Demo: SGCode: A Flexible Prompt-Optimizing System for Secure Generation of Code

Document Type

Conference Proceeding

Publication Date

12-9-2024

Abstract

This paper introduces SGCode, a flexible prompt-optimizing system to generate secure code with large language models (LLMs). SGCode integrates recent prompt-optimization approaches with LLMs in a unified system accessible through front-end and back-end APIs, enabling users to 1) generate secure code, which is free of vulnerabilities, 2) review and share security analysis, and 3) easily switch from one prompt optimization approach to another, while providing insights on model and system performance. We populated SGCode on an AWS server with PromSec, an approach that optimizes prompts by combining an LLM and security tools with a lightweight generative adversarial graph neural network to detect and fix security vulnerabilities in the generated code. Extensive experiments show that SGCode is practical as a public tool to gain insights into the trade-offs between model utility, secure code generation, and system cost. SGCode has only a marginal cost compared with prompting LLMs. SGCode is available at: SGCode.

Identifier

85215510203 (Scopus)

ISBN

[9798400706363]

Publication Title

CCS 2024 - Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security

External Full Text Location

https://doi.org/10.1145/3658644.3691367

First Page

5078

Last Page

5080

Grant

CNS-1935928

Fund Ref

National Science Foundation

This document is currently not available here.

Share

COinS