[论文解读] Evaluation of ChatGPT Model for Vulnerability Detection

Anton Cheshkov, P. Zadorozhny+1 more|arXiv (Cornell University)|Apr 12, 2023

Software Engineering Research被引用 24

一句话总结

本文通过实证评估 ChatGPT 和 GPT-3 在 Java 代码漏洞检测上的表现，结果是在真实世界的 CWE 聚焦数据集上，二分类或多标签分类都未超过一个虚拟基线的水平。

ABSTRACT

In this technical report, we evaluated the performance of the ChatGPT and GPT-3 models for the task of vulnerability detection in code. Our evaluation was conducted on our real-world dataset, using binary and multi-label classification tasks on CWE vulnerabilities. We decided to evaluate the model because it has shown good performance on other code-based tasks, such as solving programming challenges and understanding code at a high level. However, we found that the ChatGPT model performed no better than a dummy classifier for both binary and multi-label classification tasks for code vulnerability detection.

研究动机与目标

• 评估大型语言模型（ChatGPT 和 GPT-3）是否能够检测 Java 代码中的漏洞。
• 创建一个聚焦于 CWE 类型的真实世界受漏洞影响和修补后的 Java 函数数据集。
• 将模型性能与基线进行比较，并分析提示及提示变体。

提出的方法

• 从公开的 GitHub 仓库中构建包含已知漏洞和修补的 Java 函数的数据集。
• 为二分类（漏洞 vs. 修补）和多标签（前 top CWE 类型）分类准备子集。
• 通过 OpenAI API 使用设计用于 eliciting Yes/No 漏洞评估和 CWE 类型标签的提示，对 GPT-3 和 ChatGPT 进行查询。
• 对二分类使用准确率、精确率、召回率、F1 和 AUC 进行评估；对多标签任务使用每个 CWE 的指标。
• 与基线虚拟分类器进行比较，并分析提示变体和温度设置（设定为 0）。

Figure 1: Function size distribution in the dataset.

实验结果

研究问题

• RQ1 ChatGPT 和 GPT-3 能否可靠地检测 Java 代码中的漏洞？
• RQ2 这些模型在二分类漏洞检测上是否优于基线的虚拟分类器？
• RQ3 在最常见漏洞的多标签 CWE 类型分类中，这些模型的表现如何？
• RQ4 提示设计对漏洞检测性能的影响是什么？
• RQ5 连锁推理提示（chain-of-thought prompting）或更大模型在此任务中是否能提升结果？],
• RQ6 key_findings':['Binary classification results show limited performance; text-davinci-003 achieves precision 0.50, recall 0.99, F1 0.67, AUC 0.51; gpt-3.5-turbo achieves precision 0.51, recall 0.80, F1 0.62, AUC 0.51; baseline remains at 0.50 across metrics.
• RQ7 Overall multi-label classification on the top five CWE types yields around 38% accuracy for GPT-3 / ChatGPT variants, with macro and weighted averages typically below 0.3 for many CWE types.
• RQ8 The negative (non-vulnerable) class dominates the samples, and models tend to over-predict positives, inflating false positives.
• RQ9 When excluding negative examples, accuracy decreases, indicating the models struggle to correctly identify vulnerable functions without the context of non-vulnerable ones.
• RQ10 Prompts exploring multiple phrasings do not yield substantial performance gains, suggesting prompt variation did not meaningfully improve results.
• RQ11 An anomaly observed: ChatGPT predicted vulnerability types more accurately for fixed functions, suggesting dataset or training biases may influence labeling.