Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

TOSSS: a CVE-based Software Security Benchmark for Large Language Models

Marc Damie, Murat Bilgehan Ertan, Domenico Essoussi, Angela Makhanu, Gaëtan Peter, Roos Wensveen

TL;DR

This work introduces TOSSS (Two-Option Secure Snippet Selection), a benchmark that measures the ability of LLMs to choose between secure and vulnerable code snippets and evaluates 14 widely used open-source and closed-source models on C/C++ and Java code.

Abstract

With their increasing capabilities, Large Language Models (LLMs) are now used across many industries. They have become useful tools for software engineers and support a wide range of development tasks. As LLMs are increasingly used in software development workflows, a critical question arises: are LLMs good at software security? At the same time, organizations worldwide invest heavily in cybersecurity to reduce exposure to disruptive attacks. The integration of LLMs into software engineering workflows may introduce new vulnerabilities and weaken existing security efforts. We introduce TOSSS (Two-Option Secure Snippet Selection), a benchmark that measures the ability of LLMs to choose between secure and vulnerable code snippets. Existing security benchmarks for LLMs cover only a limited range of vulnerabilities. In contrast, TOSSS relies on the CVE database and provides an extensible framework that can integrate newly disclosed vulnerabilities over time. Our benchmark gives each model a security score between 0 and 1 based on its behavior; a score of 1 indicates that the model always selects the secure snippet, while a score of 0 indicates that it always selects the vulnerable one. We evaluate 14 widely used open-source and closed-source models on C/C++ and Java code and observe scores ranging from 0.48 to 0.89. LLM providers already publish many benchmark scores for their models, and TOSSS could become a complementary security-focused score to include in these reports.

TOSSS: a CVE-based Software Security Benchmark for Large Language Models

TL;DR

This work introduces TOSSS (Two-Option Secure Snippet Selection), a benchmark that measures the ability of LLMs to choose between secure and vulnerable code snippets and evaluates 14 widely used open-source and closed-source models on C/C++ and Java code.

Abstract

With their increasing capabilities, Large Language Models (LLMs) are now used across many industries. They have become useful tools for software engineers and support a wide range of development tasks. As LLMs are increasingly used in software development workflows, a critical question arises: are LLMs good at software security? At the same time, organizations worldwide invest heavily in cybersecurity to reduce exposure to disruptive attacks. The integration of LLMs into software engineering workflows may introduce new vulnerabilities and weaken existing security efforts. We introduce TOSSS (Two-Option Secure Snippet Selection), a benchmark that measures the ability of LLMs to choose between secure and vulnerable code snippets. Existing security benchmarks for LLMs cover only a limited range of vulnerabilities. In contrast, TOSSS relies on the CVE database and provides an extensible framework that can integrate newly disclosed vulnerabilities over time. Our benchmark gives each model a security score between 0 and 1 based on its behavior; a score of 1 indicates that the model always selects the secure snippet, while a score of 0 indicates that it always selects the vulnerable one. We evaluate 14 widely used open-source and closed-source models on C/C++ and Java code and observe scores ranging from 0.48 to 0.89. LLM providers already publish many benchmark scores for their models, and TOSSS could become a complementary security-focused score to include in these reports.
Paper Structure (26 sections, 4 figures, 2 tables)

This paper contains 26 sections, 4 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Our contributions
  3. Related work
  4. LLM task
  5. Security evaluation
  6. Test case generation
  7. Other works
  8. TOSSS, an Extensible Code Security Benchmark based on the CVE Database
  9. Our benchmark
  10. Building test cases
  11. Advantages of TOSSS
  12. Experimental results
  13. Setup
  14. Hintless
  15. With hint
  16. ...and 11 more sections

Figures (4)

  • Figure 1: Prompt used in the hintless TOSSS benchmark. The position of the secure and vulnerable snippets is randomly assigned between A and B.
  • Figure 2: Prompt used in the TOSSS benchmark with hint. The position of the secure and vulnerable snippets is randomly assigned between A and B.
  • Figure 3: Pipeline of the TOSSS benchmark
  • Figure 4: Code snippets from the MiniUPnP codebase before and after the fix of CVE-2019-12111, which caused Denial of Service attacks due to a NULL pointer dereference.