首个专用于评估大模型生成代码安全性的基准框架。
SafeGenBench: A Benchmark Framework for Security Vulnerability Detection in LLM-Generated Code
- 构建涵盖多种场景与漏洞类型的代码生成评估数据集。
- 结合静态分析与大模型判断，自动检测生成代码中的安全缺陷。
- 揭示主流大模型在生成无漏洞代码方面存在明显不足，适合安全研究者使用。
大语言模型（LLMs）的代码生成能力已成为评估其综合性能的关键维度。然而，以往研究普遍忽视了生成代码中固有的安全风险。本文提出SafeGenBench，一个专门用于评估大模型生成代码安全性的基准框架。该数据集覆盖了多种常见软件开发场景及漏洞类型。基于此基准，我们构建了一个自动评估框架，融合静态应用安全测试（SAST）与大模型判断，以检测模型生成代码中的安全漏洞。通过对当前先进大模型在SafeGenBench上的实证评估，我们发现其生成无漏洞代码的能力存在显著缺陷。研究结果揭示了亟待解决的挑战，并为提升大模型安全代码生成性能提供了可操作的见解。数据与代码即将开源。
原文摘要 · Abstract (English)
The code generation capabilities of large language models(LLMs) have emerged as a critical dimension in evaluating their overall performance. However, prior research has largely overlooked the security risks inherent in the generated code. In this work, we introduce SafeGenBench, a benchmark specifically designed to assess the security of LLM-generated code. The dataset encompasses a wide range of common software development scenarios and vulnerability types. Building upon this benchmark, we develop an automatic evaluation framework that leverages both static application security testing(SAST) and LLM-based judging to assess the presence of security vulnerabilities in model-generated code. Through the empirical evaluation of state-of-the-art LLMs on SafeGenBench, we reveal notable deficiencies in their ability to produce vulnerability-free code. Our findings highlight pressing challenges and offer actionable insights for future advancements in the secure code generation performance of LLMs. The data and code will be released soon.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。