[HN Gopher] Lost at C: A user study on the security of LLM codin...
       ___________________________________________________________________
        
       Lost at C: A user study on the security of LLM coding assistants
        
       Author : PaulHoule
       Score  : 15 points
       Date   : 2023-03-01 19:32 UTC (3 hours ago)
        
 (HTM) web link (arxiv.org)
 (TXT) w3m dump (arxiv.org)
        
       | [deleted]
        
       | dpflan wrote:
       | More: Do Users Write More Insecure Code with AI Assistants?
       | (https://arxiv.org/pdf/2211.03622.pdf)
       | 
       | More relevant discussion, from Andrew Ng's The Batch newsletter:
       | Check the Generated Code Generates Overconfident Coders section:
       | (https://www.deeplearning.ai/the-batch/issue-180/)
        
       | ducktective wrote:
       | Tangential but has it became popular to use titles for academic
       | papers like this: [a clever pun]: [generic short description]
       | 
       | I've seen a few AI papers that are like this. Like the "Attention
       | is all you need"
        
         | bee_rider wrote:
         | FWIW it isn't a new thing exactly.
         | 
         | https://slate.com/technology/2015/12/the-best-funny-clever-o...
         | 
         | They had an example from 2004 that I saw at least; but the
         | article is from 2015 and lots of their links have died, so
         | there might have been an older one. Anyway, 2004 is long enough
         | to not call this a new phenomenon, right?
        
           | saurik wrote:
           | This is just a popular format for titles in general, whatever
           | the medium / format / genre.
        
         | mattigames wrote:
         | At some point you have to accept that the likelihood of
         | something you wrote is read increases if you make it
         | entertaining even if just a tiny bit, yes even academics fall
         | for this trick, is usually not concious but academics are
         | humans too and some tricks like that help increase the
         | likelyhood to grab their attention, even subjects that they
         | already strongly believe are interesting to them.
        
       | mjburgess wrote:
       | > we tasked participants (student programmers) with implementing
       | a singly-linked 'shopping list' structure in C
       | 
       | Uhuh... does anyone think that LLM would actually impact this
       | case?
       | 
       | The LLM has likely been trained on thousands of "top-quality"
       | code examples covering exactly this data structure.
       | 
       | No one could plausibly regard LLMs as impairing a case of this
       | kind.
       | 
       | This seems quite silly.
        
         | IshKebab wrote:
         | You are right, this is a silly study. "...in students" is
         | pretty much the same as "...in mice".
         | 
         | I'm waiting for someone to conclude that code comments are
         | pointless because they make no difference to the ability of
         | students to implement fizzbuzz.
        
         | PaulHoule wrote:
         | Overall I think the safety problems get worse when the program
         | gets more complex. There's a big difference between getting a
         | 100 line program right and getting a 20,000 line program right.
         | 
         | That said this is an underpowered study to really answer the
         | question. It reminds me a little of that Scott Alexander blog
         | post where he came to big conclusions based on 5 questions he
         | asked ChatGPT. However there is a definite industry of people
         | who write papers where they ask ChatGPT some questions and
         | evaluate the replies.
        
       ___________________________________________________________________
       (page generated 2023-03-01 23:01 UTC)