这篇论文提出了一个名为PRGuard的新工具，用于评估自动代码审查工具在拉取请求中的安全价值，与现有工具相比，它能够更准确地识别目标漏洞，值得一看。
自动代码审查工具在拉取请求中越来越受欢迎，但评估通常只测量它们是否阻止恶意更改。一个阻止可能是由一个无关的问题触发的，而不是使PR不安全的漏洞；修复报告的问题可能会使目标缺陷可利用。我们将这种差异称为判决-诊断（VD）差距。我们提出了MalPR-Bench，这是一个基于机制的基准，包含89个恶意PR和50个配对的良性控制，涵盖44个存储库和8个语言家族。每个恶意案例都有一个预先提交的规范，指定目标漏洞、接受的机制描述、所需的存储库证据和未获得信用分的离目标发现。审查分别对判决正确性、目标漏洞识别和证据验证进行评分；一个可归因的阻止需要所有三个。我们引入了PRGuard，这是一个可归因的PR安全审查器，它使用确定性、非执行工具和有界检索来构建候选漏洞并验证其前提与存储库证据。在31个常见覆盖率保留的恶意PR中，PRGuard和CodeRabbit的阻止总数相似（22/31与24/31），但PRGuard识别出22个目标漏洞，而CodeRabbit为16个，相差1.38倍。在14个缺失类型的情况下，两者都阻止了9个，而PRGuard识别出9个目标，而CodeRabbit为3个。当所需证据位于所触及的文件中时，CodeRabbit识别出16/24个目标，而当验证需要证据在它们之外时，为0/7。最后，PRGuard在五个项目中发现了十二个以前未公开的、基于概念验证的漏洞。PRGuard/DeepSeek和CodeRabbit都阻止了10/12个发现PR，但分别产生了10/12和4/12个可归因的阻止。因此，仅判决的评估可能会大大高估自动化审查的安全价值。
From Verdict to Diagnosis: Attributable Security Review of Pull Requests
Automated code reviewers are increasingly used as gates on pull requests (PRs), yet evaluations measure whether they block a malicious change. A block may be triggered by an unrelated issue rather than the vulnerability that makes the PR unsafe; fixing the reported issue can leave the target defect exploitable. We call this discrepancy the Verdict-Diagnosis (VD) gap. We present MalPR-Bench, a mechanism-grounded benchmark of 89 malicious PRs and 50 paired benign controls across 44 repositories and eight language families. Each malicious case has a pre-committed rubric specifying the target vulnerability, accepted mechanism descriptions, required repository evidence, and off-target findings receiving no credit. Reviews are scored separately for verdict correctness, target-vulnerability identification, and evidence validation; an attributable block requires all three. We introduce PRGuard, an attributable PR security reviewer that constructs candidate vulnerabilities and validates their premises against repository evidence using deterministic, non-executing tools and bounded retrieval. Across 31 common-coverage held-out malicious PRs, PRGuard and CodeRabbit produce similar blocking totals (22/31 vs. 24/31), but PRGuard identifies 22 target vulnerabilities versus 16 for CodeRabbit, a 1.38x difference. On 14 absence-type cases, both block 9, while PRGuard identifies 9 targets versus 3. CodeRabbit identifies 16/24 targets when required evidence lies within touched files and 0/7 when validation requires evidence outside them. Finally, PRGuard uncovers twelve previously undisclosed, proof-of-concept-backed vulnerabilities across five projects. PRGuard/DeepSeek and CodeRabbit both block 10/12 discovery PRs, but produce 10/12 and 4/12 attributable blocks, respectively. Thus, verdict-only evaluation can substantially overstate the security value of automated review.