Adversarial Testing of Automated Program Repair Agents for Security Vulnerabilities
[Kryptografia i bezpieczeństwo] Autorzy: Fares Trad, Simin Chen, Hung Viet Pham i 2 więcej
Software agents with Large Language Models (LLMs) are designed for Automated Program Repair (APR) tasks, raising the possibility that, in the near future, APR agents will fix bugs automatically without much human intervention. Can we trust an APR agent to produce both functionally correct and secure code in such situations? What if attackers target production APR agents with adversarial issues that seem benign but may influence the agents to produce correct but insecure code? In this paper, we took a first step towards answering these questions by conducting an empirical study. First, we created SWEADV, a benchmark of 750 adversarial issue descriptions constructed from 150 repair tasks in SWE-bench Verified. For each repair task, we created five adversarial issue descriptions, one for each attack type: command execution, deserialization, path traversal, denial of service, and weak hashi…
- Kategoria arxiv
- cs.CR
- Kategoria
- Kryptografia i bezpieczeństwo