Adversarial comments embedded in source code can suppress an LLM-based vulnerability detector, causing it to miss a genuine flaw. A practical question for both attackers and defenders is whether an adversarial comment crafted against one model also works against other models. If such attacks transfer, an attacker who can probe one accessible model can craft comments and reuse them against unknown deployed models. This paper reports a controlled study of cross-model transferability of adversarial comment injection, using four open-source code models, CodeGemma, CodeLlama, DeepSeek-Coder, and Qwen2.5-Coder, evaluated on an identical set of adversarial comments across 960 trials. We measure, for each ordered pair of models, the probability that a comment which fools the first model also fools the second. The average cross-model transfer rate is 53.0%, indicating substantial but partial transfer. The central finding is that transfer is strongly asymmetric. Comments that defeat the most robust model, Qwen2.5-Coder, transfer to the weaker models almost universally, reaching 100% transfer to CodeGemma and 93.3% to DeepSeek-Coder, whereas comments that defeat the weakest model transfer to the most robust model only 9.1% of the time. Only 2.9% of attacks fooled all four models, while attacks typically fooled one or two of the four. These results show that an adversarial comment effective against a robust detector is a near-universal key that also opens weaker detectors, and that model diversity provides real but incomplete protection, since the strongest transferring attacks are precisely those tuned against the strongest model.

vulnerability detection,adversarial machine learning,Transferability,LLM code review,prompt injection,cross-model attacks,AI security