Replication package for "Reducing Hallucinated False Positives in LLM-Based Vulnerability Detection via Multi-Signal Focused Verification"

Replication package for the article "Reducing Hallucinated False Positives in LLM-Based Vulnerability Detection via Multi-Signal Focused Verification" (Casper Chen, 2026). Contents: (1) the frozen pipeline code as it ran (detection layers 0–5, the multi-signal verification stage, PoC generator/validator/sandbox, Semgrep rule packs); (2) the raw output of every run-configuration reported in the article — 132 run directories, 964 configurations over four benchmarks (Damn Vulnerable DeFi, PyGoat, NodeGoat, SmartBugs-curated), three detection models and three verification models — with per-finding records, verifier verdicts, PoC code and execution results, and an inference-settings manifest per run; (3) the 253-item adjudication study (protocol, items, both judges' labels and justifications); (4) the scripts that regenerate every table of the article from the recorded outputs, with their expected output; (5) the experiment launchers, job lists and run reports. To regenerate the tables (Python 3.10+, numpy, scipy): unpack the archive, cd msfv-replication/analysis, run "sh make_tables.sh". README.md documents the directory layout, the ship rules, the redactions (absolute paths, private host addresses and the commercial deployment configuration were replaced by placeholders; no finding, verdict, count or timestamp was altered) and known gaps; CHECKSUMS.sha256 covers every file. This version (1.1) is an addendum: it contains only analysis_final_revision.py and README_v1.1.md, which accompany the accepted version of the article (Table 4 computed over the verification pool, F1 averaged over all runs, alert-count terminology, and the random-removal comparison). The data archive itself — msfv-replication-package-v1.0.tar.gz, 484,835,745 bytes, SHA-256 e948413aba7d7ad193a3170cd0d5792079c7cf578d3a08d6df67e9a1525fc3cc, uploaded as 24 parts plus SHA256SUMS.txt — is in version 1.0 of this record: https://doi.org/10.5281/zenodo.22704663. Place the script in msfv-replication/analysis/ of the unpacked archive. Licences: code MIT; data and documents CC BY 4.0; benchmark excerpts quoted in the outputs remain under their own licences (THIRD_PARTY.md).