{"id":"https://openalex.org/W4408214684","doi":"https://doi.org/10.1145/3722108","title":"Prompting Techniques for Secure Code Generation: A Systematic Investigation","display_name":"Prompting Techniques for Secure Code Generation: A Systematic Investigation","publication_year":2025,"publication_date":"2025-03-07","ids":{"openalex":"https://openalex.org/W4408214684","doi":"https://doi.org/10.1145/3722108"},"language":"en","primary_location":{"id":"doi:10.1145/3722108","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3722108","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3722108","source":{"id":"https://openalex.org/S142627899","display_name":"ACM Transactions on Software Engineering and Methodology","issn_l":"1049-331X","issn":["1049-331X","1557-7392"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Software Engineering and Methodology","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3722108","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5089389565","display_name":"Catherine Tony","orcid":"https://orcid.org/0000-0002-9916-4456"},"institutions":[{"id":"https://openalex.org/I159176309","display_name":"Universit\u00e4t Hamburg","ror":"https://ror.org/00g30e956","country_code":"DE","type":"education","lineage":["https://openalex.org/I159176309"]},{"id":"https://openalex.org/I884043246","display_name":"Hamburg University of Technology","ror":"https://ror.org/04bs1pb34","country_code":"DE","type":"education","lineage":["https://openalex.org/I884043246"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Catherine Tony","raw_affiliation_strings":["Hamburg University of Technology, Hamburg, Germany","Hamburg University of Technology, Germany"],"raw_orcid":"https://orcid.org/0000-0002-9916-4456","affiliations":[{"raw_affiliation_string":"Hamburg University of Technology, Hamburg, Germany","institution_ids":["https://openalex.org/I159176309","https://openalex.org/I884043246"]},{"raw_affiliation_string":"Hamburg University of Technology, Germany","institution_ids":["https://openalex.org/I159176309","https://openalex.org/I884043246"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5020137630","display_name":"Nicol\u00e1s E. D\u00edaz Ferreyra","orcid":"https://orcid.org/0000-0001-6304-771X"},"institutions":[{"id":"https://openalex.org/I159176309","display_name":"Universit\u00e4t Hamburg","ror":"https://ror.org/00g30e956","country_code":"DE","type":"education","lineage":["https://openalex.org/I159176309"]},{"id":"https://openalex.org/I884043246","display_name":"Hamburg University of Technology","ror":"https://ror.org/04bs1pb34","country_code":"DE","type":"education","lineage":["https://openalex.org/I884043246"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Nicol\u00e1s E. D\u00edaz Ferreyra","raw_affiliation_strings":["Hamburg University of Technology, Hamburg, Germany","Hamburg University of Technology, Germany"],"raw_orcid":"https://orcid.org/0000-0001-6304-771X","affiliations":[{"raw_affiliation_string":"Hamburg University of Technology, Hamburg, Germany","institution_ids":["https://openalex.org/I159176309","https://openalex.org/I884043246"]},{"raw_affiliation_string":"Hamburg University of Technology, Germany","institution_ids":["https://openalex.org/I159176309","https://openalex.org/I884043246"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5063935922","display_name":"Markus Mutas","orcid":null},"institutions":[{"id":"https://openalex.org/I159176309","display_name":"Universit\u00e4t Hamburg","ror":"https://ror.org/00g30e956","country_code":"DE","type":"education","lineage":["https://openalex.org/I159176309"]},{"id":"https://openalex.org/I884043246","display_name":"Hamburg University of Technology","ror":"https://ror.org/04bs1pb34","country_code":"DE","type":"education","lineage":["https://openalex.org/I884043246"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Markus Mutas","raw_affiliation_strings":["Hamburg University of Technology, Hamburg, Germany","Hamburg University of Technology, Germany"],"raw_orcid":"https://orcid.org/0009-0004-7633-0409","affiliations":[{"raw_affiliation_string":"Hamburg University of Technology, Hamburg, Germany","institution_ids":["https://openalex.org/I159176309","https://openalex.org/I884043246"]},{"raw_affiliation_string":"Hamburg University of Technology, Germany","institution_ids":["https://openalex.org/I159176309","https://openalex.org/I884043246"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5116546220","display_name":"Salem Dhif","orcid":"https://orcid.org/0009-0009-4157-8582"},"institutions":[{"id":"https://openalex.org/I159176309","display_name":"Universit\u00e4t Hamburg","ror":"https://ror.org/00g30e956","country_code":"DE","type":"education","lineage":["https://openalex.org/I159176309"]},{"id":"https://openalex.org/I884043246","display_name":"Hamburg University of Technology","ror":"https://ror.org/04bs1pb34","country_code":"DE","type":"education","lineage":["https://openalex.org/I884043246"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Salem Dhif","raw_affiliation_strings":["Hamburg University of Technology, Hamburg, Germany","Hamburg University of Technology, Germany"],"raw_orcid":"https://orcid.org/0009-0009-4157-8582","affiliations":[{"raw_affiliation_string":"Hamburg University of Technology, Hamburg, Germany","institution_ids":["https://openalex.org/I159176309","https://openalex.org/I884043246"]},{"raw_affiliation_string":"Hamburg University of Technology, Germany","institution_ids":["https://openalex.org/I159176309","https://openalex.org/I884043246"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5012313708","display_name":"Riccardo Scandariato","orcid":"https://orcid.org/0000-0003-3591-7671"},"institutions":[{"id":"https://openalex.org/I159176309","display_name":"Universit\u00e4t Hamburg","ror":"https://ror.org/00g30e956","country_code":"DE","type":"education","lineage":["https://openalex.org/I159176309"]},{"id":"https://openalex.org/I884043246","display_name":"Hamburg University of Technology","ror":"https://ror.org/04bs1pb34","country_code":"DE","type":"education","lineage":["https://openalex.org/I884043246"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Riccardo Scandariato","raw_affiliation_strings":["Hamburg University of Technology, Hamburg, Germany","Hamburg University of Technology, Germany"],"raw_orcid":"https://orcid.org/0000-0003-3591-7671","affiliations":[{"raw_affiliation_string":"Hamburg University of Technology, Hamburg, Germany","institution_ids":["https://openalex.org/I159176309","https://openalex.org/I884043246"]},{"raw_affiliation_string":"Hamburg University of Technology, Germany","institution_ids":["https://openalex.org/I159176309","https://openalex.org/I884043246"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":18.0487,"has_fulltext":false,"cited_by_count":20,"citation_normalized_percentile":{"value":0.99508294,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":99,"max":100},"biblio":{"volume":"34","issue":"8","first_page":"1","last_page":"53"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9991999864578247,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10951","display_name":"Cryptographic Implementations and Security","score":0.9987000226974487,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7983332872390747},{"id":"https://openalex.org/keywords/code-generation","display_name":"Code generation","score":0.5318714380264282},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.45204877853393555},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.4464966058731079},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.3705044984817505},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.2882488965988159},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.07348430156707764}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7983332872390747},{"id":"https://openalex.org/C133162039","wikidata":"https://www.wikidata.org/wiki/Q1061077","display_name":"Code generation","level":3,"score":0.5318714380264282},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.45204877853393555},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.4464966058731079},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.3705044984817505},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2882488965988159},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.07348430156707764},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3722108","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3722108","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3722108","source":{"id":"https://openalex.org/S142627899","display_name":"ACM Transactions on Software Engineering and Methodology","issn_l":"1049-331X","issn":["1049-331X","1557-7392"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Software Engineering and Methodology","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1145/3722108","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3722108","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3722108","source":{"id":"https://openalex.org/S142627899","display_name":"ACM Transactions on Software Engineering and Methodology","issn_l":"1049-331X","issn":["1049-331X","1557-7392"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Software Engineering and Methodology","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4408214684.pdf"},"referenced_works_count":87,"referenced_works":["https://openalex.org/W1498990157","https://openalex.org/W1975675278","https://openalex.org/W2041282815","https://openalex.org/W2061554433","https://openalex.org/W2110065044","https://openalex.org/W2251935656","https://openalex.org/W2276364082","https://openalex.org/W2316776689","https://openalex.org/W2606964149","https://openalex.org/W2607303097","https://openalex.org/W2750168540","https://openalex.org/W2888302696","https://openalex.org/W2890894339","https://openalex.org/W2912924812","https://openalex.org/W2919420119","https://openalex.org/W2930957955","https://openalex.org/W2945795702","https://openalex.org/W2963015836","https://openalex.org/W2963323070","https://openalex.org/W2963341956","https://openalex.org/W2963995027","https://openalex.org/W2964223283","https://openalex.org/W2980753794","https://openalex.org/W2993331254","https://openalex.org/W2998617917","https://openalex.org/W3034850762","https://openalex.org/W3099655892","https://openalex.org/W3101118213","https://openalex.org/W3102187933","https://openalex.org/W3159959439","https://openalex.org/W3160638507","https://openalex.org/W3170092793","https://openalex.org/W3170403598","https://openalex.org/W3178592347","https://openalex.org/W3187000578","https://openalex.org/W3194676777","https://openalex.org/W3198685994","https://openalex.org/W3202114283","https://openalex.org/W4205371973","https://openalex.org/W4206070295","https://openalex.org/W4220983258","https://openalex.org/W4224051134","https://openalex.org/W4224308101","https://openalex.org/W4225108562","https://openalex.org/W4226210603","https://openalex.org/W4239249613","https://openalex.org/W4246788636","https://openalex.org/W4247737564","https://openalex.org/W4281690148","https://openalex.org/W4281763794","https://openalex.org/W4282968607","https://openalex.org/W4285490465","https://openalex.org/W4288057765","https://openalex.org/W4299527668","https://openalex.org/W4308346016","https://openalex.org/W4308627621","https://openalex.org/W4308627645","https://openalex.org/W4311991106","https://openalex.org/W4317940234","https://openalex.org/W4320560161","https://openalex.org/W4321162379","https://openalex.org/W4321276180","https://openalex.org/W4321649710","https://openalex.org/W4322718191","https://openalex.org/W4327525501","https://openalex.org/W4328028645","https://openalex.org/W4361866100","https://openalex.org/W4366204357","https://openalex.org/W4366565380","https://openalex.org/W4384026520","https://openalex.org/W4384026634","https://openalex.org/W4385570007","https://openalex.org/W4385571157","https://openalex.org/W4385571689","https://openalex.org/W4385573003","https://openalex.org/W4385574139","https://openalex.org/W4385574286","https://openalex.org/W4386566526","https://openalex.org/W4386982649","https://openalex.org/W4387427818","https://openalex.org/W4388483179","https://openalex.org/W4388505012","https://openalex.org/W4388858772","https://openalex.org/W4389364428","https://openalex.org/W4401543590","https://openalex.org/W4402671023","https://openalex.org/W6810081322"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W4391913857","https://openalex.org/W2358668433","https://openalex.org/W2163672025","https://openalex.org/W2048831961","https://openalex.org/W1606349578","https://openalex.org/W4399567378"],"abstract_inverted_index":{"Large":[0],"Language":[1,20],"Models":[2],"(LLMs)":[3],"are":[4,126],"gaining":[5],"momentum":[6],"in":[7,185],"software":[8],"development":[9],"with":[10],"prompt-driven":[11],"programming":[12],"enabling":[13],"developers":[14],"to":[15,29,50,107,207],"create":[16],"code":[17,32,65,91,118,136,150,163,177,213],"from":[18,54,93],"Natural":[19],"(NL)":[21],"instructions.":[22],"However,":[23],"studies":[24],"have":[25,48],"questioned":[26],"their":[27],"ability":[28],"produce":[30],"secure":[31,64,135,176],"and,":[33],"thereby,":[34],"the":[35,57,81,88,109,172,189,208],"quality":[36],"of":[37,83,90,123,146,171],"prompt-generated":[38],"software.":[39],"Alongside,":[40],"various":[41],"prompting":[42,61,85,111,160],"techniques":[43,86,112,125,161,174],"that":[44,113],"carefully":[45],"tailor":[46],"prompts":[47],"emerged":[49],"elicit":[51],"optimal":[52],"responses":[53],"LLMs.":[55,97],"Still,":[56],"interplay":[58],"between":[59],"such":[60],"strategies":[62],"and":[63,69,131,167,180,201],"generation":[66,119,151,164,178],"remains":[67],"under-explored":[68],"calls":[70],"for":[71,117,134,162,175],"further":[72],"investigations.":[73],"Objective":[74],":":[75,99,154],"In":[76],"this":[77],"study,":[78],"we":[79,101,140],"investigate":[80],"impact":[82],"different":[84],"on":[87,128,211],"security":[89,186],"generated":[92],"NL":[94,148],"instructions":[95],"by":[96],"Method":[98],"First,":[100],"perform":[102],"a":[103,169,183],"systematic":[104],"literature":[105],"review":[106],"identify":[108],"existing":[110,143,196],"can":[114],"be":[115],"used":[116,141],"tasks.":[120],"A":[121],"subset":[122,170],"these":[124],"evaluated":[127],"GPT-3,":[129],"GPT-3.5,":[130],"GPT-4":[132],"models":[133],"generation.":[137],"For":[138],"this,":[139],"an":[142,195],"dataset":[144],"consisting":[145],"150":[147],"security-relevant":[149],"prompts.":[152],"Results":[153],"Our":[155],"work":[156],"(i)":[157],"classifies":[158],"potential":[159],"(ii)":[165],"adapts":[166],"evaluates":[168],"identified":[173],"tasks,":[179],"(iii)":[181],"observes":[182],"reduction":[184],"weaknesses":[187],"across":[188],"tested":[190],"LLMs,":[191],"especially":[192],"after":[193],"using":[194],"technique":[197],"called":[198],"Recursive":[199],"Criticism":[200],"Improvement":[202],"(RCI),":[203],"contributing":[204],"valuable":[205],"insights":[206],"ongoing":[209],"discourse":[210],"LLM-generated":[212],"security.":[214]},"counts_by_year":[{"year":2026,"cited_by_count":10},{"year":2025,"cited_by_count":10}],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2025-10-10T00:00:00"}