Suman Jana

Detecting when a language model is wrong without ground truth labels is a fundamental challenge for safe deployment. Existing approaches rely on a model's own uncertainty, such as token entropy or confidence scores, but these signals fail critically on the most dangerous failure mode: confident errors, where a model is wrong but certain. In this work we introduce *cross-model disagreement* as a correctness indicator—a simple, training-free signal that can be dropped into existing production systems, routing pipelines, and deployment monitoring infrastructure without modification. Given a model's generated answer, cross-model disagreement computes how surprised or uncertain a second verifier model is when reading that answer via a single forward pass. No generation from the verifying model is required, and no correctness labels are needed. We instantiate this principle as Cross-Model Perplexity (CMP), which measures the verifying model's surprise at the generating model's answer tokens, and Cross-Model Entropy (CME), which measures the verifying model's uncertainty at those positions. Both CMP and CME outperform within-model uncertainty baselines across benchmarks spanning reasoning, retrieval, and mathematical problem solving (MMLU, TriviaQA, and GSM8K), and dominate other label-free signals operating in the single-prefill cost regime. On MMLU, CMP achieves a mean AUROC of 0.73 against a within-model entropy baseline of 0.59. These results establish cross-model disagreement as a practical, training-free approach to label-free correctness estimation, with direct applications in deployment monitoring, model routing, selective prediction, data filtering, and scalable oversight of production systems.

LLM-based agents are increasingly used for automated program repair (APR) to support software maintenance. Given a GitHub issue describing a bug, these agents automatically generate patches to fix the reported problem. However, existing research on APR agents focuses primarily on improving functional correctness—whether generated patches pass regression tests—while largely overlooking security risks. This raises an important question: \textit{Can an adversarial user submit a valid GitHub issue that misleads an LLM-based APR agent into generating a functionally correct but vulnerable patch?} To answer this question, we propose \tool, which generates adversarial issue statements that induce APR agents to produce functionally correct yet vulnerable patches. Empirical evaluation on three agent pipelines and five backend LLMs shows that \tool can produce patches that are both functionally correct and vulnerable (the attack success rate on the correct patch could reach 0.91, whereas the baseline ASRs are all below 0.20). Our evaluation challenges the assumption that \textit{passing all tests guarantees a patch’s reliability and security, revealing critical limitations in the current APR evaluation paradigm.} Our code is available at GitHub.

Large language models (LLMs) are increasingly deployed for understanding large codebases, but whether they understand operational semantics of long code context or rely on pattern matching shortcuts remains unclear. We distinguish between lexical recall (retrieving code verbatim) and semantic rec...

AI coding assistants automatically gather context from potentially untrusted sources to generate code recommendations. We introduce Cross-Origin Context Poisoning (XOXO), a novel attack that exploits this automatic context inclusion by subtly manipulating code without changing its semantics. Atta...