Lion Cipher Lab
Use an LLM to review code for vulnerabilities — then MEASURE its false-positive rate (so you know when to trust it)
- AI Security
- Advanced
- ~60 min
- Free · no account required
Why it matters
An LLM is a fluent, confident, tireless source of security findings — and a chunk of them are wrong. Ship its raw output as 'findings' and you flood a triage queue with false positives, burn an engineer's afternoon chasing ghosts, and torch your own credibility. The professional move is not to trust the model or dismiss it — it is to MEASURE it against known-answer code before you rely on it, so 'we can trust it here' is a number you can show, not a feeling. That single habit — measure the tool, then decide where it belongs — is what separates an analyst who uses AI well from one who gets…
What you'll learn
- building a small labeled corpus with CWE-defined ground truth
- forcing an LLM into a structured, scorable verdict
- building a confusion matrix (TP/FP/FN/TN) in Python
- computing precision, recall, and a false-positive rate
- contrasting an LLM against a deterministic SAST baseline (Semgrep)
- judging WHEN to trust a model's findings and when not to
- recognising automation bias and why a high FP rate poisons a queue
Steps in this lab
- Why you MEASURE the model instead of trusting it
- Define 'real' with CWE, then build a small LABELED corpus
- Install Ollama and pull a local model (no API key, ever)
- Force the model into a STRUCTURED verdict (so you can score it)
- Score it: confusion matrix, precision, recall, false-positive rate
- Baseline: run a deterministic SAST tool (Semgrep) on the same files
- The judgment: when to trust it, and when not