Search papers, labs, and topics across Lattice.
This paper addresses the limitations of automated code reviewers in detecting vulnerabilities in pull requests (PRs) by introducing MalPR-Bench, a benchmark that highlights the Verdict-Diagnosis (VD) gap, where a block may not accurately reflect the presence of a vulnerability. The authors present PRGuard, an attributable security reviewer that improves vulnerability identification by validating findings against repository evidence using deterministic tools. The results show that PRGuard outperforms existing tools like CodeRabbit in identifying target vulnerabilities, revealing a significant discrepancy in effectiveness and uncovering previously undisclosed vulnerabilities.
Verdict-only evaluations can misrepresent the effectiveness of automated code reviews, with PRGuard revealing a 1.38x improvement in identifying actual vulnerabilities compared to existing methods.
Automated code reviewers are increasingly used as gates on pull requests (PRs), yet evaluations measure whether they block a malicious change. A block may be triggered by an unrelated issue rather than the vulnerability that makes the PR unsafe; fixing the reported issue can leave the target defect exploitable. We call this discrepancy the Verdict-Diagnosis (VD) gap. We present MalPR-Bench, a mechanism-grounded benchmark of 89 malicious PRs and 50 paired benign controls across 44 repositories and eight language families. Each malicious case has a pre-committed rubric specifying the target vulnerability, accepted mechanism descriptions, required repository evidence, and off-target findings receiving no credit. Reviews are scored separately for verdict correctness, target-vulnerability identification, and evidence validation; an attributable block requires all three. We introduce PRGuard, an attributable PR security reviewer that constructs candidate vulnerabilities and validates their premises against repository evidence using deterministic, non-executing tools and bounded retrieval. Across 31 common-coverage held-out malicious PRs, PRGuard and CodeRabbit produce similar blocking totals (22/31 vs. 24/31), but PRGuard identifies 22 target vulnerabilities versus 16 for CodeRabbit, a 1.38x difference. On 14 absence-type cases, both block 9, while PRGuard identifies 9 targets versus 3. CodeRabbit identifies 16/24 targets when required evidence lies within touched files and 0/7 when validation requires evidence outside them. Finally, PRGuard uncovers twelve previously undisclosed, proof-of-concept-backed vulnerabilities across five projects. PRGuard/DeepSeek and CodeRabbit both block 10/12 discovery PRs, but produce 10/12 and 4/12 attributable blocks, respectively. Thus, verdict-only evaluation can substantially overstate the security value of automated review.
