Examining Zero-Shot Vulnerability Repair with Large Language Models

By Hammond A. Pearce, Benjamin Tan, Baleegh Ahmad, Ramesh Karri, Brendan Dolan-Gavitt. 2021

339 citations recorded by the source corpus.

Human developers can produce code with cybersecurity bugs. Can emerging ‘smart’ code completion tools help repair those bugs? In this work, we examine the use of large language models (LLMs) for code (such as OpenAI’s Codex and AI21’s Jurassic J-1) for zero-shot vulnerability repair. We investigate challenges in the design of prompts that coax LLMs into generating repaired versions of insecure code. This is difficult due to the numerous ways to phrase key information— both semantically and syntactically—with natural languages. We perform a large scale study of five commercially available, black-box, "off-the-shelf" LLMs, as well as an open-source model and our own locally-trained model, on a mix of synthetic, hand-crafted, and real-world security bug scenarios. Our experiments demonstrate that while the approach has promise (the LLMs could collectively repair 100% of our synthetically generated and hand-crafted scenarios), a qualitative evaluation of the model’s performance over a corpus of historical real-world examples highlights challenges in generating functionally correct code.

Subfields: Software, Large Language Models, Code Generation & Program Synthesis, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Software

In Large Language Models

In Code Generation & Program Synthesis

In Signal Processing

Citations in the corpus

Lost at C: A User Study on the Security Implications of Large Language Model Code Assistants (2022, background): “That said, LLMs may also generate secure code as a replacement for insecure code [27] (i.”
Software Testing With Large Language Models: Survey, Landscape, and Vision (2023, neutral): “1 Unit test generation Unit Test Case Generation with Transformers and Focal Context 2021 [24] 2 Unit test generation CodeT: Code Generation with Generated Tests 2022 [25] 3 Unit test generation Interactive Code Generation via Test Driven User Intent Formalization 2022 [26] 4 Unit test generation A3”
Large Language Models for Software Engineering: Survey and Open Problems (2023, background): “[148] reported repair results from five commercial LLMs on security bugs, Charalambous et al.”
LLMSecEval: A Dataset of Natural Language Prompts for Security Evaluations (2023, neutral): “The same code scenarios were used as a base in another work [13] to explore the ability of LLMs to ﬁx bugs in vulnerable code.”