{"id":"https://openalex.org/W7161025910","doi":"https://doi.org/10.1145/3786165.3788437","title":"Q&AEval: Benchmarking Secure Coding Ability of LLMs on Real-World Tasks","display_name":"Q&AEval: Benchmarking Secure Coding Ability of LLMs on Real-World Tasks","publication_year":2026,"publication_date":"2026-04-12","ids":{"openalex":"https://openalex.org/W7161025910","doi":"https://doi.org/10.1145/3786165.3788437"},"language":"en","primary_location":{"id":"doi:10.1145/3786165.3788437","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3786165.3788437","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2026 IEEE/ACM 4th International Workshop on Software Vulnerability Management","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3786165.3788437","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5136072683","display_name":"Markus Toran","orcid":"https://orcid.org/0000-0002-0803-9458"},"institutions":[{"id":"https://openalex.org/I4210133470","display_name":"Fraunhofer Institute for Secure Information Technology","ror":"https://ror.org/03qt2gs44","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210133470","https://openalex.org/I4923324"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Markus Toran","raw_affiliation_strings":["Fraunhofer SIT | ATHENE, Darmstadt, Germany"],"raw_orcid":"https://orcid.org/0000-0002-0803-9458","affiliations":[{"raw_affiliation_string":"Fraunhofer SIT | ATHENE, Darmstadt, Germany","institution_ids":["https://openalex.org/I4210133470"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136018646","display_name":"Bettina Ballin","orcid":"https://orcid.org/0009-0004-9915-3804"},"institutions":[{"id":"https://openalex.org/I4210154384","display_name":"Facility for Antiproton and Ion Research","ror":"https://ror.org/053veeq82","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210154384"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Bettina Ballin","raw_affiliation_strings":["Independent Researcher, Darmstadt, Germany"],"raw_orcid":"https://orcid.org/0009-0004-9915-3804","affiliations":[{"raw_affiliation_string":"Independent Researcher, Darmstadt, Germany","institution_ids":["https://openalex.org/I4210154384"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5001151093","display_name":"Marc Miltenberger","orcid":"https://orcid.org/0000-0002-3806-0522"},"institutions":[{"id":"https://openalex.org/I4210133470","display_name":"Fraunhofer Institute for Secure Information Technology","ror":"https://ror.org/03qt2gs44","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210133470","https://openalex.org/I4923324"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Marc Miltenberger","raw_affiliation_strings":["Fraunhofer SIT | ATHENE, Darmstadt, Germany"],"raw_orcid":"https://orcid.org/0000-0002-3806-0522","affiliations":[{"raw_affiliation_string":"Fraunhofer SIT | ATHENE, Darmstadt, Germany","institution_ids":["https://openalex.org/I4210133470"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5026715017","display_name":"Steven Arzt","orcid":"https://orcid.org/0000-0002-5807-9431"},"institutions":[{"id":"https://openalex.org/I4210133470","display_name":"Fraunhofer Institute for Secure Information Technology","ror":"https://ror.org/03qt2gs44","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210133470","https://openalex.org/I4923324"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Steven Arzt","raw_affiliation_strings":["Fraunhofer SIT | ATHENE, Darmstadt, Germany"],"raw_orcid":"https://orcid.org/0000-0002-5807-9431","affiliations":[{"raw_affiliation_string":"Fraunhofer SIT | ATHENE, Darmstadt, Germany","institution_ids":["https://openalex.org/I4210133470"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"8"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11636","display_name":"Artificial Intelligence in Healthcare and Education","score":0.2029999941587448,"subfield":{"id":"https://openalex.org/subfields/2718","display_name":"Health Informatics"},"field":{"id":"https://openalex.org/fields/27","display_name":"Medicine"},"domain":{"id":"https://openalex.org/domains/4","display_name":"Health Sciences"}},"topics":[{"id":"https://openalex.org/T11636","display_name":"Artificial Intelligence in Healthcare and Education","score":0.2029999941587448,"subfield":{"id":"https://openalex.org/subfields/2718","display_name":"Health Informatics"},"field":{"id":"https://openalex.org/fields/27","display_name":"Medicine"},"domain":{"id":"https://openalex.org/domains/4","display_name":"Health Sciences"}},{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.10010000318288803,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T10883","display_name":"Ethics and Social Impacts of AI","score":0.10000000149011612,"subfield":{"id":"https://openalex.org/subfields/3311","display_name":"Safety Research"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/python","display_name":"Python (programming language)","score":0.5548999905586243},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.4666999876499176},{"id":"https://openalex.org/keywords/secure-coding","display_name":"Secure coding","score":0.4578999876976013},{"id":"https://openalex.org/keywords/coding","display_name":"Coding (social sciences)","score":0.4300999939441681},{"id":"https://openalex.org/keywords/boilerplate-text","display_name":"Boilerplate text","score":0.39910000562667847},{"id":"https://openalex.org/keywords/source-code","display_name":"Source code","score":0.37470000982284546},{"id":"https://openalex.org/keywords/java","display_name":"Java","score":0.3504999876022339}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7577000260353088},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5830000042915344},{"id":"https://openalex.org/C519991488","wikidata":"https://www.wikidata.org/wiki/Q28865","display_name":"Python (programming language)","level":2,"score":0.5548999905586243},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.4666999876499176},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.4578999876976013},{"id":"https://openalex.org/C179518139","wikidata":"https://www.wikidata.org/wiki/Q5140297","display_name":"Coding (social sciences)","level":2,"score":0.4300999939441681},{"id":"https://openalex.org/C75701414","wikidata":"https://www.wikidata.org/wiki/Q1651672","display_name":"Boilerplate text","level":2,"score":0.39910000562667847},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.37470000982284546},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.3741999864578247},{"id":"https://openalex.org/C548217200","wikidata":"https://www.wikidata.org/wiki/Q251","display_name":"Java","level":2,"score":0.3504999876022339},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.31290000677108765},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.30820000171661377},{"id":"https://openalex.org/C92966194","wikidata":"https://www.wikidata.org/wiki/Q651794","display_name":"Compiled language","level":4,"score":0.2946000099182129},{"id":"https://openalex.org/C2781162219","wikidata":"https://www.wikidata.org/wiki/Q26250693","display_name":"Replicate","level":2,"score":0.2939999997615814},{"id":"https://openalex.org/C86251818","wikidata":"https://www.wikidata.org/wiki/Q816754","display_name":"Benchmarking","level":2,"score":0.29319998621940613},{"id":"https://openalex.org/C199519371","wikidata":"https://www.wikidata.org/wiki/Q942695","display_name":"Source lines of code","level":3,"score":0.2919999957084656},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.2791999876499176},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.2572000026702881},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.25679999589920044}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3786165.3788437","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3786165.3788437","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2026 IEEE/ACM 4th International Workshop on Software Vulnerability Management","raw_type":"proceedings-article"},{"id":"pmh:oai:publica.fraunhofer.de:publica/519209","is_oa":true,"landing_page_url":"https://publica.fraunhofer.de/handle/publica/519209","pdf_url":null,"source":{"id":"https://openalex.org/S4306400318","display_name":"Fraunhofer-Publica (Fraunhofer-Gesellschaft)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I4923324","host_organization_name":"Fraunhofer-Gesellschaft","host_organization_lineage":["https://openalex.org/I4923324"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"conference paper"}],"best_oa_location":{"id":"doi:10.1145/3786165.3788437","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3786165.3788437","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2026 IEEE/ACM 4th International Workshop on Software Vulnerability Management","raw_type":"proceedings-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.6499379873275757}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":28,"referenced_works":["https://openalex.org/W2142503704","https://openalex.org/W2166743230","https://openalex.org/W2357927175","https://openalex.org/W2604794021","https://openalex.org/W2907964905","https://openalex.org/W2964144088","https://openalex.org/W2980753794","https://openalex.org/W3176251539","https://openalex.org/W4288057765","https://openalex.org/W4289255588","https://openalex.org/W4308627645","https://openalex.org/W4308641904","https://openalex.org/W4384026520","https://openalex.org/W4386982649","https://openalex.org/W4396820575","https://openalex.org/W4400315178","https://openalex.org/W4400680805","https://openalex.org/W4401885808","https://openalex.org/W4401990041","https://openalex.org/W4402264467","https://openalex.org/W4402811603","https://openalex.org/W4403646794","https://openalex.org/W4403747722","https://openalex.org/W4405464489","https://openalex.org/W4408214684","https://openalex.org/W4409510011","https://openalex.org/W4411233154","https://openalex.org/W4411950636"],"related_works":[],"abstract_inverted_index":{"Conversational":[0],"Models":[1,12],"revolutionize":[2],"the":[3,41,46,89,99,104],"way":[4],"we":[5,39,83,111],"think,":[6],"communicate,":[7],"and":[8,33,43,65,94,120],"code.":[9],"Large":[10],"Language":[11],"(LLMs)":[13],"such":[14],"as":[15,96,98],"GPT-o4":[16],"can":[17,115],"generate":[18,138],"thousands":[19],"of":[20,22,45,62,128],"lines":[21],"code":[23,47,81,91,101,119,129,139,145],"in":[24,88,103,157],"seconds,":[25],"ranging":[26],"from":[27,58,76,117],"simple":[28],"boilerplate":[29],"functions":[30],"to":[31,53,126],"large":[32],"complex":[34],"applications.":[35],"In":[36],"this":[37,109],"study,":[38],"evaluate":[40],"security":[42,123,162],"quality":[44],"produced":[48],"by":[49,131,147],"LLMs,":[50],"comparing":[51],"it":[52],"a":[54,59,167,171],"human":[55,148],"baseline":[56],"derived":[57],"vast":[60],"corpus":[61],"StackOverflow":[63,105],"questions":[64,75],"answers.":[66,106],"We":[67,133],"queried":[68],"5":[69],"LLMs":[70,137,150],"with":[71],"over":[72],"10,000":[73],"cybersecurity-related":[74],"StackOverflow.":[77],"Using":[78],"three":[79],"static":[80],"scanners,":[82],"automatically":[84],"identified":[85],"software":[86],"vulnerabilities":[87],"AI-generated":[90],"for":[92],"Java":[93],"Python":[95],"well":[97],"human-provided":[100],"snippets":[102],"Based":[107],"on":[108,170],"data,":[110],"analyze":[112],"what":[113],"developers":[114],"expect":[116],"LLM-generated":[118],"how":[121],"its":[122],"level":[124],"compares":[125],"that":[127,135,140],"provided":[130],"humans.":[132],"find":[134],"popular":[136],"is":[141],"less":[142],"secure":[143],"than":[144],"written":[146],"programmers.":[149],"often":[151],"replicate":[152],"common":[153],"vulnerability":[154],"patterns":[155],"and,":[156],"some":[158],"cases,":[159],"introduce":[160],"additional":[161],"issues.":[163],"Our":[164],"results":[165],"contradict":[166],"previous":[168],"study":[169],"similar,":[172],"albeit":[173],"smaller":[174],"dataset.":[175]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-05-14T00:00:00"}