在键盘上打手枪？评估GitHub Copilot代码贡献的安全性
Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributions
摘要：
人们对设计基于人工智能的系统以帮助人类设计计算系统（包括自动生成计算机代码的工具）的兴趣正在蓬勃发展。其中最值得注意的是第一个自我描述的“人工智能配对程序员”GitHub Copilot，这是一个在开源GitHub代码上训练的语言模型。然而，代码通常包含错误--因此，考虑到Copilot处理的大量未公开代码，语言模型肯定会从可利用的、有错误的代码中学习。这引起了人们对Copilot代码贡献的安全性的担忧。在这项工作中，我们系统地调查了可能导致GitHub Copilot推荐不安全代码的流行程度和条件。为了执行此分析，我们提示Copilot在与高风险CWE相关的场景中生成代码（例如来自MITRE的“Top 25”列表的那些）。我们将在三个不同的代码生成轴上探索Copilot的性能--研究它在给定弱点多样性、提示多样性和域多样性的情况下如何执行。我们总共制作了89个不同的场景供Copilot完成，生成了1，689个程序。其中，我们发现大约40%是脆弱的。
英文摘要：
There is burgeoning interest in designing AI-based systems to assist humans in designing computing systems, including tools that automatically generate computer code. The most notable of these comes in the form of the first self-described `AI pair programmer', GitHub Copilot, a language model trained over open-source GitHub code. However, code often contains bugs - and so, given the vast quantity of unvetted code that Copilot has processed, it is certain that the language model will have learned from exploitable, buggy code. This raises concerns on the security of Copilot's code contributions. In this work, we systematically investigate the prevalence and conditions that can cause GitHub Copilot to recommend insecure code. To perform this analysis we prompt Copilot to generate code in scenarios relevant to high-risk CWEs (e.g. those from MITRE's "Top 25" list). We explore Copilot's performance on three distinct code generation axes -- examining how it performs given diversity of weaknesses, diversity of prompts, and diversity of domains. In total, we produce 89 different scenarios for Copilot to complete, producing 1,689 programs. Of these, we found approximately 40% to be vulnerable.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
