Imagine you hire a brilliant building inspector, but the person scheduling their visits quietly skips certain floors, the clipboard they write on has pages glued shut, and the final report merges their notes in a way that erases some findings. You'd never know what they missed — and neither would they. That's the core mechanism this paper maps: the engineering scaffold around an LLM vulnerability scanner introduces silent false negatives that are invisible in the output. The committed claim is precise and useful: LLM-based vulnerability discovery harnesses contain at least 13 identifiable points where real, reachable vulnerabilities get dropped before or after the model ever sees the code, and these drops are structural — baked into file selection, filtering, context windowing, output parsing, and result merging. The paper identifies these across two harnesses the authors maintain (Knostic's OpenAnt and raptor) plus 10 additional open-source tools, and demonstrates a single file that six harnesses dropped before their model saw the code — five of them silently. The intellectual move that elevates this beyond a bug report is the connection to Ptacek and Newsham's 1998 work on IDS evasion. That paper showed how intrusion detection systems could be fooled by exploiting the gap between what the sensor saw and what the target host processed. Here, the gap is between what the harness feeds the model and what actually exists in the codebase. An attacker who understands the harness's selection and filtering rules can craft code that evades scanning by design — not by fooling the LLM, but by never reaching it. The taxonomy covers the full pipeline: pre-model drops (file selection by extension, size limits, binary exclusion, language filtering), context-window drops (truncation, chunking boundaries that split a vulnerability across windows), prompt-level drops (content-steered verdicts where the prompt biases the model toward 'no finding'), and post-model drops (output parsing failures, deduplication that merges distinct vulnerabilities, severity filtering that discards 'low' findings). Each drop point is mapped to a specific engineering failure pattern. A particularly sharp observation: harnesses built to be descriptive become prescriptive. Rules written to describe 'typical code' and 'typical model replies' end up defining the analysis boundary. Anything that doesn't conform to those assumptions — unusual file types, atypical code structure, edge-case formatting — is treated as absent or as 'no vulnerability.' The harness's worldview becomes the ceiling of its capability, regardless of the model underneath. The paper proposes design principles and concrete tests: harnesses should report what they analyzed and what they skipped, maintain coverage logs, and be tested against adversarial inputs specifically designed to trigger each drop point. The authors argue these findings generalize beyond vulnerability research to any LLM harness where completeness matters — code review, compliance checking, content moderation. Anywhere an attacker can influence the input to the harness, the evasion findings apply. The limitation is that this is a taxonomy paper with a proof-of-concept demonstration, not a large-scale empirical study with statistical power. The single-file test across six harnesses is illustrative but not exhaustive. The 13 drop points are derived from code review of 12 tools — comprehensive for the current open-source landscape, but the paper doesn't quantify how often each drop point fires in real-world usage or what fraction of actual vulnerabilities are lost in practice.
