SecLLM4SVD

Cyberattacks exploiting software vulnerabilities are becoming increasingly sophisticated. AI, particularly large language models (LLMs), has shown promise in automating vulnerability detection due to their ability to capture both syntactic and semantic code information. However, LLMs are vulnerable to adversarial attacks, where small input changes can manipulate detection results, raising serious concerns about their reliability in software vulnerability detection (SVD). Despite this, little research has focused on understanding, mitigating, or evaluating the stability of LLM-based detection in SVD. This project focuses on addressing the reliability challenges faced by LLMs in detecting software vulnerabilities, especially in adversarially manipulated code implementations. Our main focus is threefold. First, we will explore and explain the mechanisms through which LLMs identify software vulnerabilities, with the goal of developing an explainable detection pipeline for SVD. Second, we will create a comprehensive, quantifiable assessment framework to evaluate the weaknesses and limitations of LLMs in this critical security application, measuring their reliability in SVD tasks. Third, we will design countermeasures against adversarial attacks targeting LLMs in SVD scenarios, leveraging human-LLM interactions. We will assess the effectiveness of these human-in-the-loop approaches in enhancing the reliability and robustness of LLM-based solutions. Finally, we will develop a leaderboard that dynamically tracks and ranks the robustness of state-of-the-art LLMs for SVD against the developed problem-space attacks.