微调大型语言模型以实现安全代码生成的探索性研究
An Exploratory Study on Fine-Tuning Large Language Models for Secure Code Generation
AI总结：
本文研究用漏洞修复提交微调代码 LLM，比较全量微调、LoRA、IA3 与提示方法，发现 PEFT 尤其 LoRA 可提升 C/C++ 安全生成，函数级和块级数据效果最佳。
摘要：
诸如 GitHub Copilot 和 OpenAI ChatGPT 等由 AI 驱动的编程助手已在自动化代码生成方面取得显著成功。然而，这些工具依赖预训练的大型语言模型（LLM），而这些模型通常基于从 GitHub 等开源项目托管网站获取的人工编写代码进行训练，这些代码往往包含固有安全漏洞。近期实证研究揭示并强调了一个关键风险：这些漏洞随后可能被 LLM 生成的代码所复制。在本工作中，我们开展了一项探索性研究，考察在漏洞修复提交数据集上微调预训练 LLM 是否能够促进安全代码生成。我们在四个用于代码生成的预训练 LLM 上探索了全量微调以及两种参数高效微调技术（LoRA 和 IA3）。我们通过从开源仓库收集已确认漏洞的代码修复，爬取了一个用于安全代码生成的微调数据集（14,622 个 C/C++ 文件）。我们的评估数据集包含 52 个漏洞场景，旨在覆盖最危险的 C/C++ CWE。我们的探索表明，使用 PEFT 技术微调 LLM 可以增强安全代码生成。我们观察到，C 语言和 C++ 语言在安全性方面的最大提升分别为 6.4% 和 5.0%。此外，我们比较了微调方法与基于提示的方法。经 LoRA 微调的模型在安全代码生成方面优于基于提示的方法。我们发现，与备选粒度（文件级和行级）相比，使用函数级和块级数据集进行微调可取得最佳的安全代码生成性能。
英文摘要：
AI-powered coding assistants such as GitHub's Copilot and OpenAI's ChatGPT have achieved notable success in automating code generation. However, these tools rely on pre-trained Large Language Models (LLMs) that are typically trained on human-written code sourced from open-source project hosting sites like GitHub, which often contains inherent security vulnerabilities. These vulnerabilities may then be mirrored in the code generated by these LLMs, a critical risk revealed and highlighted by recent empirical studies. In this work, we present an exploratory study on whether fine-tuning pre-trained LLMs on datasets of vulnerability-fixing commits can promote secure code generation. We explored full fine-tuning and two parameter-efficient fine-tuning techniques (LoRA and IA3) on four pre-trained LLMs for code generation. We crawled a fine-tuning dataset (14,622 C/C++ files) for secure code generation by collecting code fixes of confirmed vulnerabilities from open-source repositories. Our evaluation dataset comprises 52 vulnerability scenarios designed to cover the top most dangerous C/C++ CWEs. Our exploration reveals that fine-tuning LLMs using PEFT techniques can enhance secure code generation. We observe maximum improvements in security of 6.4% in C language and 5.0% in C++ language. In addition, we compared between the fine-tuning approaches and the prompt-based approaches. The LoRA-tuned models outperform the prompt-based approaches in secure code generation. We found that fine-tuning with function-level and block-level datasets achieves the best secure code generation performance, compared to the alternatives (file-level and line-level).
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
