评测大模型代码生成的安全性，发现其易产漏洞且修复能力弱。
Can You Really Trust Code Copilots? Evaluating Large Language Models from a Code Security Perspective
- 构建多任务安全评估基准CoV-Eval，覆盖生成、修复、检测等场景。
- 20个模型中多数能识别漏洞，但生成和修复能力仍不理想。
- 适合关注AI编程安全的研究者与开发者参考。
代码安全与可用性对由大语言模型（LLMs）驱动的编码助手应用至关重要。现有代码安全基准仅聚焦单一任务与范式，如代码补全与生成，缺乏对安全代码生成、漏洞修复与识别等多维度的综合评估。本文提出CoV-Eval，一个涵盖代码补全、漏洞修复、漏洞检测与分类等多任务的基准，用于全面评估LLM的代码安全性。同时，开发了VC-Judge，一种更贴近人类专家判断的改进型评审模型，可高效可靠地审查LLM生成代码中的漏洞。我们对20个专有及开源的LLM进行了全面评估。总体而言，尽管多数模型能较好识别漏洞代码，但仍倾向于生成不安全代码，且在特定漏洞类型识别与修复方面表现不佳。大量实验与定性分析揭示了关键挑战与优化方向，为未来LLM代码安全研究提供了洞见。
原文摘要 · Abstract (English)
Code security and usability are both essential for various coding assistant applications driven by large language models (LLMs). Current code security benchmarks focus solely on single evaluation task and paradigm, such as code completion and generation, lacking comprehensive assessment across dimensions like secure code generation, vulnerability repair and discrimination. In this paper, we first propose CoV-Eval, a multi-task benchmark covering various tasks such as code completion, vulnerability repair, vulnerability detection and classification, for comprehensive evaluation of LLM code security. Besides, we developed VC-Judge, an improved judgment model that aligns closely with human experts and can review LLM-generated programs for vulnerabilities in a more efficient and reliable way. We conduct a comprehensive evaluation of 20 proprietary and open-source LLMs. Overall, while most LLMs identify vulnerable codes well, they still tend to generate insecure codes and struggle with recognizing specific vulnerability types and performing repairs. Extensive experiments and qualitative analyses reveal key challenges and optimization directions, offering insights for future research in LLM code security.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。