{"id":"https://openalex.org/W7160615807","doi":"https://doi.org/10.48550/arxiv.2605.05867","title":"On Fixing Insecure AI-Generated Code through Model Fine-Tuning and Prompting Strategies","display_name":"On Fixing Insecure AI-Generated Code through Model Fine-Tuning and Prompting Strategies","publication_year":2026,"publication_date":"2026-05-07","ids":{"openalex":"https://openalex.org/W7160615807","doi":"https://doi.org/10.48550/arxiv.2605.05867"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.05867","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.05867","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.05867","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5135698141","display_name":"Ali Soltanian Fard Jahromi","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jahromi, Ali Soltanian Fard","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5025562598","display_name":"Amjed Tahir","orcid":"https://orcid.org/0000-0001-9454-1366"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tahir, Amjed","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135657030","display_name":"Peng Liang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liang, Peng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5135675416","display_name":"Foutse Khomh","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Khomh, Foutse","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.4235000014305115,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.4235000014305115,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.17960000038146973,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.15600000321865082,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/strengths-and-weaknesses","display_name":"Strengths and weaknesses","score":0.8267999887466431},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.49810001254081726},{"id":"https://openalex.org/keywords/unintended-consequences","display_name":"Unintended consequences","score":0.49540001153945923},{"id":"https://openalex.org/keywords/best-practice","display_name":"Best practice","score":0.36809998750686646},{"id":"https://openalex.org/keywords/work","display_name":"Work (physics)","score":0.35690000653266907},{"id":"https://openalex.org/keywords/threat-model","display_name":"Threat model","score":0.35030001401901245},{"id":"https://openalex.org/keywords/computer-security-model","display_name":"Computer security model","score":0.34299999475479126}],"concepts":[{"id":"https://openalex.org/C63882131","wikidata":"https://www.wikidata.org/wiki/Q17122954","display_name":"Strengths and weaknesses","level":2,"score":0.8267999887466431},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6315000057220459},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5318999886512756},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.49810001254081726},{"id":"https://openalex.org/C2776889888","wikidata":"https://www.wikidata.org/wiki/Q1135789","display_name":"Unintended consequences","level":2,"score":0.49540001153945923},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.4893999993801117},{"id":"https://openalex.org/C184356942","wikidata":"https://www.wikidata.org/wiki/Q830382","display_name":"Best practice","level":2,"score":0.36809998750686646},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.35690000653266907},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.35030001401901245},{"id":"https://openalex.org/C121822524","wikidata":"https://www.wikidata.org/wiki/Q5157582","display_name":"Computer security model","level":2,"score":0.34299999475479126},{"id":"https://openalex.org/C2776650193","wikidata":"https://www.wikidata.org/wiki/Q264661","display_name":"Obstacle","level":2,"score":0.32109999656677246},{"id":"https://openalex.org/C2776654903","wikidata":"https://www.wikidata.org/wiki/Q2601463","display_name":"SAFER","level":2,"score":0.3052000105381012},{"id":"https://openalex.org/C114869243","wikidata":"https://www.wikidata.org/wiki/Q133735","display_name":"Security through obscurity","level":5,"score":0.29679998755455017},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.27900001406669617},{"id":"https://openalex.org/C154908896","wikidata":"https://www.wikidata.org/wiki/Q2167404","display_name":"Security policy","level":2,"score":0.27399998903274536},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.2676999866962433},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.2624000012874603},{"id":"https://openalex.org/C189708586","wikidata":"https://www.wikidata.org/wiki/Q1504425","display_name":"Systematic review","level":3,"score":0.25850000977516174},{"id":"https://openalex.org/C539667460","wikidata":"https://www.wikidata.org/wiki/Q2414942","display_name":"Management science","level":1,"score":0.2574999928474426}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.05867","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.05867","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.05867","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.05867","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.4835817217826843,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"The":[0],"security":[1,29,45,96,115,149],"of":[2,41,73,82,114,121,130,162,172,189],"AI-generated":[3,48,197],"code":[4,14,78],"remains":[5],"a":[6,39,70,80,190],"major":[7],"obstacle":[8],"to":[9,43,91],"its":[10],"widespread":[11],"adoption.":[12],"Although":[13,156],"generation":[15,54],"models":[16,64,98,183],"achieve":[17],"strong":[18],"performance":[19],"on":[20],"functional":[21],"benchmarks,":[22],"their":[23,33,59,124],"outputs":[24],"frequently":[25],"contain":[26],"bugs":[27],"and":[28,55,65,99,104,126,154,184],"weaknesses":[30,136,139,168,180],"that":[31,148],"undermine":[32],"trustworthiness.":[34],"Prior":[35],"work":[36],"has":[37],"explored":[38],"range":[40],"approaches":[42,106,158],"mitigate":[44],"issues":[46],"in":[47,141],"code,":[49],"e.g.,":[50],"using":[51,102],"static":[52],"analysis-guided":[53],"prompt":[56],"engineering.":[57],"However,":[58],"effectiveness":[60],"varies":[61],"widely":[62],"across":[63,97,181],"settings.":[66],"This":[67],"paper":[68],"presents":[69],"systematic":[71],"investigation":[72],"strategies":[74,94],"for":[75,107,195],"hardening":[76],"model-generated":[77],"against":[79],"list":[81],"Common":[83],"Weakness":[84],"Enumeration":[85],"(CWE).":[86],"We":[87],"assess":[88],"the":[89,112,119,127,142,173,187],"extent":[90],"which":[92],"these":[93],"improve":[95],"programming":[100],"languages,":[101],"fine-tuning":[103],"prompting":[105],"model":[108],"output":[109],"refinement.":[110],"Beyond":[111],"prevalence":[113],"weaknesses,":[116,163],"we":[117],"analyse":[118],"severity":[120],"identified":[122],"CWEs,":[123],"co-occurrence,":[125],"unintended":[128],"consequences":[129],"remediation":[131],"(i.e.,":[132],"whether":[133],"fixing":[134],"certain":[135],"introduces":[137],"new":[138,167],"elsewhere":[140],"same":[143],"code).":[144],"Our":[145],"results":[146],"show":[147],"improvements":[150],"are":[151],"highly":[152],"strategy-":[153],"model-dependent.":[155],"some":[157],"reduce":[159],"specific":[160],"classes":[161],"they":[164],"often":[165],"introduce":[166],"as":[169],"side":[170],"effects":[171],"fixes.":[174],"Moreover,":[175],"no":[176],"strategy":[177],"consistently":[178],"eliminates":[179],"all":[182],"scenarios,":[185],"highlighting":[186],"absence":[188],"universally":[191],"effective":[192],"\"bulletproof\"":[193],"solution":[194],"secure":[196],"code.":[198]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-05-09T00:00:00"}