Zhuo Zhang

Software auditing is an increasingly critical task in the era of rapid code generation. While LLM-based auditors have demonstrated strong potential, their effectiveness remains limited by misalignment with the highly complex, domain-specific nature of bug detection. In this work, we introduce BugScope, a framework that mirrors how human auditors learn specific bug patterns from representative examples and apply this knowledge during code auditing. BugScope structures auditing into three steps: seed identification, context retrieval, and bug detection, and aligns LLMs to each step by analyzing real bug reports and mutated examples, and distilling concise, reusable guidelines. On a curated dataset of 33 real-world bugs from 21 widely used open-source projects, BugScope achieves 86.05\% precision and 87.88\% recall, corresponding to an F1 score of 0.87. By comparison, leading industrial tools such as Claude Code (with Claude Opus 4.6) and Cursor BugBot achieve F1 scores of only 0.51 and 0.43, respectively. Beyond benchmarks, large-scale evaluation on real-world projects such as the Linux kernel uncovered 184 previously unknown bugs, of which 78 have already been fixed and 7 explicitly confirmed by developers. Our code is available at (https://github.com/jinyaoguo/BugScope).

Large Language Models (LLMs) can produce complex reasoning chains, offering a window into their decision-making processes. However, verifying the quality (e.g., faithfulness and correctness) of these intermediate steps is a critical, unsolved challenge. Current auditing methods usually rely on a centralized auditor, either human or verifier model, to inspect full reasoning traces. This paper addresses three key challenges in those methods. **Robustness**: Centralized systems are single points of failure, vulnerable to attacks and systemic bias. **Scalability**: The lengthiness and complexity of reasoning traces create a severe bottleneck for human auditors. **IP confidentiality**: Model providers risk intellectual property theft or model distillation when exposing complete reasoning traces. To overcome these barriers, we introduce TRUST, a crowdsourcing framework for auditing LLM reasoning. TRUST makes the following contributions: *First*, it establishes a consensus mechanism among a diverse set of auditors that removes reliance on any *single trusted auditor*: under the modeled seat-corruption process the trace-level failure bound holds up to a 20% adversarial seat fraction, and empirically TRUST retains 69.0% accuracy with one compromised seat per segment, where centralized baselines collapse to ~20%. *Second*, it introduces a scalable decomposition method that transforms reasoning traces into hierarchical directed acyclic graphs, enabling atomic reasoning steps to be audited in parallel by a crowd of independent auditors. *Third*, the framework limits exposure by distributing only partial segments of the reasoning trace to auditors. We provide theoretical guarantees for the security and economic incentives. Experiments across multiple LLMs (e.g., GPT-OSS, DeepSeek-r1, Qwen) and reasoning tasks (e.g., math, medicine, science, and humanities) demonstrate that TRUST is highly effective at identifying reasoning flaws and is significantly more resilient to corrupted and adversarial auditors than centralized baselines. Our work introduces an auditing framework for reasoning AI systems, enabling safer and secure deployment in high-stakes settings.