用知识图谱引导大模型生成更安全的代码
Fortifying LLM-Based Code Generation with Graph-Based Reasoning on Secure Coding Practices
- 构建安全编码规范的有向无环图，理清规则间依赖关系
- 在多款大模型上实现超80%的安全率，零日漏洞提升88%
- 无需训练或修改模型，适合保密代码库和新出现漏洞
大型语言模型（LLMs）的代码生成能力已改变软件开发格局，但其生成的代码常含安全漏洞。现有方法通过注入或强化安全知识来增强模型，但存在资源消耗高、难适应零日漏洞、不适用于私有模型等问题。为此，本文提出GRASP，一种基于安全编码规范（SCPs）结构化推理的新方法：首先构建包含依赖关系的SCP有向无环图（DAG），再通过图推理系统引导LLM按相关规范生成代码。该设计实现可解释、模型无关且可扩展的安全增强，尤其对未知漏洞有效。评估显示，GRASP在多个主流大模型上安全率（SR）均超过80%，在零日漏洞场景下相较基线最高提升88%。
原文摘要 · Abstract (English)
The code generation capabilities of Large Language Models (LLMs) have transformed the field of software development. However, this advancement also presents significant security challenges, as LLM-generated code often contains vulnerabilities. One direction of research strengthens LLMs by injecting or refining security knowledge through curated datasets, model tuning, or static analyzers. While effective in certain settings, these methods can be resource-intensive, less adaptable to zero-day vulnerabilities, and often inapplicable to proprietary models. To address these challenges, we introduce GRASP, which explores a new direction that focuses on structured reasoning over Secure Coding Practices(SCPs) rather than additional training or external feedback. GRASP comprises two key ideas: (1) an SCP graph that organizes SCPs into a Directed Acyclic Graph (DAG) capturing dependencies and relationships, and (2) a graph-based reasoning process that systematically guides LLMs through relevant SCPs for code generation. This design enables interpretable, model-agnostic, and scalable security improvements, particularly for previously unseen vulnerabilities. Our evaluation shows that GRASP consistently achieves Security Rates (SR) exceeding 80% across multiple LLMs, and delivers up to 88% improvements over baselines on zero-day vulnerabilities.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。