Advancements in Secure Code Generation and Analysis with Large Language Models

The field of secure code generation and analysis is rapidly advancing with the integration of Large Language Models (LLMs). Recent developments have focused on improving the security and reliability of LLMs in various applications, including code review, bug bisection, and patch backporting. Notably, researchers have proposed novel approaches to detect price manipulation vulnerabilities in DeFi smart contracts and to synthesize invariants for smart contract security. Additionally, there is a growing interest in evaluating and mitigating security vulnerabilities in AI-generated code. Overall, the field is moving towards more secure and reliable code generation and analysis techniques, leveraging the capabilities of LLMs. Noteworthy papers include: REx86, which presents a local LLM for assisting in x86 assembly reverse engineering, achieving state-of-the-art results. LLM-Powered Detection of Price Manipulation in DeFi, which proposes a hybrid framework for detecting price manipulation vulnerabilities in DeFi smart contracts, achieving 88% precision and 90% recall. FLAMES, which presents a novel approach to synthesize executable runtime guards for smart contract security, achieving 96.7% compilability and preventing 20.4% of real exploits. PortGPT, which introduces an LLM-agent for automated patch backporting, achieving an 89.15% success rate on existing datasets. Is Your Prompt Poisoning Code, which investigates the impact of prompt quality on the security of generated code and proposes advanced prompting techniques to mitigate security risks. LLMBisect, which proposes a comprehensive multi-stage pipeline for bug bisection, achieving significantly better accuracy than state-of-the-art solutions. SecureReviewer, which enhances LLMs for secure code review through secure-aware fine-tuning, outperforming state-of-the-art baselines in security issue detection accuracy and generated review comment quality.

Sources

REx86: A Local Large Language Model for Assisting in x86 Assembly Reverse Engineering

LLM-Powered Detection of Price Manipulation in DeFi

FLAMES: Fine-tuning LLMs to Synthesize Invariants for Smart Contract Security

PortGPT: Towards Automated Backporting Using Large Language Models

Is Your Prompt Poisoning Code? Defect Induction Rates and Security Mitigation Strategies

Formal Verification of a Token Sale Launchpad: A Compositional Approach in Dafny

Secure Retrieval-Augmented Generation against Poisoning Attacks

LLMBisect: Breaking Barriers in Bug Bisection with A Comparative Analysis Pipeline

Security Vulnerabilities in AI-Generated Code: A Large-Scale Analysis of Public GitHub Repositories

SecureReviewer: Enhancing Large Language Models for Secure Code Review through Secure-aware Fine-tuning

Using Copilot Agent Mode to Automate Library Migration: A Quantitative Assessment

Built with on top of