AI 中文总结
研究开放语言模型中提示语法对安全代码生成的影响，采用解析器驱动方法生成句法变体并评估，发现特定句法元素及其位置影响代码安全性，为降低LLM辅助开发漏洞风险提供指导。
AI 中文摘要
大语言模型（LLMs）虽越来越多地用于源代码生成，但输出常存在安全漏洞。先前工作聚焦高级提示策略，忽视了细粒度句法变化对模型行为的显著影响，且多评估专有LLMs。本文研究提示的细粒度句法成分如何影响开放LLM生成代码的安全性。采用解析器驱动方法，系统生成安全相关代码生成提示的句法变体，并评估其对多个开放LLMs和编程语言代码安全的影响。结果表明特定句法元素及其在提示中的位置会持续影响生成不安全代码的可能性。这些发现将提示语法确定为具体的安全控制面，并为降低LLM辅助开发中的漏洞风险提供了可操作的指导。
英文摘要
Large Language Models (LLMs) are increasingly used for source code generation despite their outputs often exhibiting security vulnerabilities. Prior work shows that prompt engineering can mitigate such risks, yet (1) they focused on high-level prompting strategies, neglecting recent evidence that fine-grained syntactic variations can substantially alter model behavior; and (2) predominantly evaluate proprietary LLMs, limiting the applicability of their findings in industrial settings where self-hosted, open models are preferred for privacy, compliance, and deployment control. In this paper, we study how fine-grained syntactic constituents of prompts influence the security of open LLM-generated code. Using a parser-driven approach, we systematically generate syntactic variants of security-relevant code generation prompts and evaluate their impact on code security across multiple open LLMs and programming languages. Our results show that specific syntactic elements, such as constraints, guards, conditions, and concept bindings, and their position within the prompt consistently affect the likelihood of generating insecure code. These findings identify prompt syntax as a concrete security control surface and provide actionable guidance for reducing vulnerability risk in LLM-assisted development.
CommentsAccepted at ICSME 2026
