These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
Large language models (LLMs) excel at generating code from natural language
instructions, yet they often lack an understanding of security vulnerabilities.
This limitation makes it difficult for LLMs to avoid security risks in
generated code, particularly in high-security programming tasks such as smart
contract development for blockchain. Researchers have attempted to enhance the
vulnerability awareness of these models by training them to differentiate
between vulnerable and fixed code snippets. However, this approach relies
heavily on manually labeled vulnerability data, which is only available for
popular languages like Python and C++. For low-resource languages like
Solidity, used in smart contracts, large-scale annotated datasets are scarce
and difficult to obtain. To address this challenge, we introduce CodeBC, a code
generation model specifically designed for generating secure smart contracts in
blockchain. CodeBC employs a three-stage fine-tuning approach based on
CodeLlama, distinguishing itself from previous methods by not relying on
pairwise vulnerability location annotations. Instead, it leverages
vulnerability and security tags to teach the model the differences between
vulnerable and secure code. During the inference phase, the model leverages
security tags to generate secure and robust code. Experimental results
demonstrate that CodeBC outperforms baseline models in terms of BLEU, CodeBLEU,
and compilation pass rates, while significantly reducing vulnerability rates.
These findings validate the effectiveness and cost-efficiency of our
three-stage fine-tuning strategy, making CodeBC a promising solution for
generating secure smart contract code.