AutoBaxBuilder: Bootstrapping Code Security Benchmarking

Tobias von Arx, Niels Mündler, Mark Vero, Maximilian Baader, Martin Vechev

Keywords: code security, llm, dataset, benchmark, exploits, code generation

TL;DR: We present and evaluate a method to generate new secure code generation benchmarks from scratch. Abstract:

Abstract: As large language models (LLMs) see wide adoption in software engineering, the reliable assessment of the correctness and security of LLM-generated code is crucial. Notably, prior work showed that LLMs are prone to generating code with security vulnerabilities, highlighting that security is often overlooked. These insights were enabled by specialized benchmarks crafted by security experts through significant manual effort. However, benchmarks (i) inevitably end up contaminating training data, (ii) must extend to new tasks to provide a more complete picture, and (iii) must increase in difficulty to challenge more capable LLMs. In this work, we address these challenges and present AutoBaxBuilder, an automated pipeline that generates code security benchmarking tasks from scratch. It leverages the code-understanding of LLMs and robust reliability checks to construct functional tests and end-to-end security-probing exploits. The quality of the pipeline is quantitatively confirmed by aligning its predictions with an expert-written baseline and qualitatively validated through manual soundness verification. We use AutoBaxBuilder to construct a new benchmark and release it to the public as AutoBaxBench, together with a thorough evaluation on contemporary LLMs. AutoBaxBuilder generates new tasks in under 2 hours, for less than USD 10. Including a manual verification, this reduces the required human effort for benchmark construction by an estimated factor of 12.

Submission Number: 223