You might appreciate this survey paper: https://www.usenix.org/conference/usenixsecurity22/presentat...
Most of the work I have read in this field is focused on finding potential malware or stolen copyrighted code, so false positives are no big deal. But you don't want anything less than 100% valid code coming out of your compiler.