Generate and Pray: Using SALLMs to Evaluate the Security of LLM Generated Code

A lot of work on this topic; a consensus seems to be emerging that LLMs indeed output insecure code.

That said, I didn't quite grasp the approach in this piece. Basically, they supply insecure code snippets to a LLM and evaluate its output. However, these snippets are actually data that has been used to train the LLM. So I am not sure about the causal reasoning here, although I might have misunderstood something.

> RQ2 Findings: StarCoder generated more secure code than CodeGen-2B, CodeGen-2.5 7B, GPT-3.5 and GPT-4.

I wonder why StarCoder might generate more secure code