迭代AI生成代码反而增加安全漏洞，5轮后关键漏洞升37.6%。
Security Degradation in Iterative AI Code Generation -- A Systematic Analysis of the Paradox
- 通过400个代码样本、40轮迭代实验验证漏洞演化规律。
- 仅5轮迭代后关键漏洞上升37.6%，不同提示策略影响各异。
- 适合关注AI辅助开发安全风险的开发者与团队参考。
大型语言模型（LLMs）在代码生成中的快速应用已改变软件开发方式，但对其在迭代反馈过程中安全漏洞演变的研究仍不足。本文通过控制实验，对400个代码样本在40轮“改进”中使用四种不同提示策略进行分析。结果表明，仅经过五轮迭代，关键漏洞就增加了37.6%，且不同提示方法导致的漏洞模式各不相同。这一发现挑战了“迭代优化能提升代码安全”的普遍假设，凸显了人工专家介入的重要性。研究提出实用指南，强调在每次迭代间必须进行严格的人员验证，以防止在看似有益的代码“改进”中引入新的安全问题。
原文摘要 · Abstract (English)
The rapid adoption of Large Language Models(LLMs) for code generation has transformed software development, yet little attention has been given to how security vulnerabilities evolve through iterative LLM feedback. This paper analyzes security degradation in AI-generated code through a controlled experiment with 400 code samples across 40 rounds of "improvements" using four distinct prompting strategies. Our findings show a 37.6% increase in critical vulnerabilities after just five iterations, with distinct vulnerability patterns emerging across different prompting approaches. This evidence challenges the assumption that iterative LLM refinement improves code security and highlights the essential role of human expertise in the loop. We propose practical guidelines for developers to mitigate these risks, emphasizing the need for robust human validation between LLM iterations to prevent the paradoxical introduction of new security issues during supposedly beneficial code "improvements".
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。