给开发者上安全课，能显著减少大模型写代码时的漏洞。
A Quasi-Experimental Developer Study of Security Training in LLM-Assisted Web Application Development
- 用分层安全培训前后对比，测试开发者写代码的安全性变化。
- 漏洞总数降31.5%，严重漏洞负担减少38.2%，关键问题减少79.2%。
- 对权限和认证问题效果最好，适合想提升代码安全的开发者。
本文通过受控的准实验开发人员研究，检验分层安全培训是否能提升大模型辅助实现以身份为中心的Java Spring Boot后端时的安全质量。研究采用混合设计，包含被试内前后测比较及探索性被试间经验因素分析。12名开发者在统一界面、固定模型配置、交叉平衡任务集和共享起始项目下完成匹配任务。安全结果由第一、二作者独立手动验证提交的代码库得出。主要个体层面终点为严重性加权的有效弱点评分。配对样本的精确威尔科克斯符号秩检验显示，训练后条件有显著下降（p = 0.0059）。总体来看，有效弱点从162个降至111个（减少31.5%），严重性加权负担从432降至267（减少38.2%），关键发现从24个降至5个（减少79.2%）。授权与对象访问缺陷降幅最大（53.3%），认证、凭证策略与恢复缺陷降幅为44.7%。会话与浏览器信任边界问题变化小，敏感数据与加密缺陷仅略有改善。结果表明，在测试条件下，训练后运行可降低大模型辅助后端开发中的有效安全负担，且无需修改模型。但不支持替代安全默认值、静态分析、专家审查或操作加固。
原文摘要 · Abstract (English)
This paper presents a controlled quasi-experimental developer study examining whether a layer-based security training package is associated with improved security quality in LLM-assisted implementation of an identity-centric Java Spring Boot backend. The study uses a mixed design with a within-subject pre-training versus post-training comparison and an exploratory between-subject expertise factor. Twelve developers completed matched runs under a common interface, fixed model configuration, counterbalanced task sets, and a shared starter project. Security outcomes were assessed via independent manual validation of submitted repositories by the first and second authors. The primary participant-level endpoint was a severity-weighted validated-weakness score. The post-training condition showed a significant paired reduction under an exact Wilcoxon signed-rank test ($p = 0.0059$). In aggregate, validated weaknesses decreased from 162 to 111 (31.5\%), the severity-weighted burden decreased from 432 to 267 (38.2\%), and critical findings decreased from 24 to 5 (79.2\%). The largest reductions were in authorization and object access (53.3\%) and in authentication, credential policy, and recovery weaknesses (44.7\%). Session and browser trust-boundary issues showed minimal change, while sensitive-data and cryptographic weaknesses showed only marginal improvement. These results suggest that, under the tested conditions, post-training runs reduce validated security burden in LLM-assisted backend development without modifying the model. They do not support replacing secure defaults, static analysis, expert review, or operational hardening.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。