多智能体协作提升大模型代码生成安全性，静态分析与动态测试结合。
AutoSafeCoder: A Multi-Agent Framework for Securing LLM Code Generation through Static Analysis and Fuzz Testing
- 三智能体协同：写代码、查漏洞、做模糊测试。
- 安全评估数据集上漏洞减少13%，功能不受影响。
- 适合关注AI生成代码安全的开发者和安全研究者。
大型语言模型（LLMs）在自动代码生成方面取得进展，但现有方法多依赖单一智能体，难以生成无漏洞代码。传统程序合成侧重功能正确性，忽视运行时安全问题。为此，我们提出AutoSafeCoder，一个基于多智能体框架，通过持续协作实现代码生成、漏洞分析与安全增强。该框架包含三个智能体：编码智能体负责生成代码，静态分析智能体识别漏洞，模糊测试智能体采用变异式模糊测试检测运行时错误。核心贡献在于将动态与静态测试整合进LLM代码生成的迭代流程，显著提升安全性。在SecurityEval数据集上的实验表明，相比基线模型，代码漏洞减少13%，且未牺牲功能完整性。
原文摘要 · Abstract (English)
Recent advancements in automatic code generation using large language models (LLMs) have brought us closer to fully automated secure software development. However, existing approaches often rely on a single agent for code generation, which struggles to produce secure, vulnerability-free code. Traditional program synthesis with LLMs has primarily focused on functional correctness, often neglecting critical dynamic security implications that happen during runtime. To address these challenges, we propose AutoSafeCoder, a multi-agent framework that leverages LLM-driven agents for code generation, vulnerability analysis, and security enhancement through continuous collaboration. The framework consists of three agents: a Coding Agent responsible for code generation, a Static Analyzer Agent identifying vulnerabilities, and a Fuzzing Agent performing dynamic testing using a mutation-based fuzzing approach to detect runtime errors. Our contribution focuses on ensuring the safety of multi-agent code generation by integrating dynamic and static testing in an iterative process during code generation by LLM that improves security. Experiments using the SecurityEval dataset demonstrate a 13% reduction in code vulnerabilities compared to baseline LLMs, with no compromise in functionality.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。