LLM-powered code generation tools are transforming software development, with developers increasingly relying on AI-generated code snippets. However, recent studies have shown that such code often contains hidden security vulnerabilities, varying widely across models and programming languages. Despite this, there is no systematic comparative study on which LLMs are best suited for secure code generation across languages and application domains. This is partially due to the rapid growth of LLM models. This requires the design of an automated framework, that takes a new models API key, and returns a score for the model. How to approach this:
First, we need to systematically generate a large codebase in the selected programming language(s) using different LLMs and applying automated vulnerability detection to assess security quality. By doing so, it will highlight risks and provide guidance for safe adoption of LLM-assisted coding in practice. The important step is how do design a reliable vulnerability detection stack for a given language. Static analyzers, LLMs, formal verification tools?
Project Goal
The primary goal is to systematically evaluate the security properties of LLM-generated code in the selected programming languages and identify which models introduce the least risk in different software development contexts. At the same time the developed framework should be future proof, and allow practitioners to test future LLMS. The choice of language can be up to the student.
Your work will involve
Conducting a literature review on AI code generation, existing empirical studies on LLM vulnerabilities in code, and relevant programming language–specific risks.
Designing a methodology to generate a large, representative codebase using multiple LLMs across a selection of programming languages such as C, Python, and Go.
Applying automated vulnerability detection tools (both AI-based and static analysis tools such as Semgrep, CodeQL, or Joern) to systematically assess the generated code for security issues.
Comparing models’ performance in terms of security quality, diversity of vulnerabilities, and language-specific risks.
Producing a taxonomy of vulnerabilities most frequently introduced by LLMs in code generation.
Providing recommendations for developers and organizations on which models and programming languages are safer choices for AI-assisted coding.
Another twist to this could be a completely unexplored aspect: There are a lot of benchmarks on code correctness whether LLMs can solve a programming task and return the right answer. Some studies exist on vulnerable code detection. However, the cross-section is unexplored: which model can implement a task correctly, and at the same time avoid vulnerabilities the best.