{"id":"https://openalex.org/W7166735787","doi":"https://doi.org/10.48550/arxiv.2606.30587","title":"Words Speak Louder Than Code: Investigating Cognitive Heuristics in LLM-Based Code Vulnerability Detection","display_name":"Words Speak Louder Than Code: Investigating Cognitive Heuristics in LLM-Based Code Vulnerability Detection","publication_year":2026,"publication_date":"2026-06-29","ids":{"openalex":"https://openalex.org/W7166735787","doi":"https://doi.org/10.48550/arxiv.2606.30587"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.30587","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.30587","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.30587","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5109521774","display_name":"Asif Shahriar","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Shahriar, Asif","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139655973","display_name":"Hongyu Cai","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Cai, Hongyu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5011751968","display_name":"Hadjer Benkraouda","orcid":"https://orcid.org/0000-0001-5511-3182"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Benkraouda, Hadjer","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139703801","display_name":"Gang Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Gang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5135391333","display_name":"Z. Berkay Celik","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Celik, Z. Berkay","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.5281999707221985,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.5281999707221985,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.22259999811649323,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.05299999937415123,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/heuristics","display_name":"Heuristics","score":0.8644000291824341},{"id":"https://openalex.org/keywords/cognition","display_name":"Cognition","score":0.6291000247001648},{"id":"https://openalex.org/keywords/framing","display_name":"Framing (construction)","score":0.6211000084877014},{"id":"https://openalex.org/keywords/cognitive-bias","display_name":"Cognitive bias","score":0.580299973487854},{"id":"https://openalex.org/keywords/social-heuristics","display_name":"Social heuristics","score":0.5296000242233276},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.43639999628067017},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.3910999894142151},{"id":"https://openalex.org/keywords/cognitive-model","display_name":"Cognitive model","score":0.3582000136375427}],"concepts":[{"id":"https://openalex.org/C127705205","wikidata":"https://www.wikidata.org/wiki/Q5748245","display_name":"Heuristics","level":2,"score":0.8644000291824341},{"id":"https://openalex.org/C169900460","wikidata":"https://www.wikidata.org/wiki/Q2200417","display_name":"Cognition","level":2,"score":0.6291000247001648},{"id":"https://openalex.org/C169087156","wikidata":"https://www.wikidata.org/wiki/Q2131593","display_name":"Framing (construction)","level":2,"score":0.6211000084877014},{"id":"https://openalex.org/C189216375","wikidata":"https://www.wikidata.org/wiki/Q1127759","display_name":"Cognitive bias","level":3,"score":0.580299973487854},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5454999804496765},{"id":"https://openalex.org/C139475501","wikidata":"https://www.wikidata.org/wiki/Q17081866","display_name":"Social heuristics","level":4,"score":0.5296000242233276},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.43639999628067017},{"id":"https://openalex.org/C180747234","wikidata":"https://www.wikidata.org/wiki/Q23373","display_name":"Cognitive psychology","level":1,"score":0.4115000069141388},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.3910999894142151},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.39100000262260437},{"id":"https://openalex.org/C161407221","wikidata":"https://www.wikidata.org/wiki/Q4382939","display_name":"Cognitive model","level":3,"score":0.3582000136375427},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.35100001096725464},{"id":"https://openalex.org/C77805123","wikidata":"https://www.wikidata.org/wiki/Q161272","display_name":"Social psychology","level":1,"score":0.3368000090122223},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.32350000739097595},{"id":"https://openalex.org/C2778079588","wikidata":"https://www.wikidata.org/wiki/Q5141258","display_name":"Cognitive vulnerability","level":4,"score":0.319599986076355},{"id":"https://openalex.org/C32903209","wikidata":"https://www.wikidata.org/wiki/Q840537","display_name":"Halo effect","level":4,"score":0.3021000027656555},{"id":"https://openalex.org/C175154964","wikidata":"https://www.wikidata.org/wiki/Q380077","display_name":"Task analysis","level":3,"score":0.2973000109195709},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.28450000286102295},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.27720001339912415},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.273499995470047},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.27000001072883606},{"id":"https://openalex.org/C2776035688","wikidata":"https://www.wikidata.org/wiki/Q1606558","display_name":"Affect (linguistics)","level":2,"score":0.26919999718666077},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.26899999380111694},{"id":"https://openalex.org/C187029079","wikidata":"https://www.wikidata.org/wiki/Q958679","display_name":"Cognitive reframing","level":2,"score":0.2628999948501587},{"id":"https://openalex.org/C169806903","wikidata":"https://www.wikidata.org/wiki/Q5937752","display_name":"Human error","level":2,"score":0.2540999948978424}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.30587","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.30587","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.30587","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.30587","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Researchers":[0],"and":[1,72,95,97,116,120,149,228],"practitioners":[2],"increasingly":[3],"apply":[4],"Large":[5],"Language":[6],"Models":[7],"(LLMs)":[8],"for":[9,140,162],"automated":[10],"vulnerability":[11,60,233],"detection.":[12,61,234],"Recent":[13],"work":[14,32],"has":[15,33],"shown":[16],"that":[17,26,67,126,156,158,209,222],"LLMs":[18,111],"are":[19,130,164],"susceptible":[20,131,166],"to":[21,78,132,167,184,213],"the":[22,50,69,75,83,89,98,188,194,199],"same":[23],"cognitive":[24,55,81,168,189,207,223],"heuristics":[25,37,56,169],"bias":[27],"human":[28],"judgment.":[29],"Yet,":[30],"no":[31],"investigated":[34],"whether":[35],"these":[36,133],"affect":[38],"a":[39,64,204,226],"model's":[40],"assessment":[41],"of":[42,54,215,231],"code":[43,59,70],"vulnerabilities.":[44,218],"In":[45],"this":[46,106],"paper,":[47],"we":[48,108,202],"present":[49],"first":[51],"systematic":[52],"exploration":[53],"in":[57],"LLM-driven":[58],"We":[62],"introduce":[63],"controlled":[65],"framework":[66],"holds":[68],"fixed":[71],"only":[73],"varies":[74],"surrounding":[76],"context":[77],"trigger":[79],"three":[80,113],"heuristics:":[82],"halo":[84,150],"effect":[85,91,100],"through":[86,92,101,173],"author":[87],"attribution,":[88],"framing":[90,141],"task":[93],"objectives":[94],"consequences,":[96],"anchoring":[99,146],"prior":[102],"analysis":[103,154],"results.":[104],"Within":[105],"framework,":[107],"evaluate":[109],"eight":[110],"across":[112],"programming":[114],"languages":[115],"perform":[117],"both":[118],"quantitative":[119],"code-level":[121],"analyses.":[122],"Our":[123],"findings":[124,220],"demonstrate":[125,203],"all":[127],"evaluated":[128],"models":[129,177],"heuristics.":[134],"Cross-model":[135],"average":[136],"susceptibility":[137,224],"is":[138,225],"highest":[139],"at":[142,147,151],"33.2%,":[143],"followed":[144],"by":[145],"23.5%":[148],"18.4%.":[152],"Code-level":[153],"reveals":[155],"vulnerabilities":[157],"require":[159],"semantic":[160],"reasoning":[161],"detection":[163],"more":[165],"than":[170],"those":[171],"identifiable":[172],"pattern":[174],"matching.":[175],"Furthermore,":[176],"often":[178],"change":[179],"their":[180],"verdict":[181],"from":[182],"safe":[183],"vulnerable":[185],"based":[186],"on":[187],"condition,":[190],"without":[191],"accurately":[192],"identifying":[193],"actual":[195],"vulnerability.":[196],"To":[197],"highlight":[198],"practical":[200],"impact,":[201],"proof-of-concept":[205],"black-box":[206],"attack":[208],"can":[210],"suppress":[211],"up":[212],"97%":[214],"previously":[216],"detected":[217],"These":[219],"indicate":[221],"consistent":[227],"exploitable":[229],"property":[230],"LLM-based":[232]},"counts_by_year":[],"updated_date":"2026-07-01T06:29:00.853634","created_date":"2026-07-01T00:00:00"}