Poster: Rethinking Security in LLM Code Generation through Real-World Risk Scenarios

2026-07-25

AI Summary

This work addresses the limitations of existing code generation safety benchmarks, which fail to capture risks arising from ambiguous or incomplete prompts commonly encountered in real-world development. From a developer-centric perspective, the study identifies three representative risk scenarios—ambiguous requirements, missing context, and conflicts between security and functionality—and introduces the first fine-grained safety evaluation benchmark comprising 2,700 test cases, moving beyond traditional reliance on explicit security specifications. Through risk modeling, security-aware prompt engineering, and comparative evaluation across eight prominent large language models, the authors reveal an average vulnerability rate exceeding 56%. Notably, incorporating security-aware prompts improves model safety by up to 45%.

Abstract

Large Language Models (LLMs) are widely used for code generation, yet their security behavior in realistic development workflows remains underexplored. Existing benchmarks often rely on explicitly specified security requirements, failing to capture real-world scenarios where prompts are frequently ambiguous or incomplete. In this paper, we adopt a developer-centric perspective and identify three representative risk scenarios that commonly lead to security vulnerabilities in LLM-generated code: Ambiguous Requirements, Under-Specified Operational Context, and Security--Functionality Conflict. Based on these scenarios, we construct a large-scale benchmark comprising 2,700 test cases, enabling fine-grained evaluation of LLM security under realistic conditions. Extensive evaluation of eight state-of-the-art LLMs reveals that all models exhibit average vulnerability rates exceeding 56\% across risk scenarios. We further demonstrate that security-aware prompting can substantially mitigate these risks, achieving up to 45\% improvement.

Problem

• LLM code generation
• security evaluation
• real-world risk scenarios
• ambiguous requirements
• developer-centric perspective

Innovation

• real-world risk scenarios
• security-aware prompting
• LLM code generation
• ambiguous requirements
• large-scale benchmark