用自我反思提升代码安全，无需额外训练。
RefleXGen:The unexamined code is not worth using
- 通过自我评估迭代优化生成代码
- 在多个模型上提升4.5%~13.6%安全性能
- 适合关注AI代码安全的研究与开发者
代码生成中的安全性仍是大型语言模型（LLMs）应用中的关键挑战。本文提出RefleXGen，一种创新方法，通过结合检索增强生成（RAG）与模型内在的引导式自我反思机制，显著提升代码安全性。与依赖微调或构建专用安全数据集的传统方法不同，RefleXGen通过无资源密集型的迭代自我评估与反思，持续积累并优化知识库，逐步提升生成代码的安全性。实验表明，该方法在多个模型上均实现显著改进：GPT-3.5 Turbo提升13.6%，GPT-4o提升6.7%，CodeQwen提升4.5%，Gemini提升5.8%。结果表明，优化模型自我反思能力是增强AI生成代码安全性的有效且可行策略。
原文摘要 · Abstract (English)
Security in code generation remains a pivotal challenge when applying large language models (LLMs). This paper introduces RefleXGen, an innovative method that significantly enhances code security by integrating Retrieval-Augmented Generation (RAG) techniques with guided self-reflection mechanisms inherent in LLMs. Unlike traditional approaches that rely on fine-tuning LLMs or developing specialized secure code datasets - processes that can be resource-intensive - RefleXGen iteratively optimizes the code generation process through self-assessment and reflection without the need for extensive resources. Within this framework, the model continuously accumulates and refines its knowledge base, thereby progressively improving the security of the generated code. Experimental results demonstrate that RefleXGen substantially enhances code security across multiple models, achieving a 13.6% improvement with GPT-3.5 Turbo, a 6.7% improvement with GPT-4o, a 4.5% improvement with CodeQwen, and a 5.8% improvement with Gemini. Our findings highlight that improving the quality of model self-reflection constitutes an effective and practical strategy for strengthening the security of AI-generated code.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。