Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Does Teaming-Up LLMs Improve Secure Code Generation? A Comprehensive Evaluation with Multi-LLMSecCodeEval

Bushra Sabir, Shigang Liu, Seung Ick Jang, Sharif Abuadbba, Yansong Gao, Kristen Moore, SangCheol Kim, Hyoungshick Kim, Surya Nepal

Abstract

Automatically generating source code from natural language using large language models (LLMs) is becoming common, yet security vulnerabilities persist despite advances in fine tuning and prompting. In this work, we systematically evaluate whether multi LLM ensembles and collaborative strategies can meaningfully improve secure code generation. We present MULTI-LLMSECCODEEVAL, a framework for assessing and enhancing security across the vulnerability management lifecycle by combining multiple LLMs with static analysis and structured collaboration. Using SecLLMEval and SecLLMHolmes, we benchmark ten pipelines spanning single model, ensemble, collaborative, and hybrid designs. Our results show that ensemble pipelines augmented with static analysis improve secure code generation over single LLM baselines by up to 47.3% on SecLLMEval and 19.3% on SecLLMHolmes, while purely LLM based collaborative pipelines yield smaller gains of 8.9% to 22.3%. Hybrid pipelines that integrate ensembling, detection, and patching achieve the strongest security performance, outperforming the best ensemble baseline by 1.78% to 4.72% and collaborative baselines by 19.81% to 26.78%. Ablation studies reveal that model scale alone does not ensure security. Smaller, structured multi model ensembles consistently outperform large monolithic LLMs. Overall, our findings demonstrate that secure code does not emerge from scale, but from carefully orchestrated multi model system design.

Does Teaming-Up LLMs Improve Secure Code Generation? A Comprehensive Evaluation with Multi-LLMSecCodeEval

Abstract

Automatically generating source code from natural language using large language models (LLMs) is becoming common, yet security vulnerabilities persist despite advances in fine tuning and prompting. In this work, we systematically evaluate whether multi LLM ensembles and collaborative strategies can meaningfully improve secure code generation. We present MULTI-LLMSECCODEEVAL, a framework for assessing and enhancing security across the vulnerability management lifecycle by combining multiple LLMs with static analysis and structured collaboration. Using SecLLMEval and SecLLMHolmes, we benchmark ten pipelines spanning single model, ensemble, collaborative, and hybrid designs. Our results show that ensemble pipelines augmented with static analysis improve secure code generation over single LLM baselines by up to 47.3% on SecLLMEval and 19.3% on SecLLMHolmes, while purely LLM based collaborative pipelines yield smaller gains of 8.9% to 22.3%. Hybrid pipelines that integrate ensembling, detection, and patching achieve the strongest security performance, outperforming the best ensemble baseline by 1.78% to 4.72% and collaborative baselines by 19.81% to 26.78%. Ablation studies reveal that model scale alone does not ensure security. Smaller, structured multi model ensembles consistently outperform large monolithic LLMs. Overall, our findings demonstrate that secure code does not emerge from scale, but from carefully orchestrated multi model system design.
Paper Structure (10 sections, 3 equations, 13 figures, 4 tables)

This paper contains 10 sections, 3 equations, 13 figures, 4 tables.

Table of Contents

  1. Introduction
  2. Motivation Example
  3. Related Work
  4. Multi-LLMSecCodeEval
  5. Evaluation
  6. In-Depth Analysis
  7. Conclusion, Limitations, and Future Work
  8. Ethical Considerations
  9. Open Science
  10. Appendix

Figures (13)

  • Figure 1: Side-by-side comparison of LLM-generated C code for the same prompt, highlighting distinct model-specific vulnerabilities.
  • Figure 2: End-to-end architecture of MULTI-LLMSecCodeEval for secure code generation(Gen), vulnerability detection (Detect), and automated patching (Patch).
  • Figure 3: Overview of LLM-based pipelines for [Gen] refers to generated code, [Detect] refers to detection report, [Patch] refers to patched code. Each pipeline reflects a distinct coordination mechanism among LLMs, Static Analysis Tool (SAT).
  • Figure 4: Security analysis of code generated by single LLMs using CodeQL.
  • Figure 5: Vulnerability detection and patching capability of single LLMs.
  • ...and 8 more figures