测试发现部分大模型记住了真实漏洞数据，影响评估可靠性。
Are Large Language Models Memorizing Bug Benchmarks?
- 用训练集匹配、负对数似然等方法检测模型是否记住漏洞数据
- codegen-multi 在 Defects4J 上表现异常，疑似记忆了原始数据
- 新模型如 LLaMa 3.1 数据量大，泄露风险较低，适合严谨评估
大语言模型已广泛应用于代码生成、缺陷检测与修复等软件工程任务。为评估模型性能，研究者开发了包含真实项目漏洞的多个漏洞基准数据集。然而，软件工程界日益关注这些基准可能存在数据泄露问题，导致评估结果不可靠。尽管如此，关于泄露影响程度的量化研究仍有限。本文系统评估了主流大语言模型在常见漏洞基准上的泄露风险，采用多种指标分析，包括基准数据在常用训练集中的归属关系，以及负对数似然和 n-gram 准确率。结果表明，部分模型（尤其是 codegen-multi）在 Defects4J 等基准上表现出显著的记忆化现象；而基于更大规模数据训练的新模型（如 LLaMa 3.1）则显示出较少泄露迹象。研究提示需谨慎选择基准，并采用更稳健的评估指标来真实反映模型能力。
原文摘要 · Abstract (English)
Large Language Models (LLMs) have become integral to various software engineering tasks, including code generation, bug detection, and repair. To evaluate model performance in these domains, numerous bug benchmarks containing real-world bugs from software projects have been developed. However, a growing concern within the software engineering community is that these benchmarks may not reliably reflect true LLM performance due to the risk of data leakage. Despite this concern, limited research has been conducted to quantify the impact of potential leakage. In this paper, we systematically evaluate popular LLMs to assess their susceptibility to data leakage from widely used bug benchmarks. To identify potential leakage, we use multiple metrics, including a study of benchmark membership within commonly used training datasets, as well as analyses of negative log-likelihood and n-gram accuracy. Our findings show that certain models, in particular codegen-multi, exhibit significant evidence of memorization in widely used benchmarks like Defects4J, while newer models trained on larger datasets like LLaMa 3.1 exhibit limited signs of leakage. These results highlight the need for careful benchmark selection and the adoption of robust metrics to adequately assess models capabilities.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。