How Reliable Are Generative-AI Code Reviews?
This study examines whether generative-AI tools can perform dependable code reviews and whether they identify the same defects that would be found by established tools or known ground-truth datasets.
View full research brief
Problem Statement
Software teams increasingly use generative AI to review source code, yet it is unclear how consistently these tools detect real defects, distinguish serious problems from minor concerns, or avoid generating false alarms. An unreliable reviewer could either miss important faults or overwhelm developers with incorrect recommendations.
Objective
Evaluate the accuracy and reliability of one or more LLM-based code reviewers and determine which categories of software defects they detect well, which they miss, and how their performance compares with traditional static-analysis tools or known defect labels.
Scope
Focus on a manageable set of Java, Python, or C/C++ projects. Defects may include logic errors, requirement violations, maintainability issues, security weaknesses, API misuse, and selected code smells. Teams should avoid attempting to evaluate every programming language or every defect class.
Research Method
- Select open-source programs with known bugs or create controlled seeded defects.
- Run one or more LLMs using a consistent review prompt.
- Run one or more established static-analysis or quality tools as baselines.
- Compare reported findings against ground truth.
- Measure precision, recall, F1-score, false positives, false negatives, and performance by defect category.
Anticipated Contribution
The study can provide evidence about when AI-based code review is trustworthy, where human review is still essential, and which defect categories are most or least suitable for automated AI review. The resulting benchmark and evaluation procedure could also be reused in future studies.