用上下文提示调优提升大模型修复缓冲区溢出漏洞能力
Code Vulnerability Repair with Large Language Model using Context-Aware Prompt Tuning
- 通过注入安全与代码上下文知识优化提示词
- 修复成功率从15%提升至63%
- 适合关注代码安全与大模型应用的开发者
大型语言模型（LLMs）在检测和修复涉及变量、代码流和结构等多方面问题的漏洞时表现不佳。本研究以GitHub Copilot为基底模型，聚焦缓冲区溢出漏洞。实验显示，其漏洞检测率为76%，但修复率仅为15%。为此，我们提出上下文感知的提示调优技术，通过注入漏洞相关的安全与代码上下文知识，使Copilot的修复成功率提升至63%，相比无领域知识的情况提升超过四倍。
原文摘要 · Abstract (English)
Large Language Models (LLMs) have shown significant challenges in detecting and repairing vulnerable code, particularly when dealing with vulnerabilities involving multiple aspects, such as variables, code flows, and code structures. In this study, we utilize GitHub Copilot as the LLM and focus on buffer overflow vulnerabilities. Our experiments reveal a notable gap in Copilot's abilities when dealing with buffer overflow vulnerabilities, with a 76% vulnerability detection rate but only a 15% vulnerability repair rate. To address this issue, we propose context-aware prompt tuning techniques designed to enhance LLM performance in repairing buffer overflow. By injecting a sequence of domain knowledge about the vulnerability, including various security and code contexts, we demonstrate that Copilot's successful repair rate increases to 63%, representing more than four times the improvement compared to repairs without domain knowledge.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。