Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Do LLMs Provide Links to Code Similar to what they Generate? A Study with Gemini and Bing CoPilot

Daniele Bifolco, Pietro Cassieri, Giuseppe Scanniello, Massimiliano Di Penta, Fiorella Zampetti

TL;DR

This study investigates whether two LLM-based code assistants, Bing CoPilot and Gemini, provide reliable provenance through external links for code they generate. It combines manual link-content analysis with automated clone-detection and textual similarity across 175 Bing CoPilot and 173 Gemini queries drawn from CodeSearchNet tasks over six languages, yielding 1,520 links for evaluation. The results show a mix of relevant and irrelevant links, with Bing CoPilot offering more frequent and more relevant links than Gemini, yet overall provenance signals remain weak and noisy, highlighting licensing and trust concerns. The authors provide a replication dataset and argue for provenance-aware improvements in LLMs and development tools to help engineers assess code provenance and licensing risk.

Abstract

Large Language Models (LLMs) are currently used for various software development tasks, including generating code snippets to solve specific problems. Unlike reuse from the Web, LLMs are limited in providing provenance information about the generated code, which may have important trustworthiness and legal consequences. While LLM-based assistants may provide external links that are "related" to the generated code, we do not know how relevant such links are. This paper presents the findings of an empirical study assessing the extent to which 243 and 194 code snippets, across six programming languages, generated by Bing CoPilot and Google Gemini, likely originate from the links provided by these two LLM-based assistants. The study leverages automated code similarity assessments with thorough manual analysis. The study's findings indicate that the LLM-based assistants provide a mix of relevant and irrelevant links having a different nature. Specifically, although 66% of the links from Bing CoPilot and 28% from Google Gemini are relevant, LLMs-based assistants still suffer from serious "provenance debt".

Do LLMs Provide Links to Code Similar to what they Generate? A Study with Gemini and Bing CoPilot

TL;DR

This study investigates whether two LLM-based code assistants, Bing CoPilot and Gemini, provide reliable provenance through external links for code they generate. It combines manual link-content analysis with automated clone-detection and textual similarity across 175 Bing CoPilot and 173 Gemini queries drawn from CodeSearchNet tasks over six languages, yielding 1,520 links for evaluation. The results show a mix of relevant and irrelevant links, with Bing CoPilot offering more frequent and more relevant links than Gemini, yet overall provenance signals remain weak and noisy, highlighting licensing and trust concerns. The authors provide a replication dataset and argue for provenance-aware improvements in LLMs and development tools to help engineers assess code provenance and licensing risk.

Abstract

Large Language Models (LLMs) are currently used for various software development tasks, including generating code snippets to solve specific problems. Unlike reuse from the Web, LLMs are limited in providing provenance information about the generated code, which may have important trustworthiness and legal consequences. While LLM-based assistants may provide external links that are "related" to the generated code, we do not know how relevant such links are. This paper presents the findings of an empirical study assessing the extent to which 243 and 194 code snippets, across six programming languages, generated by Bing CoPilot and Google Gemini, likely originate from the links provided by these two LLM-based assistants. The study leverages automated code similarity assessments with thorough manual analysis. The study's findings indicate that the LLM-based assistants provide a mix of relevant and irrelevant links having a different nature. Specifically, although 66% of the links from Bing CoPilot and 28% from Google Gemini are relevant, LLMs-based assistants still suffer from serious "provenance debt".
Paper Structure (17 sections, 3 figures, 7 tables)

This paper contains 17 sections, 3 figures, 7 tables.

Table of Contents

  1. Introduction
  2. Study Design
  3. Study Context
  4. Step 1: Querying the LLM (and search engine)
  5. Step 2: Manual Analysis
  6. Step 3: Automated Similarity Analysis
  7. Analysis Methodology
  8. Study Results
  9. RQ$_1$: To what extent are LLM-based assistants able to provide links to external sources for code generation tasks?
  10. RQ$_2$: To what extent are the automatically generated code snippets "similar" to code snippets extracted from the LLM-provided links?
  11. Distilled Findings and Implications
  12. Threats to Validity
  13. Related Work
  14. Approaches and Studies About Code Provenance
  15. Code Search Approaches
  16. ...and 2 more sections

Figures (3)

  • Figure 1: Dataflow of the Study Design
  • Figure 2: Bing CoPilot: Cloning ratio and textual similarity
  • Figure 3: Gemini: Cloning ratio and textual similarity