针对大模型代码生成中的真实安全风险，提出新评估框架并验证缓解策略。
Poster: Rethinking Security in LLM Code Generation through Real-World Risk Scenarios
- 从开发者视角提炼三类真实安全风险场景
- 构建2700个用例的基准，发现主流模型漏洞率超56%
- 提示词优化可降低45%风险，适合安全开发与模型评测者
大型语言模型（LLMs）广泛用于代码生成，但其在真实开发流程中的安全表现仍缺乏深入研究。现有基准多依赖明确的安全需求，难以反映提示模糊或不完整的真实场景。本文从开发者角度识别三类典型风险：需求模糊、运行上下文不足、安全与功能冲突。基于此构建包含2,700个测试用例的大规模基准，实现对LLM在真实条件下安全性的细粒度评估。对八种先进LLM的广泛测试显示，所有模型在各类风险场景下的平均漏洞率均超过56%。进一步实验表明，采用安全感知提示可显著降低风险，最高提升达45%。
原文摘要 · Abstract (English)
Large Language Models (LLMs) are widely used for code generation, yet their security behavior in realistic development workflows remains underexplored. Existing benchmarks often rely on explicitly specified security requirements, failing to capture real-world scenarios where prompts are frequently ambiguous or incomplete. In this paper, we adopt a developer-centric perspective and identify three representative risk scenarios that commonly lead to security vulnerabilities in LLM-generated code: Ambiguous Requirements, Under-Specified Operational Context, and Security--Functionality Conflict. Based on these scenarios, we construct a large-scale benchmark comprising 2,700 test cases, enabling fine-grained evaluation of LLM security under realistic conditions. Extensive evaluation of eight state-of-the-art LLMs reveals that all models exhibit average vulnerability rates exceeding 56\% across risk scenarios. We further demonstrate that security-aware prompting can substantially mitigate these risks, achieving up to 45\% improvement.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。