AWS Deception Benchmark Targets AI's False Positive Problem in Vulnerability Detection
Amazon Web Services has launched the Deception Benchmark, a public dataset designed to rigorously test AI models' ability to distinguish real security vulnerabilities from benign code, aiming to combat the pervasive issue of false positives in automated security tools.
Amazon Web Services (AWS) has introduced the Deception Benchmark, a novel public dataset and evaluation framework aimed at addressing a critical challenge in the application of artificial intelligence to cybersecurity: the high rate of false positives generated by AI models tasked with identifying software vulnerabilities.
This initiative seeks to improve the accuracy of AI-powered security tools used in various domains, including code review, vulnerability triage, penetration testing, and threat modeling. High false-positive rates can significantly degrade the effectiveness of these tools, leading to increased workload for security analysts, alert fatigue, and a diminished trust in legitimate findings. By providing a standardized benchmark, AWS hopes to accelerate the development of more reliable AI security solutions.
The Deception Benchmark comprises 14,822 samples across 16 programming languages and over 70 Common Weakness Enumeration (CWE) categories. Unlike existing benchmarks that might focus on exploit generation or general cybersecurity tasks, AWS's dataset specifically targets the AI's ability to discern genuine vulnerabilities from code that merely appears suspicious. This is particularly challenging because safe code might contain patterns that resemble known vulnerabilities, but incorporate compensating controls that prevent exploitation.
AWS designed the benchmark's "safe" samples to be intentionally deceptive, incorporating real vulnerability patterns alongside safeguards that render them non-exploitable. AI models must analyze these samples and determine their true security status without explicit hints. "Production tools rely on multi-step loops and agentic workflows to compensate, but that scaffolding masks whether the model itself understands the code," explained Anshumali Shrivastava, Amazon Scholar, and Neha Rungta, Applied Science Director at AWS Identity. "This benchmark strips the scaffolding away and asks the model to make the call in a single pass, so what it measures is understanding, not how many tries a harness takes to get there."
AWS meticulously generated and refined these samples, a process that consumed tens of billions of tokens. The dataset includes 9,695 scored samples, further divided into code-level challenges (where a small code change differentiates vulnerable from safe versions) and environment-gated challenges (where external configurations like Kubernetes Network Policies prevent exploitation). To prevent overfitting, the dataset also contains 5,127 unscored samples mixed with the scored ones, and users submit predictions to AWS for verification.
Ensuring label accuracy was a priority for AWS. Each sample's label was independently reviewed by multiple experts without knowledge of other reviewers' decisions or the original reasoning. Disagreements were subjected to further review, with unresolved cases escalated to human experts. This rigorous process aimed to achieve a high degree of confidence in the dataset's integrity, with a target of less than 1% of samples remaining disputed after human review.
Initial evaluations of 12 AI models using the Deception Benchmark revealed significant challenges. Even with direct prompting, models incorrectly flagged between 41% and 99% of safe code as vulnerable. While asking models to demonstrate exploitability reduced false positives, it often increased false negatives, meaning more real vulnerabilities were missed. None of the tested configurations met AWS's proposed minimum bar of below 10% for both false-positive and false-negative rates.
The results highlight that current general-purpose AI models, when evaluated in a single pass without complex scaffolding, struggle to reliably differentiate between potentially risky code and genuinely exploitable vulnerabilities, especially when external security controls are in play. AWS emphasizes that these findings do not directly reflect the performance of specialized security products that employ multi-step validation processes.