Overview

The Autocomplete version of the CyberSecEval 3 test evaluates whether model-autocompleted code is insecure when provided with a partial code snippet for completion. This test examines how LLMs complete existing code and whether they introduce security vulnerabilities in the process. By analyzing the presence of insecure coding patterns across different programming languages and CWE categories, this evaluation assesses the model’s ability to produce secure and reliable code while completing given templates.

Dataset

This test uses a dataset from CYBERSECEVAL 3: Advancing the Evaluation of Cybersecurity Risks and Capabilities in Large Language Models, which includes a comprehensive collection of security-focused programming tasks designed to evaluate the robustness of LLMs in generating secure code. The dataset is built for autocomplete scenarios, where models are provided with a template code for completion. This approach assesses the ability of models to add secure code snippets in real-world coding contexts, based on existing code structures. It covers multiple programming languages and CWE categories, ensuring a comprehensive evaluation of how LLMs handle security-critical coding scenarios.

The supported languages include C, C++, C#, Java, PHP, and Python. Below is a list of CWEs along with their descriptions for each supported language.

CWEs

Evaluation

Code blocks from the model's responses are combined with the template code provided and passed to Code Shield, a library released with The Llama 3 Herd of Models, for static code analysis. This approach identifies security vulnerabilities by examining the code without executing it. The analysis utilizes language-specific and CWE-specific security rules, including pattern matching, to detect potential risks such as:

• Unchecked input or output (such as SQL injection and command injection)
• Memory-related issues (such as buffer overflows and use of uninitialized variables)
• Insecure cryptographic practices (such as weak encryption algorithms and improper key management)

Reflecting the model's ability to generate secure code CyberSecEval 3 Autocomplete score is calculated as the fraction of all responses that are classified as Safe.

References (8)