CAREER: Secure Code Generation with Large Language Models

AI Coding Assistants have revolutionized software development by significantly boosting developer productivity. By 2028, it is estimated that 75% of software engineers in enterprises will rely on AI Coding Assistants. These assistants are powered by Code Large Language Models (Code LLMs), which are already integrated in software development environments to complete partial programs and generate code from natural language instructions. However, Code LLMs can produce vulnerable code, raising serious security concerns. Thus, it is critical to ensure the security of code generated by Code LLMs. This project seeks to understand the secure coding capabilities of Code LLMs and to develop techniques to ensure both security and correctness of their outputs. The project’s novelties are establishing the foundation for multi-objective security evaluation of Code LLMs and advancing all facets of the Code LLM security ecosystem to support secure and reliable code generation. The project's broader significance and importance are enhancing the security and reliability of AI-driven software development, empowering millions of developers and tens of thousands of organizations to strengthen critical software systems, and promoting societal and educational impact through student mentoring and training. The objective of the project is to design, develop, and implement the next generation of secure Code LLMs that can be used in realistic coding scenarios. The project is organized into three key research thrusts. First, the project develops multi-objective benchmarks and metrics to thoroughly evaluate Code LLMs in a variety of practical coding scenarios at different difficulty levels, including foundational programming, real-world project development, and instruction following. Second, the project develops semantic-aware decoding algorithms for Code LLMs to generate secure and correct code by enforcing security constraints and ensuring code quality simultaneously. Third, the project designs and implements semantic-aware pre-training techniques to learn secure coding practices while maintaining the performance of general AI coding abilities. The project will release the resulting datasets, methods, and scientific findings to the research community. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.