AI Source Code Analysis Detection Evasion Techniques (cipher.org.uk)

Recent research has explored the potential for disguising vulnerabilities in source code to evade detection by advanced large language models (LLMs) like Nemotron 3.5, DeepSeek V4.1, OpenAI GPT-5.5, and Anthropic Claude Sonnet 5.5. The study demonstrates a C-to-C transformation that conceals a stack buffer overflow vulnerability by employing techniques such as Enum/Preprocessor Divergence and Branchless MBA Clamping. Surprisingly, even when models are aware of the tricks used, they fail to identify the hidden defect, highlighting limitations in their reasoning capabilities despite possessing the necessary knowledge. The significance of this research lies in its implications for software security and AI/ML systems. The successful manipulation of code semantics—whereby the evaluation context misleads the model about safety—poses a critical challenge to current detection methodologies. For instance, the use of an enumeration constant that is interpreted differently by the compiler and preprocessor creates an illusion of safety, while actual execution unearths vulnerabilities. These findings underscore the need for the AI/ML community to enhance model capabilities, particularly in reasoning about complex code transformations, to improve security assessments and prevent exploitation of similar evasion techniques in real-world applications.