测试10个大模型生成的C++代码，发现漏洞普遍且严重。
LLM-CSEC: Empirical Evaluation of Security in C/C++ Code Generated by Large Language Models
- 用CWE和CVE分类漏洞，系统评估生成代码安全
- 多款主流大模型生成代码普遍存在高危漏洞
- 适合关注AI编程安全的研究者与开发者
大型语言模型（LLM）生成代码的安全性引发广泛关注，研究显示其代码常含漏洞且缺乏防御性编程结构。本文聚焦于C/C++场景，采用通用弱点枚举（CWE）对已知漏洞进行分类，并通过映射至常见漏洞披露（CVE）评估其严重性。使用十种不同大模型生成代码，并借助静态分析技术进行检测。结果显示，人工智能生成代码中存在大量CWE漏洞，令人担忧。研究强调开发者在使用此类代码时需保持警惕，为提升自动化代码生成安全性提供重要参考，并推动该领域进一步研究。
原文摘要 · Abstract (English)
The security of code generated by large language models (LLMs) is a significant concern, as studies indicate that such code often contains vulnerabilities and lacks essential defensive programming constructs. This work focuses on examining and evaluating the security of LLM-generated code, particularly in the context of C/C++. We categorized known vulnerabilities using the Common Weakness Enumeration (CWE) and, to study their criticality, mapped them to CVEs. We used ten different LLMs for code generation and analyzed the outputs through static analysis. The amount of CWEs present in AI-generated code is concerning. Our findings highlight the need for developers to be cautious when using LLM-generated code. This study provides valuable insights to advance automated code generation and encourage further research in this domain.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。