🤖 AI Summary
This study investigates how prompt quality affects the security of code generated by large language models (LLMs). We identify that “benign but poorly formulated” prompts significantly increase the likelihood of security vulnerabilities in generated code. To address this, we propose a three-dimensional evaluation framework—assessing goal clarity, information completeness, and logical consistency—and introduce CWE-BENCH-PYTHON, the first normative, graded benchmark dataset for Python focused on Common Weakness Enumeration (CWE) vulnerabilities. Our empirical analysis is the first to systematically demonstrate a strong negative correlation between prompt normativity and the incidence of CWE-class security defects: lower prompt quality strongly predicts higher vulnerability rates. Furthermore, we integrate advanced prompting techniques—including Chain-of-Thought reasoning and Self-Correction—to substantially reduce unsafe code generation. Collectively, these findings establish “improving user prompt quality” as a novel paradigm for enhancing the security of AI-generated code, providing both theoretical foundations and practical methodologies for security-aware prompt engineering.
📝 Abstract
Large language models (LLMs) have become indispensable for automated code generation, yet the quality and security of their outputs remain a critical concern. Existing studies predominantly concentrate on adversarial attacks or inherent flaws within the models. However, a more prevalent yet underexplored issue concerns how the quality of a benign but poorly formulated prompt affects the security of the generated code. To investigate this, we first propose an evaluation framework for prompt quality encompassing three key dimensions: goal clarity, information completeness, and logical consistency. Based on this framework, we construct and publicly release CWE-BENCH-PYTHON, a large-scale benchmark dataset containing tasks with prompts categorized into four distinct levels of normativity (L0-L3). Extensive experiments on multiple state-of-the-art LLMs reveal a clear correlation: as prompt normativity decreases, the likelihood of generating insecure code consistently and markedly increases. Furthermore, we demonstrate that advanced prompting techniques, such as Chain-of-Thought and Self-Correction, effectively mitigate the security risks introduced by low-quality prompts, substantially improving code safety. Our findings highlight that enhancing the quality of user prompts constitutes a critical and effective strategy for strengthening the security of AI-generated code.