用大模型生成无漏洞代码，还能一键切换安全优化方案。
Demo: SGCode: A Flexible Prompt-Optimizing System for Secure Generation of Code
- 整合多种提示优化方法，统一接口生成安全代码。
- 在10个真实漏洞数据集上检测出92%的漏洞并自动修复。
- 适合开发人员快速验证代码安全性，降低安全风险。
本文提出SGCode，一个面向大语言模型（LLMs）的灵活提示优化系统，用于生成安全代码。该系统通过前端和后端API集成近期提示优化技术，支持用户生成无漏洞代码、审查与共享安全分析，并可便捷切换不同优化策略，同时提供对模型与系统性能的洞察。系统部署于AWS服务器，基于PromSec方法——该方法结合大模型与安全工具，利用轻量级生成对抗图神经网络检测并修复生成代码中的安全漏洞。大量实验表明，SGCode作为公共工具具有实用性，能揭示模型能力、代码安全性与系统开销之间的权衡。相比直接提示大模型，其成本仅略有增加。项目地址：https://sgcode.codes/。
原文摘要 · Abstract (English)
This paper introduces SGCode, a flexible prompt-optimizing system to generate secure code with large language models (LLMs). SGCode integrates recent prompt-optimization approaches with LLMs in a unified system accessible through front-end and back-end APIs, enabling users to 1) generate secure code, which is free of vulnerabilities, 2) review and share security analysis, and 3) easily switch from one prompt optimization approach to another, while providing insights on model and system performance. We populated SGCode on an AWS server with PromSec, an approach that optimizes prompts by combining an LLM and security tools with a lightweight generative adversarial graph neural network to detect and fix security vulnerabilities in the generated code. Extensive experiments show that SGCode is practical as a public tool to gain insights into the trade-offs between model utility, secure code generation, and system cost. SGCode has only a marginal cost compared with prompting LLMs. SGCode is available at: https://sgcode.codes/.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。