https://arxiv.org/abs/2208.09727

close this message
arXiv smileybones icon

Global Survey

In just 3 minutes help us understand how you see arXiv.

TAKE SURVEY
Skip to main content
Cornell University
We gratefully acknowledge support from
the Simons Foundation and member institutions.
 
arxiv logo > cs > arXiv:2208.09727
[                    ]

Help | Advanced Search

[All fields        ]
Search
arXiv logo
Cornell University Logo
[                    ] GO
quick links

  * Login
  * Help Pages
  * About

Computer Science > Cryptography and Security

arXiv:2208.09727 (cs)
[Submitted on 20 Aug 2022 (v1), last revised 27 Feb 2023 (this
version, v4)]

Title:Lost at C: A User Study on the Security Implications of Large
Language Model Code Assistants

Authors:Gustavo Sandoval, Hammond Pearce, Teo Nys, Ramesh Karri,
Siddharth Garg, Brendan Dolan-Gavitt
Download PDF

    Abstract: Large Language Models (LLMs) such as OpenAI Codex are
    increasingly being used as AI-based coding assistants.
    Understanding the impact of these tools on developers' code is
    paramount, especially as recent work showed that LLMs may suggest
    cybersecurity vulnerabilities. We conduct a security-driven user
    study (N=58) to assess code written by student programmers when
    assisted by LLMs. Given the potential severity of low-level bugs
    as well as their relative frequency in real-world projects, we
    tasked participants with implementing a singly-linked 'shopping
    list' structure in C. Our results indicate that the security
    impact in this setting (low-level C with pointer and array
    manipulations) is small: AI-assisted users produce critical
    security bugs at a rate no greater than 10% more than the
    control, indicating the use of LLMs does not introduce new
    security risks.

          Accepted for publication in USENIX'23. For associated
Comments: dataset see this https URL. 18 pages, 12 figures. G.
          Sandoval and H. Pearce contributed equally to this work
Subjects: Cryptography and Security (cs.CR)
Cite as:  arXiv:2208.09727 [cs.CR]
          (or arXiv:2208.09727v4 [cs.CR] for this version)
          https://doi.org/10.48550/arXiv.2208.09727
          Focus to learn more
          arXiv-issued DOI via DataCite

Submission history

From: Hammond Pearce [view email]
[v1] Sat, 20 Aug 2022 17:58:40 UTC (1,302 KB)
[v2] Mon, 3 Oct 2022 20:19:44 UTC (1,302 KB)
[v3] Thu, 17 Nov 2022 21:36:40 UTC (1,742 KB)
[v4] Mon, 27 Feb 2023 18:52:59 UTC (556 KB)
Full-text links:

Download:

  * PDF
  * Other formats

(license)
Current browse context:
cs.CR
< prev   |   next >
new | recent | 2208
Change to browse by:
cs

References & Citations

  * NASA ADS
  * Google Scholar
  * Semantic Scholar

a export bibtex citation Loading...

Bibtex formatted citation

x
[loading...          ]
Data provided by:

Bookmark

BibSonomy logo Mendeley logo Reddit logo ScienceWISE logo
(*) Bibliographic Tools

Bibliographic and Citation Tools

[ ] Bibliographic Explorer Toggle
Bibliographic Explorer (What is the Explorer?)
[ ] Litmaps Toggle
Litmaps (What is Litmaps?)
[ ] scite.ai Toggle
scite Smart Citations (What are Smart Citations?)
( ) Code, Data, Media

Code, Data and Media Associated with this Article

[ ] Links to Code Toggle
Papers with Code (What is Papers with Code?)
[ ] ScienceCast Toggle
ScienceCast (What is ScienceCast?)
( ) Demos

Demos

[ ] Replicate Toggle
Replicate (What is Replicate?)
[ ] Spaces Toggle
Hugging Face Spaces (What is Spaces?)
( ) Related Papers

Recommenders and Search Tools

[ ] Connected Papers Toggle
Connected Papers (What is Connected Papers?)
[ ] Core recommender toggle
CORE Recommender (What is CORE?)
( ) About arXivLabs

arXivLabs: experimental projects with community collaborators

arXivLabs is a framework that allows collaborators to develop and
share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have
embraced and accepted our values of openness, community, excellence,
and user data privacy. arXiv is committed to these values and only
works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community?
Learn more about arXivLabs.

Which authors of this paper are endorsers? | Disable MathJax (What is
MathJax?)

  * About
  * Help

  * Click here to contact arXiv Contact
  * Click here to subscribe Subscribe

  * Copyright
  * Privacy Policy

  * Web Accessibility Assistance
  * arXiv Operational Status
    Get status notifications via email or slack