LLMSecEval: A Dataset of Natural Language Prompts for Security Evaluations

By Catherine Tony, Markus Mutas, Nicolás E. Díaz Ferreyra, Riccardo Scandariato. 2023

118 citations recorded by the source corpus.

Large Language Models (LLMs) like Codex are powerful tools for performing code completion and code generation tasks as they are trained on billions of lines of code from publicly available sources. Moreover, these models are capable of generating code snippets from Natural Language (NL) descriptions by learning languages and programming practices from public GitHub repositories. Although LLMs promise an effortless NL-driven deployment of software applications, the security of the code they generate has not been extensively investigated nor documented. In this work, we present LLMSecEval, a dataset containing 150 NL prompts that can be leveraged for assessing the security performance of such models. Such prompts are NL descriptions of code snippets prone to various security vulnerabilities listed in MITRE’s Top 25 Common Weakness Enumeration (CWE) ranking. Each prompt in our dataset comes with a secure implementation example to facilitate comparative evaluations against code produced by LLMs. As a practical application, we show how LLMSecEval can be used for evaluating the security of snippets automatically generated from NL descriptions.

Subfields: Artificial Intelligence, Information Systems, Large Language Models, Evaluation & Benchmarks, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In Large Language Models

In Evaluation & Benchmarks

In Safety, Robustness & Interpretability

Citations in the corpus

LiveCodeBench: Holistic and Contamination Free Evaluation of Large Language Models for Code (2024, background): “…(LeClair et al., 2019; Iyer et al., 2016; Barone and Sennrich, 2017; Hasan et al., 2021; Alon et al., 2018), code security (Liguori et al., 2022; Pearce et al., 2022; Tony et al., 2023), etc. 2023) demonstrated contamination by simply prompting the model to highlight its contamination.”
NoFunEval: Funny How Code LMs Falter on Requirements Beyond Functional Correctness (2024, methodology): “LLMSecEval (Tony et al., 2023) is another similar effort focused on evaluating LM-generated code for prompts particularly prone to security vulnerabilities.”
CoQuIR: A Comprehensive Benchmark for Code Quality-Aware Information Retrieval (2025, unknown): “LLMSecEval [40], SecurityEval [41] py, java, c, cpp, js, go, rb, rs, swift, ts 492 60293 Maintainablity DepreAPI [13] py 145 2590”