CIPHER: 通过响应混合评估进行密码学不安全性分析
CIPHER: Cryptographic Insecurity Profiling via Hybrid Evaluation of Responses
AI总结：
CIPHER通过混合评估响应的方法，评估LLM生成代码中的密码学漏洞，发现安全提示能减少部分问题但无法彻底消除漏洞。
摘要：
大型语言模型（LLMs）越来越多地被用于帮助开发人员编写代码，但它们在实现加密功能时往往包含可被利用的漏洞。细微的设计选择（例如静态初始化向量或缺少认证）可以默默地使安全保证失效。我们介绍了CIPHER（通过响应混合评估进行密码学不安全性分析），这是一个用于测量LLM生成的Python代码中密码学漏洞发生率的基准，在受控的安全指导条件下。CIPHER使用针对每个任务的不安全/中性/安全提示变体、密码学特定的漏洞分类学，以及通过自动化评分管道进行的行级归因。在广泛使用的多种LLM上，我们发现明确的安全提示可以减少某些针对性问题，但并不能可靠地消除密码学漏洞整体。该基准和可重复的评分管道将在发表时公开发布。
英文摘要：
Large language models (LLMs) are increasingly used to assist developers with code, yet their implementations of cryptographic functionality often contain exploitable flaws. Minor design choices (e.g., static initialization vectors or missing authentication) can silently invalidate security guarantees. We introduce CIPHER(Cryptographic Insecurity Profiling via Hybrid Evaluation of Responses), a benchmark for measuring cryptographic vulnerability incidence in LLM-generated Python code under controlled security-guidance conditions. CIPHER uses insecure/neutral/secure prompt variants per task, a cryptography-specific vulnerability taxonomy, and line-level attribution via an automated scoring pipeline. Across a diverse set of widely used LLMs, we find that explicit secure prompting reduces some targeted issues but does not reliably eliminate cryptographic vulnerabilities overall. The benchmark and reproducible scoring pipeline will be publicly released upon publication.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
