Keynote: Using LLMs and generative AI to fix software vulnerabilities
summary
Claim: LLMs can autonomously remediate many real vulnerabilities by combining models (StarCoder, CodeLlama, GPT‑4), commit‑based fine‑tuning, and retrieval‑augmented generation against an enterprise code index. Measured results: copilot suggestions accepted ≈33%, GPT‑4 hits ~86% on code gen benchmarks but ~47% on bug repair, and ≈55% on static‑analysis remediation; open models tuned with commits approach low‑40s. Practical wins come from precise prompts, analyzer‑driven context, cross‑file impact analysis, and multi‑step planning; failures need test/build gates and human review.
AI-written summary · about
chapters (16)
- 0:00Welcome and introductions
- 1:33Keynote introduction
- 3:14Evolution of app security
- 6:14DevOps and shift left
- 8:33Rise of generative AI
- 10:47Open source LLMs
- 14:41Evaluating code LLMs
- 16:37Open vs. closed models
- 18:57Vulnerability fixing techniques
- 22:31Instruction tuning
- 26:09Security context in prompts
- 29:43Retrieval augmented generation
- 34:14Spatial context in code
- 37:05Autonomous security agents
- 41:15Developerless security
- 42:57Q&A and concluding remarks
related talks
09mHow Much Trust Do You Have with LLM-Based Solutions?
42mFrom Text to Flaws: Application Vulnerabilities with Generative AI and LLMs
56mWhy Auto-Fixing Vulnerable Code Needs More Than Good Intentions
47mHarnessing LLMs for Next-Level Security Analysis
40mFrom Text to Flaws: Application Vulnerabilities with Generative AI and LLMs
29mSurvival of the Safest: Automating LLM Defense with Genetic Programming
52mUsing GenAI on and inside your code, what could possibly go wrong?
29mOne-Click Code Fix: Securing Code Using AI