These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
With the recent unprecedented advancements in Artificial Intelligence (AI)
computing, progress in Large Language Models (LLMs) is accelerating rapidly,
presenting challenges in establishing clear guidelines, particularly in the
field of security. That being said, we thoroughly identify and describe three
main technical challenges in the security and software engineering literature
that spans the entire LLM workflow, namely; \textbf{\textit{(i)}} Data
Collection and Labeling; \textbf{\textit{(ii)}} System Design and Learning; and
\textbf{\textit{(iii)}} Performance Evaluation. Building upon these challenges,
this paper introduces \texttt{SecRepair}, an instruction-based LLM system
designed to reliably \textit{identify}, \textit{describe}, and automatically
\textit{repair} vulnerable source code. Our system is accompanied by a list of
actionable guides on \textbf{\textit{(i)}} Data Preparation and Augmentation
Techniques; \textbf{\textit{(ii)}} Selecting and Adapting state-of-the-art LLM
Models; \textbf{\textit{(iii)}} Evaluation Procedures. \texttt{SecRepair} uses
a reinforcement learning-based fine-tuning with a semantic reward that caters
to the functionality and security aspects of the generated code. Our empirical
analysis shows that \texttt{SecRepair} achieves a \textit{12}\% improvement in
security code repair compared to other LLMs when trained using reinforcement
learning. Furthermore, we demonstrate the capabilities of \texttt{SecRepair} in
generating reliable, functional, and compilable security code repairs against
real-world test cases using automated evaluation metrics.