LLM vs. SAST: A Technical Analysis on Detecting Coding Bugs of GPT4-Advanced Data Analysis

2025/06/18 by Madjid G. Tehrani, Tehrani, Madjid G., Eldar Sultanow +7
Computer Science · #Advanced Data Storage Technologies #Cryptography and Security (cs.CR) #FOS: Computer and information sciences

paper · pdf · doi:10.48550/arxiv.2506.15212

openalex publication_date 2025/06/18 · openalex created_date 2025/10/19 · openalex updated_date 2026/07/28

Abstract

Large language models (LLMs) are increasingly used for code understanding, yet their practical effectiveness for vulnerability detection relative to Static Application Security Testing (SAST) remains insufficiently quantified. We present a controlled comparative study between GPT-4 (Advanced Data Analysis) and two SAST tools (SonarQube and Cloud Defence) on 32 curated security scenarios representing common coding pitfalls. Each scenario is scored with a binary detection rule, the two SAST outputs are aggregated using a logical OR baseline, and paired outcomes are evaluated using McNemar's test for statistical significance. In our dataset, GPT-4 correctly detected 30 of 32 scenarios (93.75%), while the aggregated SAST baseline detected 11 of 32. The paired comparison shows a statistically significant difference in detection performance in favour of GPT-4. We also discuss security considerations and operational constraints for integrating LLM-enhanced vulnerability scanning into secure software development workflows.

Citations

• "Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models
• The Hitchhiker's Guide to Program Analysis: A Journey with Large Language Models
• To Repeat or Not To Repeat: Insights from Scaling LLM under Token-Crisis
• Evaluation of ChatGPT Model for Vulnerability Detection
• DiverseVul: A New Vulnerable Source Code Dataset for Deep Learning Based Vulnerability Detection
• An Analysis of the Automatic Bug Fixing Performance of ChatGPT
• Ignore Previous Prompt: Attack Techniques For Language Models
• Planting Undetectable Backdoors in Machine Learning Models
• A Survey on Machine Learning Techniques for Source Code Analysis
• Evaluating Large Language Models Trained on Code
• Systematic Evaluation of Backdoor Data Poisoning Attacks on Image\n Classifiers
• The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• Membership Inference Attacks against Machine Learning Models
• Reflections on trusting trust
• Note on the Sampling Error of the Difference Between Correlated Proportions or Percentages
• LMs: Understanding Code Syntax and Semantics for Code Analysis
• Integration of Large Language Models and Federated Learning

Related

• LLM-Driven SAST-Genius: A Hybrid Static Analysis Framework for Comprehensive and Actionable Security
• LLMs Cannot Reliably Identify and Reason About Security Vulnerabilities (Yet?): A Comprehensive Evaluation, Framework, and Benchmarks
• LLM4CVE: Enabling Iterative Automated Vulnerability Repair with Large Language Models
• Boosting Cybersecurity Vulnerability Scanning based on LLM-supported Static Application Security Testing
• LLMs in Software Security: A Survey of Vulnerability Detection Techniques and Insights