack numbers are arithmetically incompatible with the described protocol, which invalidates the central empirical claim in its current form.

major comments (4)

[§5.1, Table 1, Eq. (22)] With 5 held-out programs per domain, ASR per domain must be an integer multiple of 20% (0/5 .. 5/5). The cross-domain rows of Table 1 report values such as 76.47%, 88.24%, 93.75%, 81.25%, 72.73%, 83.33%, 87.50%, and 80.65%, which correspond to denominators 17, 16, 11, 8, 6, and 31. The paper also contradicts itself on corpus size: §5.1 states 1050 programs, Appendix B.1 states 900, and Table 4 implies 175 per model (125 construction + 50 test). Even a 50-program test set would restrict ASR to 2% increments, excluding 76.47 and 88.24. The abstract's 'up to 94%' therefore rests on numbers that cannot be regenerated from the stated split and metric definition. The authors must reconcile the protocol and the reported values or provide the raw per-program results.
[§3.2, Eq. (21), Appendix H] The attack is called black-box, but feature extraction uses AST parsing and regex over source code, not UI observation. Eq. (21) is described as a 'high-fidelity proxy for manual black-box inspection,' yet Appendix H gives only a single illustrative example with hand-picked scores; there is no validation that extracted features match what an attacker actually sees from the UI. Since ASR/ACR are computed with these features, the results may overstate the practical black-box attack. A calibration study (e.g., compare against manual UI-based reconnaissance on a sample) is needed.
[§4.1, Eq. (5)] A vulnerability is defined as a (feature, rule-ID) pair. This is an ad-hoc identity that makes recurrence metrics depend on the coarseness of the feature taxonomy and counts the same rule under different features as distinct vulnerabilities. Meanwhile, the FSTab query (Eq. 2) returns rule IDs and Eqs. (3)-(4) compare rule-ID sets; the mismatch between the (f,v)-based definitions and the rule-ID-based ASR/ACR is never resolved. The authors should either use rule IDs consistently or justify why feature-pair identity is the right unit for attack success.
[Appendix G and §3.2] Scanner labels are acknowledged to have 75% (CodeQL) and 63% (Semgrep) precision. Every FSTab entry, recurrence metric, and ASR/ACR value derives from these labels, but the paper does not quantify how label noise propagates to the reported accuracy. The statement that the metrics are 'conservative' is not substantiated; false positives and false negatives can inflate or deflate ASR/ACR asymmetrically depending on their correlation with features. A sensitivity analysis or explicit error propagation is required before these numbers can be taken at face value.

minor comments (5)

[§5.1 / App. B.1 / Table 4] The total corpus size is inconsistent: §5.1 says 1050 programs, Appendix B.1 says 900, and Table 4's column headers imply 125 construction + 50 test per model, which sums to 1050 but contradicts the stated 5 held-out prompts per domain. Please reconcile these numbers.
[Appendix E.2.2 / §5.1] Appendix E.2.2 says K=4 rephrasings are used, while §5.1 says k=5 semantic-preserving rephrasings. This discrepancy affects RVP and the construction set size and must be corrected.
[Table 3] The column headers 'FVR↑ RVP↑ DVR↑ CDT_d↑' do not identify the feature, prompt, or domain to which each column refers; the caption provides this information but the table alone is ambiguous. Please make the headers self-contained.
[Appendix E.3] Typo in the metric definition: 'respresnts' should be 'represents'. Also, the notation P is overloaded (a single program vs. the set of programs) in Eqs. (22)-(23); please disambiguate.
[§3.2, Eq. (3)] Eq. (3) evaluates success against V_actual obtained by running scanners on the backend source, which the attacker cannot do. The text should clarify that ground truth is used only for evaluation, not by the attacker, to avoid confusing the threat model.

Circularity Check

1 steps flagged

Vulnerability identity includes the observable frontend feature (Eq. 5), so the feature-matching part of ASR/ACR is guaranteed by construction; the held-out rule-prediction core is otherwise non-circular.

specific steps

self definitional [Section 4.1 (Vulnerability Definition, Eq. 5); attack evaluation Eqs. 2-4]
"A vulnerability is defined as an feature-security rulepair. ... Two vulnerabilities are considered identical if and only if they share the same feature and security rule: V_{p1,k1,d1,f1,v1}=V_{p2,k2,d2,f2,v2} ⇔ f1=f2 ∧ v1=v2. For a fixed program P_{p,k}, each (f,v) pair is counted at most once."

The attack input is the observable frontend feature f, and predictions are returned per feature (Eq. 2: Vpred = ∪ Tm[f]). Because Eq. 5 defines the ground-truth 'actual vulnerability' as the pair (f,v), the input feature is part of the label itself. Consequently, in SuccessP and CoverageP (Eqs. 3-4), the f-component of any predicted/actual match is satisfied by construction whenever the attacker observes that feature; the metric reduces to asking whether the rule for an already-observed feature co-occurred with it in training. The hidden rule component is still empirically tested on held-out programs, so the core generalization claim is not fully circular, but the reported ASR/ACR are partly inflated by this definitional overlap.

full rationale

No load-bearing self-citation or imported uniqueness theorem is present; the references are external (e.g., Pearce et al. 2022, WebGenBench, LM-CPPF). The FSTab attack is trained on same-model programs and evaluated on held-out same-model programs, which is a legitimate held-out protocol and not circular. The recurrence metrics (FVR/RVP/DVR/CDT) are computed from the same scanner labels and feature taxonomy as FSTab, but they aggregate different quantities and their high values are empirical rather than forced. Appendix G explicitly acknowledges scanner precision limits (~75% CodeQL, ~63% Semgrep), and Section 3.2 calls the automated extractor a 'high-fidelity proxy for manual black-box inspection'; these are validity/fidelity limitations, not circularity. The one definitional concern is Eq. 5, which makes the observable frontend feature part of the vulnerability identity, so the feature-matching component of the attack metrics is guaranteed by construction; this partially inflates ASR/ACR but does not eliminate the need for held-out rule prediction. The arithmetic inconsistencies in Table 1 cross-domain denominators (values incompatible with the stated 5-program held-out protocol) are a reproducibility/correctness issue outside the scope of the circularity pass. Overall score 3 reflects one partial self-definitional step while the central transfer claim retains independent empirical content.

Axiom & Free-Parameter Ledger

5 free parameters · 5 axioms · 0 invented entities

FSTab is an empirical lookup table; its contents are determined by the hand-set regularizers and feature-extraction weights above plus scanner labels. No new physical entities are introduced. The largest unvalidated assumptions are the scanner-as-ground-truth and source-code-as-UI proxy.

free parameters (5)

PMI Laplace smoothing alpha = 0.5
Eq. D.1.16; chosen as a conservative prior; affects every PMI score and therefore every FSTab mapping.
Top-k rule list size = 25
Algorithm 1; selected via training-split sensitivity; with median 3 candidate rules per feature, the cap mainly bounds long-tail cases.
Diversity penalty lambda = 0.8
Eq. D.1.17; chosen from the plateau in the training-split sensitivity table (Table 5); controls reuse of the same rule across features.
Feature-extraction weights and caps = w_fn=2.5, w_route=2.0, w_api=1.8, w_id=0.5, w_str=0.35, w_neg=0.5; caps tau_id=1.5, tau_str=1.0
Eq. 21; 'calibrated to reflect semantic reliability', i.e., hand-set; determines which of the 59 features is assigned to each code location.
Feature-assignment threshold = 0.0
Appendix H; a label is assigned whenever the argmax score exceeds this threshold, affecting feature coverage in the training corpus.

axioms (5)

domain assumption CodeQL and Semgrep rule hits define ground-truth vulnerabilities
Section 3.2; Appendix G reports manual precision ~75% for CodeQL and ~63% for Semgrep but no recall; scanner false positives and negatives propagate into FSTab and all metrics.
domain assumption Automated AST/regex feature extraction is a high-fidelity proxy for black-box UI observation
Section 3.2 calls S(f, C_l) a high-fidelity proxy; Appendix H gives only a single illustrative scoring example, with no systematic validation against manual UI reconnaissance.
domain assumption The 5/5 prompt split and held-out protocol isolates generalization
Section 5.1; only 10 prompts per domain. Table 1 cross-domain ASR values such as 76.47% and 93.75% are impossible with n=5 held-out programs, so the split/aggregation assumption is internally inconsistent.
ad hoc to paper Vulnerability identity is defined as a (feature, rule-ID) pair
Eq. 5; this definition ties all recurrence and transfer metrics to the paper's 59-feature taxonomy and can make the same rule under two feature labels count as different vulnerabilities.
domain assumption The attacker knows the source model identity
Section 3 requires the model name to select the correct FSTab; Appendix A admits this constraint and discusses fingerprinting as a possible way to obtain it.

reviewed 2026-08-03 · how reviews work

0 comments

Cite this review

Pith. "Pith review of Extracting Recurring Vulnerabilities from Black-Box LLM-Generated Software." pith.science (2026). https://pith.science/paper/S4ROCWX6

@misc{pith2026260204894,
  author       = {Pith},
  title        = {Pith review of: Extracting Recurring Vulnerabilities from Black-Box LLM-Generated Software},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/S4ROCWX6}},
  note         = {Machine review of arXiv:2602.04894}
}

Share X Bluesky LinkedIn Reddit HN

read the original abstract

LLMs are increasingly used for code generation, but their outputs often follow recurring templates that can induce predictable vulnerabilities. We study vulnerability persistence in LLM-generated software and introduce Feature--Security Table (FSTab) with two components. First, FSTab enables a black-box attack that predicts likely backend vulnerabilities from observable frontend features and knowledge of the source LLM, without access to the backend or source code. Second, FSTab provides a model-centric evaluation that quantifies how consistently a model reproduces the same vulnerabilities across programs, semantics-preserving rephrasings, and application domains. We evaluate FSTab on state-of-the-art code LLMs, including GPT-5.2, Claude-4.5 Opus, and Gemini-3 Pro, across diverse application domains. Our results show strong cross-domain transfer: even when the target domain is excluded from training, FSTab achieves up to 94% attack success and 93% vulnerability coverage on Internal Tools (Claude-4.5 Opus). These findings expose an underexplored attack surface in LLM-generated software and highlight the security risks of code generation. Our code is available at https://github.com/fstabicml2026/FSTab

Figures

Figures reproduced from arXiv: 2602.04894 by Amit Levi, Avi Mendelson, Maayan Yamin, Noam Benzimra, Tomer Kordonsky.

**Figure 1.** Figure 1: Architectural Vulnerability Fingerprints. Visual representation of models vulnerability recurrence across five functional domains. that approximately 30% of new Python functions in leading regions are now AI-generated(Daniotti et al., 2026). Their adoption is reinforced by standard benchmarks and broad empirical performance gains, enabling rapid prototyping and integration into developer workflows (Chen e… view at source ↗

**Figure 2.** Figure 2: Overview of the FSTab Framework. Machine learning security shows that probabilistic sampling in LLMs allows black-box query access to leak sensitive information, enabling model extraction (Tramer et al. ` , 2016; Jagielski et al., 2020), membership inference (Shokri et al., 2017), and training-data extraction (Carlini et al., 2021). More recently, fingerprinting methods show that models leave stable and id… view at source ↗

**Figure 3.** Figure 3: The Universality Gap. CDT consistently exceeds DVR, confirming vulnerabilities are inherent to the model. contexts (CDT > DV R). This phenomenon is universal across our benchmark, showing a mean positive gap of +18.3% (range: 7.2% to 29.4%). Grok demonstrates the strongest architectural bias (+29.4%), confirming that insecure coding templates are intrinsic to the model rather than specific to the prompt’s… view at source ↗

discussion (0)

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

Unsupervised Features Mining via Activation Geometry
cs.AI 2026-07 conditional novelty 6.0

Prefix-induced activation shifts (MAG) yield model-relative reasoning directions that predict verdicts, support matched-format steering, and select transfer datasets at 94.7% Top-1 accuracy.

Reference graph

Works this paper leans on

18 extracted references · 10 linked inside Pith · cited by 1 Pith paper

[1]

light salmon background,

4, the functional requirements (e.g., “light salmon background,” “dashboard preview”) remain invariant. • Base Prompt (k= 0 ):“Please implement a big data visualization platform for data analysis and display. The platform should have functionalities for data visualization, report editing, dashboard preview, resource tree management, text editing, and data...

arXiv
[2]

Cao, X., Jia, J., and Gong, N

URL https://arxiv.org/abs/2312.04724. Cao, X., Jia, J., and Gong, N. Z. IPGuard: Protecting intellectual property of deep neural networks via finger- printing the classification boundary. InProceedings of the 2021 ACM Asia Conference on Computer and Com- munications Security (AsiaCCS), pp. 14–25,

Pith/arXiv arXiv 2021
[5]

Generate a paraphrase of the following text using different words and sentence structures while still conveying the same meaning,

Sensitivity on the training split. Left: varying k with fixed λ= 0.8 . Right: varying λ with fixed k= 25 . Concentration is computed on the top-1 rule per feature (MaxUse1, Gini1). λ= 0.8k= 25 kMeanCov k ↑Avg|M[f]|λMeanCov 25 ↑MaxUse 1 ↓Gini 1 ↓ 5 0.866 3.145 0.0 0.988 10 0.559 10 0.960 4.000 0.2 0.987 8 0.567 20 0.986 4.362 0.4 0.987 8 0.555 25 0.987 4.4...

2023
[6]

Fried, D., Aghajanyan, A., Lin, J., Wang, S., Wallace, E., Shi, F., Zhong, R., Yih, W.-t., Zettlemoyer, L., and Lewis, M

URL https://arxiv.org/abs/2402.00689. Fried, D., Aghajanyan, A., Lin, J., Wang, S., Wallace, E., Shi, F., Zhong, R., Yih, W.-t., Zettlemoyer, L., and Lewis, M. InCoder: A generative model for code infilling and synthesis. InICLR (Workshop or Conference),

arXiv
[7]

URLhttps://arxiv.org/abs/2506.05692. Li, Y ., Choi, D., Chung, J., Kushman, N., Schrit- twieser, J., Leblond, R., Eccles, T., Keeling, J., Gi- meno, F., Dal Lago, A., Hubert, T., Choy, P., de Mas- son d’Autume, C., Babuschkin, I., Chen, X., Huang, P.-S., Welbl, J., Gowal, S., Cherepanov, A., Mol- loy, J., Mankowitz, D., Sutherland Robson, E., Kohli, P., d...

Pith/arXiv arXiv
[9]

Lu, Z., Yang, Y ., Ren, H., Hou, H., Xiao, H., Wang, K., Shi, W., Zhou, A., Zhan, M., and Li, H

URL https: //arxiv.org/abs/2510.14509. Lu, Z., Yang, Y ., Ren, H., Hou, H., Xiao, H., Wang, K., Shi, W., Zhou, A., Zhan, M., and Li, H. Webgen-bench: Evaluating llms on generating interactive and functional websites from scratch,

Pith/arXiv arXiv
[10]

org/abs/2505.03733

URL https://arxiv. org/abs/2505.03733. Nijkamp, E., Pang, B., Hayashi, H., Tu, L., Wang, H., Zhou, Y ., Savarese, S., and Xiong, C. Codegen: An open large language model for code with multi-turn program synthe- sis. InICLR (Conference Track),

Pith/arXiv arXiv
[11]

Accepted to the 2025 IEEE/ACM International Workshop on Large Lan- guage Models for Code (LLM4Code)

URL https: //arxiv.org/abs/2501.08200. Accepted to the 2025 IEEE/ACM International Workshop on Large Lan- guage Models for Code (LLM4Code). Rozi`ere, B., Gehring, J., Gloeckle, F., Sootla, S., Gat, I., Tan, X. E., Adi, Y ., Liu, J., Sauvestre, R., Remez, T., Rapin, J., Kozhevnikov, A., Evtimov, I., Bitton, J., Bhatt, M., Ferrer, C. C., Grattafiori, A., Xi...

Pith/arXiv arXiv 2025
[13]

Tony, C., Mutas, M., Ferreyra, N

doi: 10.1145/3549035.3561184. Tony, C., Mutas, M., Ferreyra, N. E. D., and Scandariato, R. LLMSecEval: A dataset of natural language prompts for security evaluations. InProceedings of the 20th In- ternational Conference on Mining Software Repositories (MSR), pp. 588–592,

arXiv
[14]

Wang, Y ., Wang, W., Joty, S., and Hoi, S

URL https:// arxiv.org/abs/2407.02395. Wang, Y ., Wang, W., Joty, S., and Hoi, S. C. CodeT5: Identifier-aware unified pre-trained encoder-decoder mod- els for code understanding and generation. InProceedings of the 2021 Conference on Empirical Methods in Natural Language Processing (EMNLP), pp. 8696–8708,

Pith/arXiv arXiv 2021
[15]

D., Koh, P

Xu, J., Wang, F., Ma, M. D., Koh, P. W., Xiao, C., and Chen, M. Instructional fingerprinting of large language mod- els. InProceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pp. 3277–3306,

2024
[16]

super-node

URL https://arxiv.org/abs/2505.18949. 11 Extracting Recurring Vulnerabilities from Black-Box LLM-Generated Software Appendix A. Limitations Model Identity Assumption.A constraint of the current FSTab framework is the requirement of prior knowledge regarding the source LLM’s identity to select the correct lookup table. While this study assumes model knowle...

Pith/arXiv arXiv
[2021]

Chen, M., Tworek, J., Jun, H., Yuan, Q., Pinto, H. P. d. O., Kaplan, J., Edwards, H., Burda, Y ., Joseph, N., Brockman, G., et al. Evaluating large language models trained on code.arXiv preprint arXiv:2107.03374,

Pith/arXiv arXiv
[2022]

URL https://www.science

doi: 10.1126/ science.abq1158. URL https://www.science. org/doi/10.1126/science.abq1158. Liu, J., Huang, C., Guan, Z., Lei, W., and Deng, Y . E2edev: Benchmarking large language models in end- to-end software development task,

doi:10.1126/science.abq1158
[2023]

doi: 10.18653/v1/2023.acl-short.59

Association for Computational Linguistics. doi: 10.18653/v1/2023.acl-short.59. URL https:// aclanthology.org/2023.acl-short.59/. Bhatt, M., Chennabasappa, S., Nikolaidis, C., Wan, S., Evtimov, I., Gabi, D., Song, D., Ahmad, F., Ascher- mann, C., Fontana, L., Frolov, S., Giri, R. P., Kapil, D., Kozyrakis, Y ., LeBlanc, D., Milazzo, J., Strau- mann, A., Syn...

doi:10.18653/v1/2023.acl-short.59 2023
[2024]

Shokri, R., Stronati, M., Song, C., and Shmatikov, V

URL https:// arxiv.org/abs/2308.12950. Shokri, R., Stronati, M., Song, C., and Shmatikov, V . Mem- bership inference attacks against machine learning mod- els. InIEEE Symposium on Security and Privacy (SP), pp. 3–18,

Pith/arXiv arXiv
[2025]

Elgedawy, R., Dosch, P., Sadik, J., Dutta, S., Gautam, A., Georgiou, K., Gholamrezae, F., Ji, F., Lim, K., Liu, Q., and Ruoti, S

URL https://arxiv.org/abs/ 2503.09433. Elgedawy, R., Dosch, P., Sadik, J., Dutta, S., Gautam, A., Georgiou, K., Gholamrezae, F., Ji, F., Lim, K., Liu, Q., and Ruoti, S. Ocassionally secure: A compara- tive analysis of code generation assistants,

Pith/arXiv arXiv
[2026]

URL https://www.science

doi: 10.1126/ science.adz9311. URL https://www.science. org/doi/abs/10.1126/science.adz9311. Dubniczky, R. A., Horv´at, K. Z., Bisztray, T., Ferrag, M. A., Cordeiro, L. C., and Tihanyi, N. CASTLE: Benchmarking dataset for static code analyzers and LLMs towards CWE detection,

doi:10.1126/science.adz9311

This paper was first reviewed by deepseek-v4-flash on August 3, 2026.

[1] [1]

light salmon background,

4, the functional requirements (e.g., “light salmon background,” “dashboard preview”) remain invariant. • Base Prompt (k= 0 ):“Please implement a big data visualization platform for data analysis and display. The platform should have functionalities for data visualization, report editing, dashboard preview, resource tree management, text editing, and data...

arXiv

[2] [2]

Cao, X., Jia, J., and Gong, N

URL https://arxiv.org/abs/2312.04724. Cao, X., Jia, J., and Gong, N. Z. IPGuard: Protecting intellectual property of deep neural networks via finger- printing the classification boundary. InProceedings of the 2021 ACM Asia Conference on Computer and Com- munications Security (AsiaCCS), pp. 14–25,

Pith/arXiv arXiv 2021

[3] [5]

Generate a paraphrase of the following text using different words and sentence structures while still conveying the same meaning,

Sensitivity on the training split. Left: varying k with fixed λ= 0.8 . Right: varying λ with fixed k= 25 . Concentration is computed on the top-1 rule per feature (MaxUse1, Gini1). λ= 0.8k= 25 kMeanCov k ↑Avg|M[f]|λMeanCov 25 ↑MaxUse 1 ↓Gini 1 ↓ 5 0.866 3.145 0.0 0.988 10 0.559 10 0.960 4.000 0.2 0.987 8 0.567 20 0.986 4.362 0.4 0.987 8 0.555 25 0.987 4.4...

2023

[4] [6]

Fried, D., Aghajanyan, A., Lin, J., Wang, S., Wallace, E., Shi, F., Zhong, R., Yih, W.-t., Zettlemoyer, L., and Lewis, M

URL https://arxiv.org/abs/2402.00689. Fried, D., Aghajanyan, A., Lin, J., Wang, S., Wallace, E., Shi, F., Zhong, R., Yih, W.-t., Zettlemoyer, L., and Lewis, M. InCoder: A generative model for code infilling and synthesis. InICLR (Workshop or Conference),

arXiv

[5] [7]

URLhttps://arxiv.org/abs/2506.05692. Li, Y ., Choi, D., Chung, J., Kushman, N., Schrit- twieser, J., Leblond, R., Eccles, T., Keeling, J., Gi- meno, F., Dal Lago, A., Hubert, T., Choy, P., de Mas- son d’Autume, C., Babuschkin, I., Chen, X., Huang, P.-S., Welbl, J., Gowal, S., Cherepanov, A., Mol- loy, J., Mankowitz, D., Sutherland Robson, E., Kohli, P., d...

Pith/arXiv arXiv

[6] [9]

Lu, Z., Yang, Y ., Ren, H., Hou, H., Xiao, H., Wang, K., Shi, W., Zhou, A., Zhan, M., and Li, H

URL https: //arxiv.org/abs/2510.14509. Lu, Z., Yang, Y ., Ren, H., Hou, H., Xiao, H., Wang, K., Shi, W., Zhou, A., Zhan, M., and Li, H. Webgen-bench: Evaluating llms on generating interactive and functional websites from scratch,

Pith/arXiv arXiv

[7] [10]

org/abs/2505.03733

URL https://arxiv. org/abs/2505.03733. Nijkamp, E., Pang, B., Hayashi, H., Tu, L., Wang, H., Zhou, Y ., Savarese, S., and Xiong, C. Codegen: An open large language model for code with multi-turn program synthe- sis. InICLR (Conference Track),

Pith/arXiv arXiv

[8] [11]

Accepted to the 2025 IEEE/ACM International Workshop on Large Lan- guage Models for Code (LLM4Code)

URL https: //arxiv.org/abs/2501.08200. Accepted to the 2025 IEEE/ACM International Workshop on Large Lan- guage Models for Code (LLM4Code). Rozi`ere, B., Gehring, J., Gloeckle, F., Sootla, S., Gat, I., Tan, X. E., Adi, Y ., Liu, J., Sauvestre, R., Remez, T., Rapin, J., Kozhevnikov, A., Evtimov, I., Bitton, J., Bhatt, M., Ferrer, C. C., Grattafiori, A., Xi...

Pith/arXiv arXiv 2025

[9] [13]

Tony, C., Mutas, M., Ferreyra, N

doi: 10.1145/3549035.3561184. Tony, C., Mutas, M., Ferreyra, N. E. D., and Scandariato, R. LLMSecEval: A dataset of natural language prompts for security evaluations. InProceedings of the 20th In- ternational Conference on Mining Software Repositories (MSR), pp. 588–592,

arXiv

[10] [14]

Wang, Y ., Wang, W., Joty, S., and Hoi, S

URL https:// arxiv.org/abs/2407.02395. Wang, Y ., Wang, W., Joty, S., and Hoi, S. C. CodeT5: Identifier-aware unified pre-trained encoder-decoder mod- els for code understanding and generation. InProceedings of the 2021 Conference on Empirical Methods in Natural Language Processing (EMNLP), pp. 8696–8708,

Pith/arXiv arXiv 2021

[11] [15]

D., Koh, P

Xu, J., Wang, F., Ma, M. D., Koh, P. W., Xiao, C., and Chen, M. Instructional fingerprinting of large language mod- els. InProceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pp. 3277–3306,

2024

[12] [16]

super-node

URL https://arxiv.org/abs/2505.18949. 11 Extracting Recurring Vulnerabilities from Black-Box LLM-Generated Software Appendix A. Limitations Model Identity Assumption.A constraint of the current FSTab framework is the requirement of prior knowledge regarding the source LLM’s identity to select the correct lookup table. While this study assumes model knowle...

Pith/arXiv arXiv

[13] [2021]

Chen, M., Tworek, J., Jun, H., Yuan, Q., Pinto, H. P. d. O., Kaplan, J., Edwards, H., Burda, Y ., Joseph, N., Brockman, G., et al. Evaluating large language models trained on code.arXiv preprint arXiv:2107.03374,

Pith/arXiv arXiv

[14] [2022]

URL https://www.science

doi: 10.1126/ science.abq1158. URL https://www.science. org/doi/10.1126/science.abq1158. Liu, J., Huang, C., Guan, Z., Lei, W., and Deng, Y . E2edev: Benchmarking large language models in end- to-end software development task,

doi:10.1126/science.abq1158

[15] [2023]

doi: 10.18653/v1/2023.acl-short.59

Association for Computational Linguistics. doi: 10.18653/v1/2023.acl-short.59. URL https:// aclanthology.org/2023.acl-short.59/. Bhatt, M., Chennabasappa, S., Nikolaidis, C., Wan, S., Evtimov, I., Gabi, D., Song, D., Ahmad, F., Ascher- mann, C., Fontana, L., Frolov, S., Giri, R. P., Kapil, D., Kozyrakis, Y ., LeBlanc, D., Milazzo, J., Strau- mann, A., Syn...

doi:10.18653/v1/2023.acl-short.59 2023

[16] [2024]

Shokri, R., Stronati, M., Song, C., and Shmatikov, V

URL https:// arxiv.org/abs/2308.12950. Shokri, R., Stronati, M., Song, C., and Shmatikov, V . Mem- bership inference attacks against machine learning mod- els. InIEEE Symposium on Security and Privacy (SP), pp. 3–18,

Pith/arXiv arXiv

[17] [2025]

Elgedawy, R., Dosch, P., Sadik, J., Dutta, S., Gautam, A., Georgiou, K., Gholamrezae, F., Ji, F., Lim, K., Liu, Q., and Ruoti, S

URL https://arxiv.org/abs/ 2503.09433. Elgedawy, R., Dosch, P., Sadik, J., Dutta, S., Gautam, A., Georgiou, K., Gholamrezae, F., Ji, F., Lim, K., Liu, Q., and Ruoti, S. Ocassionally secure: A compara- tive analysis of code generation assistants,

Pith/arXiv arXiv

[18] [2026]

URL https://www.science

doi: 10.1126/ science.adz9311. URL https://www.science. org/doi/abs/10.1126/science.adz9311. Dubniczky, R. A., Horv´at, K. Z., Bisztray, T., Ferrag, M. A., Cordeiro, L. C., and Tihanyi, N. CASTLE: Benchmarking dataset for static code analyzers and LLMs towards CWE detection,

doi:10.1126/science.adz9311

Extracting Recurring Vulnerabilities from Black-Box LLM-Generated Software

The reading

Core claim §

What carries the argument

Load-bearing premise §

What would settle it §

If this is right

Where Pith is reading between the lines

discussion (0)

Core claim

Load-bearing premise

What would settle it