Search papers, labs, and topics across Lattice.
This paper introduces a novel benchmark dataset of runnable web applications with functional and security tests to evaluate Detect-Repair-Verify (DRV) pipelines for securing LLM-generated code at the project level. The study empirically compares generation-only, single-pass DRV, and iterative DRV approaches, assessing their secure and correct yield using test-grounded verification across three prompt granularities. Results show that iterative DRV improves security and correctness but also reveals challenges related to report actionability and post-repair failure modes like regressions and semantic drift.
LLM-generated code can be significantly hardened against security vulnerabilities using iterative Detect-Repair-Verify loops, but watch out for regressions and semantic drift.
Large language models are increasingly used to produce runnable software. In practice, security is often addressed through a Detect--Repair--Verify (DRV) loop that detects issues, applies fixes, and verifies the result. This work studies such a workflow for project-level artifacts and addresses four gaps: L1, the lack of project-level benchmarks with executable function and security tests; L2, limited evidence on pipeline-level effectiveness beyond studying detection or repair alone; L3, unclear reliability of detection reports as repair guidance; and L4, uncertain repair trustworthiness and side effects under verification. A new benchmark dataset\footnote{https://github.com/Hahappyppy2024/EmpricalVDR} is introduced, consisting of runnable web-application projects paired with functional tests and targeted security tests, and supporting three prompt granularities at the project, requirement, and function level. The evaluation compares generation-only, single-pass DRV, and bounded iterative DRV variants under comparable budget constraints. Outcomes are measured by secure and correct yield using test-grounded verification, and intermediate artifacts are analyzed to assess report actionability and post-repair failure modes such as regressions, semantic drift, and newly introduced security issues.
