SecCodePLT: A Unified Platform for Evaluating the Security of Code GenAI
Existing works have established multiple benchmarks to highlight the security
risks associated with Code GenAI. These risks are primarily reflected in two
areas: a model potential to generate insecure code (insecure coding) and its
utility in cyberattacks (cyberattack helpfulness). While these benchmarks have
made significant strides, there remain opportunities for further improvement.
For instance, many current benchmarks tend to focus more on a model ability to
provide attack suggestions rather than its capacity to generate executable
attacks. Additionally, most benchmarks rely heavily on static evaluation
metrics, which may not be as precise as dynamic metrics such as passing test
cases. Conversely, expert-verified benchmarks, while offering high-quality
data, often operate at a smaller scale. To address these gaps, we develop
SecCodePLT, a unified and comprehensive evaluation platform for code GenAIs'
risks. For insecure code, we introduce a new methodology for data creation that
combines experts with automatic generation. Our methodology ensures the data
quality while enabling large-scale generation. We also associate samples with
test cases to conduct code-related dynamic evaluation. For cyberattack
helpfulness, we set up a real environment and construct samples to prompt a
model to generate actual attacks, along with dynamic metrics in our
environment. We conduct extensive experiments and show that SecCodePLT
outperforms the state-of-the-art (SOTA) benchmark CyberSecEval in security
relevance. Furthermore, it better identifies the security risks of SOTA models
in insecure coding and cyberattack helpfulness. Finally, we apply SecCodePLT to
the SOTA code agent, Cursor, and, for the first time, identify non-trivial
security risks in this advanced coding agent.
670f11460dd9c30426f5eb0a
Yu Yang
claimed_verified
2024-10-16T09:44:02.861Z
62f82e52870a3f98bbf9e302
https://cdn-avatars.huggingface.co/v1/production/uploads/62f82e52870a3f98bbf9e302/5pN3oNBouZWlYu-uKa7lA.jpeg
Yu Yang
user
yuyangy
670f11460dd9c30426f5eb0b
Yuzhou Nie
670f11460dd9c30426f5eb0c
Zhun Wang
670f11460dd9c30426f5eb0d
Yuheng Tang
670f11460dd9c30426f5eb0e
Wenbo Guo
670f11460dd9c30426f5eb0f
Bo Li
670f11460dd9c30426f5eb10
Dawn Song
SecCodePLT: A Unified Platform for Evaluating the Security of Code GenAI
Existing works have established multiple benchmarks to highlight the security
risks associated with Code GenAI. These risks are primarily reflected in two
areas: a model potential to generate insecure code (insecure coding) and its
utility in cyberattacks (cyberattack helpfulness). While these benchmarks have
made significant strides, there remain opportunities for further improvement.
For instance, many current benchmarks tend to focus more on a model ability to
provide attack suggestions rather than its capacity to generate executable
attacks. Additionally, most benchmarks rely heavily on static evaluation
metrics, which may not be as precise as dynamic metrics such as passing test
cases. Conversely, expert-verified benchmarks, while offering high-quality
data, often operate at a smaller scale. To address these gaps, we develop
SecCodePLT, a unified and comprehensive evaluation platform for code GenAIs'
risks. For insecure code, we introduce a new methodology for data creation that
combines experts with automatic generation. Our methodology ensures the data
quality while enabling large-scale generation. We also associate samples with
test cases to conduct code-related dynamic evaluation. For cyberattack
helpfulness, we set up a real environment and construct samples to prompt a
model to generate actual attacks, along with dynamic metrics in our
environment. We conduct extensive experiments and show that SecCodePLT
outperforms the state-of-the-art (SOTA) benchmark CyberSecEval in security
relevance. Furthermore, it better identifies the security risks of SOTA models
in insecure coding and cyberattack helpfulness. Finally, we apply SecCodePLT to
the SOTA code agent, Cursor, and, for the first time, identify non-trivial
security risks in this advanced coding agent.
A unified evaluation platform, SecCodePLT, assesses security risks in code generation models more comprehensively than existing benchmarks.
Code GenAI insecure coding cyberattack helpfulness SecCodePLT dynamic evaluation real environment test cases CyberSecEval security risks Cursor