Evaluation of ChatGPT Model for Vulnerability Detection

In this technical report, we evaluated the performance of the ChatGPT and GPT-3 models for the task of vulnerability detection in code. Our evaluation was conducted on our real-world dataset, using binary and multi-label classification tasks on CWE vulnerabilities. We decided to evaluate the model because it has shown good performance on other code-based tasks, such as solving programming challenges and understanding code at a high level. However, we found that the ChatGPT model performed no better than a dummy classifier for both binary and multi-label classification tasks for code vulnerability detection.

cs.CR cs.AI cs.SE Computer Science

Source

Paper

References (12)

01Sparks of Artificial General Intelligence: Early experiments with GPT-4Sébastien Bubeck, Varun Chandrasekaran, Ronen Eldan et al.2023 · arXiv.org · 4.3k citations In Library

02A Comprehensive Capability Analysis of GPT-3 and GPT-3.5 Series ModelsJunjie Ye, Xuanting Chen, Nuo Xu et al.2023 · arXiv.org · 491 citations In Library

03Chain of Thought Prompting Elicits Reasoning in Large Language ModelsJason Wei, Xuezhi Wang, Dale Schuurmans et al.2022 · Neural Information Processing Systems · 21k citations In Library

04Evaluating Large Language Models Trained on CodeMark Chen, Jerry Tworek, Heewoo Jun et al.2021 · arXiv.org · 11k citations In Library

05GPT3Mix: Leveraging Large-scale Language Models for Text AugmentationKang Min Yoo, Dongju Park, Jaewook Kang et al.2021 · Conference on Empirical Methods in Natural Language Processing · 290 citations In Library

06Language Models are Few-Shot LearnersTom B. Brown, Benjamin Mann, Nick Ryder et al.2020 · Neural Information Processing Systems · 61k citations In Library

07CWE-200: Exposure of Sensitive Information to an Unauthorized ActorCWE-611: Improper Restriction of XML External Entity Reference 5

08Sang-Woo Lee, and Woomyeong Park2021 · Gpt3mix: Leveraging largescale language models for text augmentation

09CWE-611: Improper Restriction of XML External Entity Reference 5. CWE-200: Exposure of Sensitive Information to an Unauthorized Actor 6. There is no vulnerability in the code

10Which of these types of vulnerabilities is contained in the code? 1. CWE-502: Deserialization of Untrusted Data 2CWE

11CWE-20: Improper Input Validation

12CWE-502: Deserialization of Untrusted Data 2. CWE-79: Cross-site Scripting