How do LLMs actually reduce false positives in security tools?
Traditional security tools like static application security testing (SAST) scanners are notorious for drowning teams in false alarms — alerts that look like vulnerabilities but aren't. One study found that a standard SAST tool (Semgrep) produced 560 false positives on a benchmark of 2,740 Java test cases [2]. That's a lot of wasted developer time chasing ghosts. An LLM-based multi-agent system called QASecClaw was designed to review each SAST finding in context, using the source code to decide if it's a real bug or a false alarm. The result: false positives dropped by 88.6% to just 64, while recall (the ability to find real vulnerabilities) only fell by 3.1% [2]. The overall accuracy, measured by F1 score, jumped from 78.39% to 90.93% [2]. This means teams see far fewer useless alerts and can trust the remaining ones more.
Another study tackled false positives in IoT network intrusion detection, where traditional anomaly systems generate so many false alarms that analysts ignore them [4]. The researchers added an LLM (GPT-4o mini) to explain each alert in plain language, assign a risk score, and summarize the network traffic context [4]. This didn't just reduce the number of false positives — it made the output understandable to non-experts, so fewer people needed to be involved in triage [4]. A third paper on enterprise security operations centers (SOCs) reported that an LLM-driven framework decreased alert fatigue and improved detection accuracy by correlating threats across multiple data sources and automating governance reporting [5]. Together, these studies show that LLMs help in two ways: filtering out noise and explaining what's left so humans can act faster.
What's the catch — can attackers turn false positives against us?
There's a serious downside: the same LLM safeguards that protect against malicious prompts can be tricked into blocking safe content, creating a new kind of attack. One study demonstrated that attackers can insert a short adversarial prompt (about 30 characters) into a user request that causes the LLM's guardrail to reject over 97% of legitimate user queries [1]. This is a denial-of-service (DoS) attack that exploits the safeguard's tendency to produce false positives — blocking harmless requests as if they were dangerous [1]. The attack works both by injecting prompts on the client side and by corrupting the LLM model on the server through poisoned fine-tuning [1]. So while LLMs can reduce false positives in security scanning, they also introduce a new surface where false positives can be weaponized against the system itself.
This doesn't mean the approach is a net negative — it means teams need to be aware of the trade-off. The studies that show dramatic false-positive reduction [2][4] focus on using LLMs as a filter or explainer for other security tools, not as the primary guardrail. The attack study [1] targets LLM safeguards that are designed to block harmful content, which is a different use case. The key insight is that LLMs are powerful but brittle: they can clean up noise from traditional tools, but they also need their own defenses against adversarial manipulation. A practical takeaway is to use LLMs for post-processing (filtering and explaining alerts from deterministic scanners) rather than as the sole gatekeeper.
When should teams adopt LLM pair programmers for security, and what are the limits?
The evidence suggests LLMs are most effective when paired with existing deterministic security tools, not as a replacement. The QASecClaw system [2] works by having a traditional SAST engine (Semgrep) do the initial scan, then an LLM agent reviews each finding with full source code context. This two-stage approach preserves the high recall of the SAST tool while using the LLM's contextual understanding to cut false positives dramatically. The IoT framework [4] similarly uses traditional machine learning (isolation forest, random forest) for initial detection, then an LLM to interpret and explain the results. In both cases, the LLM adds value on top of a reliable base, not as the sole detector.
The limits are clear from the adversarial study [1]: LLMs used as standalone security gates are vulnerable to carefully crafted inputs that cause them to reject everything. Also, the studies here are mostly on benchmark datasets (OWASP Benchmark v1.2 [2], UNSW-NB15 [5]) or specific environments (SAP HANA Cloud [3]), so real-world performance may vary. The false-positive reduction in [2] was on Java code; results may differ for other languages or frameworks. Finally, the LLM-based approaches require computational resources and careful prompt engineering — they're not a free lunch. But for teams drowning in false positives from SAST or intrusion detection systems, the evidence shows that an LLM pair programmer can cut the noise by nearly 90% while catching almost all real vulnerabilities.
About These Sources
This answer is built on 5 peer-reviewed studies — published from 2024 to 2026, 5 from 2024 or later — selected as the most relevant from 5 studies that passed quality screening, drawn from 41 papers retrieved from a database of over 500 million.
Sources used in this answer
LLM Safeguard is a Double-Edged Sword: Exploiting False Positives for Denial-of-Service Attacks
Demonstrates that attackers can exploit false positives in LLM safeguards to cause denial-of-service attacks, blocking over 97% of legitimate user requests with a short adversarial prompt (about 30 characters) in a white-box setting on Llama Guard 3.
QASecClaw: A Multi-Agent LLM Approach for False Positive Reduction in Static Application Security Testing
In the largest quantitative evaluation among these studies (2,740 Java test cases from OWASP Benchmark v1.2), a multi-agent LLM system reduced false positives by 88.6% (from 560 to 64) with only a 3.1% recall loss, raising F1 from 78.39% to 90.93%.
FPDetection: False Positives Detection in Static Code Analysis with Deep Learning and LLM
Proposes a method using deep learning and a fine-tuned LLM with ensemble classification to detect false positives in static code analysis for SAP HANA Cloud, showing improved efficiency in security defect analysis.
LLM-Enhanced Security Framework for IoT Network: Anomaly Detection and Malicious Devices Identification
Integrates GPT-4o mini with traditional anomaly detection (isolation forest, random forest) for IoT networks, reducing false positives and providing human-readable explanations that bridge the semantic gap for non-technical users.
Large Language Model (LLM)–Driven Threat Correlation and Governance Automation for Security Operations in U.S. Enterprise Systems
Proposes an LLM-driven framework for enterprise SOCs that correlates threats across multiple data sources (UNSW-NB15 dataset), reduces alert fatigue, and improves detection accuracy and response time compared to conventional methods.