用工具反馈+检索修复案例，让大模型生成更安全的代码
Improving LLM-Assisted Secure Code Generation through Retrieval-Augmented-Generation and Multi-Tool Feedback
- 用编译诊断、安全扫描和符号执行多工具反馈迭代优化代码
- 对DeepSeek-Coder降低96%安全漏洞，对CodeLlama关键缺陷率降超60%
- 适合需要生成高安全性代码的研发人员或自动化测试团队
大型语言模型（LLMs）生成代码时常引入安全漏洞、逻辑错误和编译失败。已有研究表明，结构化反馈、静态分析、检索增强与基于执行的优化能显著提升效果。本文提出一种基于检索增强的多工具修复流程：单一代码生成模型通过编译诊断、CodeQL安全扫描和KLEE符号执行持续迭代修正输出。采用轻量级嵌入模型检索过往成功修复案例，提供聚焦安全的参考样本。在由DeepSeek-Coder-1.3B和CodeLlama-7B生成的共3,242个程序上评估，系统显著提升鲁棒性：DeepSeek的漏洞减少96%；CodeLlama的关键安全缺陷率从58.55%降至22.19%，证明该工具辅助自修复机制对“顽固”模型同样有效。
原文摘要 · Abstract (English)
Large Language Models (LLMs) can generate code but often introduce security vulnerabilities, logical inconsistencies, and compilation errors. Prior work demonstrates that LLMs benefit substantially from structured feedback, static analysis, retrieval augmentation, and execution-based refinement. We propose a retrieval-augmented, multi-tool repair workflow in which a single code-generating LLM iteratively refines its outputs using compiler diagnostics, CodeQL security scanning, and KLEE symbolic execution. A lightweight embedding model is used for semantic retrieval of previously successful repairs, providing security-focused examples that guide generation. Evaluated on a combined dataset of 3,242 programs generated by DeepSeek-Coder-1.3B and CodeLlama-7B, the system demonstrates significant improvements in robustness. For DeepSeek, security vulnerabilities were reduced by 96%. For the larger CodeLlama model, the critical security defect rate was decreased from 58.55% to 22.19%, highlighting the efficacy of tool-assisted self-repair even on "stubborn" models.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。