Large Language Models and Simple, Stupid Bugs

2023/03/20 by Kevin Jesse, Toufique Ahmed, Jesse, Kevin +6 · 1 voice · 16 citations
Computer Science · #Adversarial Robustness in Machine Learning #Software Engineering Research #Software Reliability and Analysis Research #cs.CL #cs.LG #cs.SE

paper · pdf · doi:10.48550/arxiv.2303.11455

Abstract

With the advent of powerful neural language models, AI-based systems to assist developers in coding tasks are becoming widely available; Copilot is one such system. Copilot uses Codex, a large language model (LLM), to complete code conditioned on a preceding "prompt". Codex, however, is trained on public GitHub repositories, viz., on code that may include bugs and vulnerabilities. Previous studies [1], [2] show Codex reproduces vulnerabilities seen in training. In this study, we examine how prone Codex is to generate an interesting bug category, single statement bugs, commonly referred to as simple, stupid bugs or SStuBs in the MSR community. We find that Codex and similar LLMs do help avoid some SStuBs, but do produce known, verbatim SStuBs as much as 2x as likely than known, verbatim correct code. We explore the consequences of the Codex generated SStuBs and propose avoidance strategies that suggest the possibility of reducing the production of known, verbatim SStubs, and increase the possibility of producing known, verbatim fixes.

Cited by

• Anka: A Domain-Specific Language for Reliable LLM Code Generation
• Multicalibration for LLM-based Code Generation
• Open the Oyster: Empirical Evaluation and Improvement of Code Reasoning Confidence in LLMs
• Model-Agnostic Correctness Assessment for LLM-Generated Code via Dynamic Internal Representation Selection
• Investigating Security Implications of Automatically Generated Code on the Software Supply Chain
• Evaluating the Limitations of Local LLMs in Solving Complex Programming Challenges
• Stack Overflow Is Not Dead Yet: Crowd Answers Still Matter
• Guidelines for Empirical Studies in Software Engineering involving Large Language Models
• Analyzing Prominent LLMs: An Empirical Study of Performance and Complexity in Solving LeetCode Problems
• MultiAIGCD: A Comprehensive dataset for AI Generated Code Detection Covering Multiple Languages, Models,Prompts, and Scenarios
• Are They All Good? Evaluating the Quality of CoTs in LLM-based Code Generation
• Evaluating Efficiency and Novelty of LLM-Generated Code for Graph Analysis
• Automatic Programming: Large Language Models and Beyond
• What Breaks When LLMs Code? Characterizing Operational Safety Failures of Agentic Code Assistants
• Hallucination by Code Generation LLMs: Taxonomy, Benchmarks, Mitigation, and Challenges
• MigGPT: Harnessing Large Language Models for Automated Migration of Out-of-Tree Linux Kernel Patches Across Versions

Discussions

• Large Language Models and Simple, Stupid Bugs [hn, 2 points, 0 comments]

Related

• Bugs in Large Language Models Generated Code: An Empirical Study
• Large Language Models of Code Fail at Completing Code with Potential Bugs
• Security Weaknesses of Copilot-Generated Code in GitHub Projects: An Empirical Study
• Is GitHub's Copilot as Bad as Humans at Introducing Vulnerabilities in Code?
• Codexity: Secure AI-assisted Code Generation