From Vulnerabilities to Remediation: A Systematic Literature Review of LLMs in Code Security

2024/12/19 by Enna Basic, Alberto Giaretta, Basic, Enna +1 · 3 citations
Computer Science · #Artificial Intelligence (cs.AI) #Computation and Language (cs.CL) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Software Engineering Research

paper · pdf · doi:10.48550/arxiv.2412.15004

openalex publication_date 2024/12/19 · openalex created_date 2024/12/21 · openalex updated_date 2026/07/28

Abstract

Large Language Models (LLMs) have emerged as powerful tools for automating programming tasks, including security-related ones. However, they can also introduce vulnerabilities during code generation, fail to detect existing vulnerabilities, or report nonexistent ones. This systematic literature review investigates the security benefits and drawbacks of using LLMs for code-related tasks. In particular, it focuses on the types of vulnerabilities introduced by LLMs when generating code. Moreover, it analyzes the capabilities of LLMs to detect and fix vulnerabilities, and examines how prompting strategies impact these tasks. Finally, it examines how data poisoning attacks impact LLMs performance in the aforementioned tasks.

Cited by

• Secure Code Generation at Scale with Reflexion
• LLM-Driven SAST-Genius: A Hybrid Static Analysis Framework for Comprehensive and Actionable Security
• Trust Me, I Know This Function: Hijacking LLM Static Analysis using Bias

Related

• LLMs Cannot Reliably Identify and Reason About Security Vulnerabilities (Yet?): A Comprehensive Evaluation, Framework, and Benchmarks
• Guiding AI to Fix Its Own Flaws: An Empirical Study on LLM-Driven Secure Code Generation
• From Model to Breach: Towards Actionable LLM-Generated Vulnerabilities Reporting
• Harnessing the Power of LLMs in Source Code Vulnerability Detection
• Understanding the Effectiveness of Large Language Models in Detecting Security Vulnerabilities