Which Neurons Detect Malicious Code? A Probing Study of LLM Security Knowledge

Anh M. T. Bui; Lam D. Dao; Phuong T. Nguyen; Vang T. Nguyen

REVIEW 2 major objections 4 minor 16 references

Malware detection in code LLMs is concentrated in a small set of feed-forward neurons whose amplification or suppression can raise or collapse accuracy.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-14 13:24 UTC pith:AT7YZUKP

load-bearing objection Solid NIER-style causal localization of malware-detection FFN neurons on real PyPI data; effects are real but model-dependent and the proxy task leaves open whether they track security semantics or surface cues. the 2 major comments →

arxiv 2607.10221 v1 pith:AT7YZUKP submitted 2026-07-11 cs.SE cs.CR

Which Neurons Detect Malicious Code? A Probing Study of LLM Security Knowledge

Lam D. Dao , Vang T. Nguyen , Anh M. T. Bui , Phuong T. Nguyen This is my paper

classification cs.SE cs.CR

keywords malicious codeprobing methodsLLMsmechanistic interpretabilityneuron attributionfeed-forward neuronscausal interventionPyPI malware

verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper asks where inside a language model the ability to tell malicious code from benign code actually lives. Using two attribution methods on the feed-forward layers of three instruction-tuned models, and a balanced set of real PyPI packages, the authors locate small groups of neurons that either facilitate or inhibit malware detection. Causal interventions then show that turning the facilitating neurons up and the inhibiting ones down can raise accuracy, while the reverse drives the model toward chance or a single class. The effect is model-dependent and the responsible neurons cluster in different layer bands for different models, yet the layer-level pattern is more stable than the individual neurons themselves. The practical claim is that once those neurons are known, one can edit, suppress, or early-exit on them, opening a path to lighter and more targeted safety controls for code models.

Core claim

Both integrated gradients and neuron conductance identify feed-forward neurons that causally encode malware-detection behavior. Amplifying the facilitating set while suppressing the inhibiting set can raise accuracy; the reverse collapses predictions toward a single class. The size of the effect and the layers that matter differ sharply across Llama-3.1-8B, Mistral-7B and Qwen-2.5-7B, yet each model concentrates its signal in a characteristic layer band that remains stable even when the exact neurons change.

What carries the argument

Aggregated conductance score (ACE) derived from per-example integrated gradients or neuron conductance on a contrastive A/B malware-detection target, followed by causal scaling of the top-K facilitating and inhibiting neurons under five intervention conditions.

Load-bearing premise

The proxy multiple-choice prompts built from heuristically extracted package snippets are assumed to be a faithful stand-in for the model’s real malware-detection behavior.

What would settle it

Repeat the same attribution-and-intervention pipeline on a held-out set of malware that uses different attack vectors or languages; if amplifying the previously identified neurons no longer moves accuracy, the claimed causal encoding does not generalize.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Desk Editor's Note

Solid NIER-style causal localization of malware-detection FFN neurons on real PyPI data; effects are real but model-dependent and the proxy task leaves open whether they track security semantics or surface cues.

read the letter

This is a clean, reproducible NIER paper that takes standard mechanistic-interpretability tools (per-layer IG and neuron conductance) and applies them to a security-relevant code task with real PyPI packages. What is new is the empirical map: middle-layer concentration for Llama and Mistral, late-layer for Qwen, plus the five-condition intervention table showing that scaling the identified “good” and “bad” neurons can raise Mistral from 66 % to 94 % or collapse Llama to chance. They ship code and data, use a held-out balanced set of 2 890 samples, report Wilson CIs and McNemar tests, and keep the same target function F for attribution and evaluation. That is more careful than most early interpretability-for-SE work.

The soft spots are real but proportionate. Individual neuron Jaccard is low (<0.20), so the claim lives at the layer-band level, which they themselves document. The bigger open question is the proxy: heuristically extracted setup.py / long __init__.py snippets, length-matched, truncated at 2 k chars, forced into label-swapped A/B prompts. Nothing in the paper shows the selected neurons are responding to malicious semantics rather than residual format or length cues. The stress-test concern is therefore fair; the numerical interventions still stand, but the “security knowledge” gloss is stronger than the evidence. Hyper-parameters (K=100, m=16, |D_attrib|=20) are fixed; sensitivity is left for later. Scope is three 7–8 B models and one ecosystem—exactly what a NIER should be.

Math and citation pattern look solid; they correctly credit Li et al. and Dhamdhere et al. and do not over-claim generality. This is useful for anyone working on code-LLM safety, early-exit checks, or neuron editing. I would bring it to reading group, cite the layer-band and intervention numbers if I am writing on the same topic, and send it to referees. It deserves a serious look and the usual “expand validation / probe the proxy” revision cycle.

Referee Report

2 major / 4 minor

Summary. The paper applies mechanistic interpretability (per-layer Integrated Gradients and Neuron Conductance) to three instruction-tuned 7–8B LLMs to locate FFN neurons that support or inhibit malware-versus-benign classification on length-matched PyPI packages. Attribution is performed on a proxy multiple-choice A/B task with label swapping; the top-K facilitating and inhibiting neurons are then subjected to five causal scaling interventions (Baseline, Suppress Good, Suppress Bad, Enhancer, Degrader) on a held-out set of 2,890 samples. Results show model-dependent accuracy and per-class F1 shifts (largest for Mistral under IG Enhancer; collapse to chance for Llama under Degrader), with malware-detection signal concentrated in middle layers for Llama/Mistral and late layers for Qwen. Layer-level selection is stable across seeds while individual-neuron Jaccard is low. The authors position the work as a NIER-style feasibility study toward neuron-level editing and security-aware alignment.

Significance. If the identified neurons truly encode security-relevant knowledge rather than proxy artifacts, the work supplies a concrete, model-agnostic route to early-exit safety checks, targeted unlearning, and layer-specific hardening for code LLMs—directions that current black-box prompt or fine-tuning defenses do not address. Strengths include a clean five-condition intervention design, McNemar tests with continuity correction, Wilson CIs, an explicit effectiveness-gap metric, a balanced held-out evaluation set, and a public replication package. The model-dependent layer localization and the co-localization of good/bad neurons are interesting empirical observations even if the security interpretation remains provisional.

major comments (2)

[§2.1–3.2, Table 2, RQ1] §2.1–3.2 and the RQ1 claim (Table 2): Attribution optimizes F = Z_correct − Z_incorrect on heuristically extracted “pure harmful payload” snippets (setup.py / long __init__.py), truncated at 2 000 characters, embedded in label-swapped A/B prompts with log-sum-exp pooling over {" A"," B"}. Interventions then scale the same neurons. Nothing in the manuscript demonstrates that the selected neurons respond to malicious semantics rather than residual surface correlates (install-time boilerplate, length-bucket artifacts remaining after matching, or the multiple-choice format itself). Because good and bad neurons co-localize in the same layer bands (Fig. 3) and individual-neuron Jaccard is <0.20 (Fig. 4), the observed accuracy shifts could be generic decision-boundary effects. A control that re-attributes on length-matched or format-matched non-security tasks, or that measures neuron response t
[§2.3, §4.2, Figs. 4–5] §2.3 and §4.2: Ambiguous neurons (those appearing in both G_j and B_j) are discarded before ACE aggregation, and the final top-100 sets are unstable across random attribution subsets (median Jaccard <0.20). The paper correctly notes that layer-level histograms are more stable, yet the causal interventions are performed on the unstable individual-neuron sets. It remains unclear whether the Enhancer/Degrader effects would survive if the intervention set were defined solely by the stable layer bands rather than by the particular neurons chosen on a given seed. Reporting intervention results under a layer-band ablation (or under the intersection of the five stability runs) would strengthen the causal claim.

minor comments (4)

[Table 1, §2.1] Table 1 and §2.1: The length-matching heuristic is described only at a high level; the exact sampling procedure and any residual length or token-count statistics after truncation should be reported so that surface-cue confounds can be quantified.
[§3.2] §3.2: Attribution sample size |D_attrib| is swept but only the default of 20 is used for primary results; a short sensitivity table for K and m would help readers judge robustness of the ACE ranking.
[Fig. 2] Fig. 2 caption and surrounding text: ΔF1 values are described as “relative to baseline,” yet the y-axis scale and exact baseline F1 numbers are not restated in the figure or caption, making the magnitude of the bars harder to interpret.
Throughout: minor inconsistencies in model naming (Mistral-v0.3 vs Mistralv0.3, Llama3.1-8B-Instruct vs Llama3.1-8-B-Instruct) and occasional missing spaces after periods should be cleaned for camera-ready.

Circularity Check

0 steps flagged

No circularity: neuron attribution ranks FFN units via IG/NC on a held-out attribution split, then independent causal scaling interventions are evaluated on a disjoint test set; nothing forces intervention accuracy to equal the ranking by construction.

full rationale

The paper's load-bearing chain is (1) define target F = Z_correct - Z_incorrect on proxy A/B prompts, (2) attribute via per-layer IG or Neuron Conductance on ~110 samples to obtain ACE scores, (3) select top-K facilitating/inhibiting neurons after ambiguous filtering, (4) apply five multiplicative intervention conditions (Baseline, Suppress-Good, Suppress-Bad, Enhancer, Degrader) and measure accuracy/F1/McNemar on a disjoint 2 890-sample test set. Attribution and evaluation use separate data partitions; no free parameters are fitted to test-set accuracy and then re-reported as predictions. The effectiveness gap Δ is simply the observed difference Accuracy_Enhancer - Accuracy_Degrader, not an identity. Method citations (Li et al. for IG-style good/bad neurons, Dhamdhere et al. for conductance) are external and non-overlapping in authorship; they supply the attribution technique, not a uniqueness theorem that forces the malware-detection claim. Layer co-localization and low Jaccard stability are empirical observations, not definitional reductions. Proxy-task faithfulness is a validity concern outside the circularity criteria. The derivation is therefore self-contained against its own inputs.

Axiom & Free-Parameter Ledger

5 free parameters · 4 axioms · 2 invented entities

The work is empirical and method-driven. It inherits standard attribution axioms and domain assumptions about the dataset and proxy task; it introduces no new physical entities. The free parameters are the usual hyper-parameters of the attribution and selection pipeline; none are fitted to the final test accuracy.

free parameters (5)

K (top neurons kept) = 100
Fixed at 100 for both good and bad sets; controls the size of the intervention set and therefore the magnitude of accuracy shifts.
m (IG/conductance integration steps) = 16
Fixed at 16 right-Riemann steps; trades off attribution fidelity against compute.
|D_attrib| (attribution sample count) = 20 (default)
Default 20, swept over {10,20,50,100,200}; determines which neurons enter the ACE ranking.
truncation length = 2000 characters
Source code truncated at 2,000 characters; longer samples receive a fixed suffix. Affects what the model actually sees.
intervention scales (sG, sB) = 0 / 1 / 2
Multiplicative factors {0,1,2} chosen by hand for the five conditions; not learned from data.

axioms (4)

domain assumption Integrated gradients and neuron conductance correctly attribute the scalar F = Z_correct − Z_incorrect to individual FFN neurons.
Inherited from Sundararajan et al. and Dhamdhere et al.; used throughout Stage 2 without re-derivation.
domain assumption Heuristically extracted setup.py / __init__.py snippets are pure harmful (or pure benign) payloads representative of the package’s maliciousness.
Section 2.1; the entire contrastive dataset rests on this extraction rule.
ad hoc to paper Label-swapped A/B multiple-choice prompts with log-sum-exp pooling over option tokens are an unbiased proxy for the model’s malware-detection decision.
Section 2.1 and 3.2; introduced to mitigate first-token bias but not validated against free-form generation or human labels.
ad hoc to paper Ambiguous neurons (those appearing in both G_j and B_j across samples) can be safely discarded without losing the causal signal.
Section 2.3 filtering step; the ACE score is defined only after this mask.

invented entities (2)

ACE (Aggregated Conductance/Example) score no independent evidence
purpose: Scalar ranking of neurons after ambiguous-neuron masking, used to select the final GT and BT sets of size K.
Defined in Section 2.3 as a paper-specific aggregation; no independent external validation beyond the subsequent interventions.
Effectiveness gap Δ = Acc_Enhancer − Acc_Degrader no independent evidence
purpose: Single scalar summarizing causal utility of the identified neuron sets.
Defined in Section 3.1; purely a reporting convenience, not a new physical quantity.

pith-pipeline@v1.1.0-grok45 · 16556 in / 3380 out tokens · 29236 ms · 2026-07-14T13:24:18.335336+00:00 · methodology

0 comments

read the original abstract

Background. Large language models (LLMs) have become increasingly capable of understanding and generating source code, leading to their widespread adoption in software engineering tasks such as code completion, repair, and vulnerability detection. However, despite their strong empirical performance, the internal mechanisms through which LLMs recognize malicious or vulnerable code patterns remain poorly understood. Aim. We investigated where the malware detection behavior is encoded inside LLMs Feed Forward Network (FFN) neurons and verified the attribution with causal interventions on the neurons identified. This aims to identify the most important neurons in detecting malicious code. Methods. We applied mechanistic interpretability methods to locate the neurons being responsible for malware-detection behavior in three instruction-tuned LLMs: Llama3.1-8B-Instruct, Mistral-v0.3-7B-Instruct, and Qwen2.5-7B-Instruct. Using 1,500 malicious and 1,500 benign PyPI packages from the PyPI Malregistry, we attribute the behavior to a set of neurons. Results. The experimental results reveal that amplifying facilitating neurons for malware detection while suppressing inhibiting ones can boost accuracy, while the reverse collapses predictions toward a single class, although the magnitude and consistency is heavily model-dependent. We demonstrated that the guardrail detection mechanism varies across models, each represents its malware detection behavior differently within its FFN layers. Conclusions. Probing the neurons associated with security-relevant knowledge helps us gain insights into how LLMs encode malicious programming concepts, identify potentially harmful memorized behaviors, paving the way toward more reliable defense mechanisms, such as neuron-level editing, selective unlearning, and security-aware alignment for code-focused LLMs.

discussion (0)

Reference graph

Works this paper leans on

16 extracted references · 2 canonical work pages

[1]

2 AhmetEmirBosnak, SahandMoslemi, MayasahLami, andAnilKoyuncu

Accessed: 2026-05-27. 2 AhmetEmirBosnak, SahandMoslemi, MayasahLami, andAnilKoyuncu. Explicitvulnerability generation with llms: An investigation beyond adversarial attacks. InIEEE International Conference on Software Maintenance and Evolution, ICSME 2025, Auckland, New Zealand, September 7-12, 2025, pages 821–826. IEEE, 2025.doi:10.1109/ICSME64153.2025.0...

doi:10.1109/icsme64153.2025.00086 2026
[3]

5 Kedar Dhamdhere, Mukund Sundararajan, and Qiqi Yan

URL:https://arxiv.org/abs/2107.03374,arXiv:2107.03374. 5 Kedar Dhamdhere, Mukund Sundararajan, and Qiqi Yan. How important is a neuron?CoRR, abs/1805.12233,

Pith/arXiv arXiv
[4]

6 Dario Di Palma, Alessandro De Bellis, Giovanni Servedio, Vito Walter Anelli, Fedelucio Narducci, and Tommaso Di Noia

URL:http://arxiv.org/abs/1805.12233,arXiv:1805.12233. 6 Dario Di Palma, Alessandro De Bellis, Giovanni Servedio, Vito Walter Anelli, Fedelucio Narducci, and Tommaso Di Noia. LLaMAs have feelings too: Unveiling sentiment and emotion representations in LLaMA models through probing. In Wanxiang Che, Joyce Nabende, ESEM 2026 23:12 WhichNeuronsDetectMaliciousC...

Pith/arXiv arXiv 2026
[5]

correction for continuity

Association for Computational Linguistics. URL: https://aclanthology.org/2025.acl-long.306/,doi:10.18653/v1/2025.acl-long.306. 7 Allen L. Edwards. Note on the “correction for continuity” in testing the significance of the difference between correlated proportions.Psychometrika, 13(3):185–187,

doi:10.18653/v1/2025.acl-long.306 2025
[6]

8 Wenbo Guo, Zhengzi Xu, Chengwei Liu, Cheng Huang, Yong Fang, and Yang Liu

doi: 10.1007/BF02289261. 8 Wenbo Guo, Zhengzi Xu, Chengwei Liu, Cheng Huang, Yong Fang, and Yang Liu. An empirical study of malicious code in pypi ecosystem. In2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE), pages 166–177. IEEE,

work page doi:10.1007/bf02289261
[7]

10 Quinn McNemar

URL:https://arxiv.org/abs/2601.04548, arXiv:2601.04548. 10 Quinn McNemar. Note on the sampling error of the difference between correlated proportions or percentages.Psychometrika, 12(2):153–157, 1947.doi:10.1007/BF02295996. 11 Milad Nasr, Nicholas Carlini, et al. Scalable extraction of training data from (production) language models.CoRR, abs/2311.17035,

doi:10.1007/bf02295996 1947
[8]

2311.17035,arXiv:2311.17035,doi:10.48550/ARXIV.2311.17035

URL: https://doi.org/10.48550/arXiv. 2311.17035,arXiv:2311.17035,doi:10.48550/ARXIV.2311.17035. 12 Robert G Newcombe. Two-sided confidence intervals for the single proportion: comparison of seven methods.Statistics in medicine, 17(8):857–872,

Pith/arXiv arXiv doi:10.48550/arxiv
[9]

Application of large language models to software engineering tasks: Opportunities, risks, and implications.IEEE Softw., 40(3):4–8, May 2023.doi:10.1109/MS.2023.3248401

13 Ipek Ozkaya. Application of large language models to software engineering tasks: Opportunities, risks, and implications.IEEE Softw., 40(3):4–8, May 2023.doi:10.1109/MS.2023.3248401. 14 Hammond Pearce, Baleegh Ahmad, Benjamin Tan, Brendan Dolan-Gavitt, and Ramesh Karri. Asleep at the keyboard? assessing the security of github copilot’s code contribution...

doi:10.1109/ms.2023.3248401 2023
[10]

225,doi:10.18653/V1/2022.EMNLP-MAIN.225

URL: https://doi.org/10.18653/v1/2022.emnlp-main. 225,doi:10.18653/V1/2022.EMNLP-MAIN.225. 16 Pouya Pezeshkpour and Estevam Hruschka. Large language models sensitivity to the or- der of options in multiple-choice questions. In Kevin Duh, Helena Gomez, and Steven Bethard, editors,Findings of the Association for Computational Linguistics: NAACL 2024, pages ...

doi:10.18653/v1/2022.emnlp-main 2022
[11]

URL: https://aclanthology.org/2024.findings-naacl.130/, doi:10.18653/v1/2024

Association for Computational Linguist- ics. URL: https://aclanthology.org/2024.findings-naacl.130/, doi:10.18653/v1/2024. findings-naacl.130. 17 Marina Sokolova and Guy Lapalme. A systematic analysis of performance measures for classification tasks.Information processing & management, 45(4):427–437,

doi:10.18653/v1/2024 2024
[12]

19 Mukund Sundararajan, Ankur Taly, and Qiqi Yan

URL:https://www.sciencedirect.com/science/article/pii/ S016412122500398X,doi:10.1016/j.jss.2025.112729. 19 Mukund Sundararajan, Ankur Taly, and Qiqi Yan. Axiomatic attribution for deep networks. In Proceedings of the 34th International Conference on Machine Learning - Volume 70, ICML’17, page 3319–3328. JMLR.org,

work page doi:10.1016/j.jss.2025.112729 2025
[13]

Universal adversarial triggers for attacking and analyzing NLP

20 Eric Wallace, Shi Feng, Nikhil Kandpal, Matt Gardner, and Sameer Singh. Universal adversarial triggers for attacking and analyzing NLP. In Kentaro Inui, Jing Jiang, Vincent Ng, and Xiaojun Wan, editors,Proceedings of the 2019 Conference on Empirical Methods in Natural Lan- guage Processing and the 9th International Joint Conference on Natural Language ...

2019
[14]

21 Edwin B Wilson

URL:https://doi.org/10.18653/v1/D19-1221, doi:10.18653/V1/D19-1221. 21 Edwin B Wilson. Probable inference, the law of succession, and statistical inference.Journal of the American Statistical Association, 22(158):209–212,

doi:10.18653/v1/d19-1221
[15]

doi:10.1145/3510003.3510146

Association for Computing Machinery. doi:10.1145/3510003.3510146. 23 Zhou Yang, Bowen Xu, Jie M. Zhang, Hong Jin Kang, Jieke Shi, Junda He, and David Lo. Stealthy backdoor attack for code models.IEEE Transactions on Software Engineering, 50(4):721–741, 2024.doi:10.1109/TSE.2024.3361661. 24 Chujie Zheng, Hao Zhou, Fandong Meng, Jie Zhou, and Minlie Huang. ...

doi:10.1145/3510003.3510146 2024
[16]

25 Andy Zou, Zifan Wang, J

URL:https://openreview.net/forum?id=shr9PXz7T0. 25 Andy Zou, Zifan Wang, J. Zico Kolter, and Matt Fredrikson. Universal and transferable ad- versarial attacks on aligned language models.CoRR, abs/2307.15043,

Pith/arXiv arXiv
[17]

org/10.48550/arXiv.2307.15043,arXiv:2307.15043,doi:10.48550/ARXIV.2307.15043

URL:https://doi. org/10.48550/arXiv.2307.15043,arXiv:2307.15043,doi:10.48550/ARXIV.2307.15043. ESEM 2026

Pith/arXiv arXiv doi:10.48550/arxiv.2307.15043 2026

[1] [1]

2 AhmetEmirBosnak, SahandMoslemi, MayasahLami, andAnilKoyuncu

Accessed: 2026-05-27. 2 AhmetEmirBosnak, SahandMoslemi, MayasahLami, andAnilKoyuncu. Explicitvulnerability generation with llms: An investigation beyond adversarial attacks. InIEEE International Conference on Software Maintenance and Evolution, ICSME 2025, Auckland, New Zealand, September 7-12, 2025, pages 821–826. IEEE, 2025.doi:10.1109/ICSME64153.2025.0...

doi:10.1109/icsme64153.2025.00086 2026

[2] [3]

5 Kedar Dhamdhere, Mukund Sundararajan, and Qiqi Yan

URL:https://arxiv.org/abs/2107.03374,arXiv:2107.03374. 5 Kedar Dhamdhere, Mukund Sundararajan, and Qiqi Yan. How important is a neuron?CoRR, abs/1805.12233,

Pith/arXiv arXiv

[3] [4]

6 Dario Di Palma, Alessandro De Bellis, Giovanni Servedio, Vito Walter Anelli, Fedelucio Narducci, and Tommaso Di Noia

URL:http://arxiv.org/abs/1805.12233,arXiv:1805.12233. 6 Dario Di Palma, Alessandro De Bellis, Giovanni Servedio, Vito Walter Anelli, Fedelucio Narducci, and Tommaso Di Noia. LLaMAs have feelings too: Unveiling sentiment and emotion representations in LLaMA models through probing. In Wanxiang Che, Joyce Nabende, ESEM 2026 23:12 WhichNeuronsDetectMaliciousC...

Pith/arXiv arXiv 2026

[4] [5]

correction for continuity

Association for Computational Linguistics. URL: https://aclanthology.org/2025.acl-long.306/,doi:10.18653/v1/2025.acl-long.306. 7 Allen L. Edwards. Note on the “correction for continuity” in testing the significance of the difference between correlated proportions.Psychometrika, 13(3):185–187,

doi:10.18653/v1/2025.acl-long.306 2025

[5] [6]

8 Wenbo Guo, Zhengzi Xu, Chengwei Liu, Cheng Huang, Yong Fang, and Yang Liu

doi: 10.1007/BF02289261. 8 Wenbo Guo, Zhengzi Xu, Chengwei Liu, Cheng Huang, Yong Fang, and Yang Liu. An empirical study of malicious code in pypi ecosystem. In2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE), pages 166–177. IEEE,

work page doi:10.1007/bf02289261

[6] [7]

10 Quinn McNemar

URL:https://arxiv.org/abs/2601.04548, arXiv:2601.04548. 10 Quinn McNemar. Note on the sampling error of the difference between correlated proportions or percentages.Psychometrika, 12(2):153–157, 1947.doi:10.1007/BF02295996. 11 Milad Nasr, Nicholas Carlini, et al. Scalable extraction of training data from (production) language models.CoRR, abs/2311.17035,

doi:10.1007/bf02295996 1947

[7] [8]

2311.17035,arXiv:2311.17035,doi:10.48550/ARXIV.2311.17035

URL: https://doi.org/10.48550/arXiv. 2311.17035,arXiv:2311.17035,doi:10.48550/ARXIV.2311.17035. 12 Robert G Newcombe. Two-sided confidence intervals for the single proportion: comparison of seven methods.Statistics in medicine, 17(8):857–872,

Pith/arXiv arXiv doi:10.48550/arxiv

[8] [9]

Application of large language models to software engineering tasks: Opportunities, risks, and implications.IEEE Softw., 40(3):4–8, May 2023.doi:10.1109/MS.2023.3248401

13 Ipek Ozkaya. Application of large language models to software engineering tasks: Opportunities, risks, and implications.IEEE Softw., 40(3):4–8, May 2023.doi:10.1109/MS.2023.3248401. 14 Hammond Pearce, Baleegh Ahmad, Benjamin Tan, Brendan Dolan-Gavitt, and Ramesh Karri. Asleep at the keyboard? assessing the security of github copilot’s code contribution...

doi:10.1109/ms.2023.3248401 2023

[9] [10]

225,doi:10.18653/V1/2022.EMNLP-MAIN.225

URL: https://doi.org/10.18653/v1/2022.emnlp-main. 225,doi:10.18653/V1/2022.EMNLP-MAIN.225. 16 Pouya Pezeshkpour and Estevam Hruschka. Large language models sensitivity to the or- der of options in multiple-choice questions. In Kevin Duh, Helena Gomez, and Steven Bethard, editors,Findings of the Association for Computational Linguistics: NAACL 2024, pages ...

doi:10.18653/v1/2022.emnlp-main 2022

[10] [11]

URL: https://aclanthology.org/2024.findings-naacl.130/, doi:10.18653/v1/2024

Association for Computational Linguist- ics. URL: https://aclanthology.org/2024.findings-naacl.130/, doi:10.18653/v1/2024. findings-naacl.130. 17 Marina Sokolova and Guy Lapalme. A systematic analysis of performance measures for classification tasks.Information processing & management, 45(4):427–437,

doi:10.18653/v1/2024 2024

[11] [12]

19 Mukund Sundararajan, Ankur Taly, and Qiqi Yan

URL:https://www.sciencedirect.com/science/article/pii/ S016412122500398X,doi:10.1016/j.jss.2025.112729. 19 Mukund Sundararajan, Ankur Taly, and Qiqi Yan. Axiomatic attribution for deep networks. In Proceedings of the 34th International Conference on Machine Learning - Volume 70, ICML’17, page 3319–3328. JMLR.org,

work page doi:10.1016/j.jss.2025.112729 2025

[12] [13]

Universal adversarial triggers for attacking and analyzing NLP

20 Eric Wallace, Shi Feng, Nikhil Kandpal, Matt Gardner, and Sameer Singh. Universal adversarial triggers for attacking and analyzing NLP. In Kentaro Inui, Jing Jiang, Vincent Ng, and Xiaojun Wan, editors,Proceedings of the 2019 Conference on Empirical Methods in Natural Lan- guage Processing and the 9th International Joint Conference on Natural Language ...

2019

[13] [14]

21 Edwin B Wilson

URL:https://doi.org/10.18653/v1/D19-1221, doi:10.18653/V1/D19-1221. 21 Edwin B Wilson. Probable inference, the law of succession, and statistical inference.Journal of the American Statistical Association, 22(158):209–212,

doi:10.18653/v1/d19-1221

[14] [15]

doi:10.1145/3510003.3510146

Association for Computing Machinery. doi:10.1145/3510003.3510146. 23 Zhou Yang, Bowen Xu, Jie M. Zhang, Hong Jin Kang, Jieke Shi, Junda He, and David Lo. Stealthy backdoor attack for code models.IEEE Transactions on Software Engineering, 50(4):721–741, 2024.doi:10.1109/TSE.2024.3361661. 24 Chujie Zheng, Hao Zhou, Fandong Meng, Jie Zhou, and Minlie Huang. ...

doi:10.1145/3510003.3510146 2024

[15] [16]

25 Andy Zou, Zifan Wang, J

URL:https://openreview.net/forum?id=shr9PXz7T0. 25 Andy Zou, Zifan Wang, J. Zico Kolter, and Matt Fredrikson. Universal and transferable ad- versarial attacks on aligned language models.CoRR, abs/2307.15043,

Pith/arXiv arXiv

[16] [17]

org/10.48550/arXiv.2307.15043,arXiv:2307.15043,doi:10.48550/ARXIV.2307.15043

URL:https://doi. org/10.48550/arXiv.2307.15043,arXiv:2307.15043,doi:10.48550/ARXIV.2307.15043. ESEM 2026

Pith/arXiv arXiv doi:10.48550/arxiv.2307.15043 2026