利用大语言模型增强源代码安全：揭示挑战并生成可靠修复
Enhancing Source Code Security with LLMs: Demystifying The Challenges and Generating Reliable Repairs
AI总结：
本文针对LLM在源代码安全修复中的全流程挑战，提出基于指令的SecRepair系统，结合强化学习与语义奖励，实现漏洞代码的可靠识别、描述与自动修复，并在安全修复性能上较其他LLM提升12%。
摘要：
随着人工智能（AI）计算领域近来取得前所未有的进展，大语言模型（LLMs）的发展正在迅速加速，这在制定明确指导方针方面带来了挑战，尤其是在安全领域。为此，我们深入识别并描述了贯穿整个LLM工作流程的安全与软件工程文献中的三大主要技术挑战，即：（i）数据收集与标注；（ii）系统设计与学习；以及（iii）性能评估。基于这些挑战，本文介绍了SecRepair，这是一个基于指令的LLM系统，旨在可靠地识别、描述并自动修复存在漏洞的源代码。我们的系统配套提供了一系列可操作的指南，涵盖：（i）数据准备与增强技术；（ii）选择与适配最先进的LLM模型；（iii）评估流程。SecRepair采用基于强化学习的微调方法，并引入一种兼顾生成代码功能性与安全性的语义奖励机制。我们的实证分析表明，与其他LLM相比，SecRepair在使用强化学习训练时，在安全代码修复方面实现了12%的提升。此外，我们通过自动化评估指标展示了SecRepair针对真实世界测试用例生成可靠、功能正确且可编译的安全代码修复的能力。
英文摘要：
With the recent unprecedented advancements in Artificial Intelligence (AI) computing, progress in Large Language Models (LLMs) is accelerating rapidly, presenting challenges in establishing clear guidelines, particularly in the field of security. That being said, we thoroughly identify and describe three main technical challenges in the security and software engineering literature that spans the entire LLM workflow, namely; \textbf{\textit{(i)}} Data Collection and Labeling; \textbf{\textit{(ii)}} System Design and Learning; and \textbf{\textit{(iii)}} Performance Evaluation. Building upon these challenges, this paper introduces \texttt{SecRepair}, an instruction-based LLM system designed to reliably \textit{identify}, \textit{describe}, and automatically \textit{repair} vulnerable source code. Our system is accompanied by a list of actionable guides on \textbf{\textit{(i)}} Data Preparation and Augmentation Techniques; \textbf{\textit{(ii)}} Selecting and Adapting state-of-the-art LLM Models; \textbf{\textit{(iii)}} Evaluation Procedures. \texttt{SecRepair} uses a reinforcement learning-based fine-tuning with a semantic reward that caters to the functionality and security aspects of the generated code. Our empirical analysis shows that \texttt{SecRepair} achieves a \textit{12}\% improvement in security code repair compared to other LLMs when trained using reinforcement learning. Furthermore, we demonstrate the capabilities of \texttt{SecRepair} in generating reliable, functional, and compilable security code repairs against real-world test cases using automated evaluation metrics.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
