SPLASH: Contrastive Audit Pressure for Detecting and Localizing Security Hallucinations in Generated Code
Code generated by large language models often passes every functional test while remaining insecure.
ProofPaper ↗
Key points
- We introduce SPLASH, which is guided by a new measure called audit pressure.
- It contrasts teacher-forced log-probabilities for the generated program under a security review and a style review.
- Aggregated to statements and programs, and grounded in a probabilistic model of competing edits, audit pressure allows SPLASH to choose the secure program among a model's candidate programs and locate the vulnerable statement, with no model training, CWE-specific rules, or internal access to the generating model.
- On 63,684 programs generated by 12 models for 899 tasks, SPLASH picks secure code in 74% of cases, places the vulnerable statement first in 58% of insecure programs, and chooses better than a frontier LLM judge.
Sources (1)
- [1]SPLASH: Contrastive Audit Pressure for Detecting and Localizing Security Hallucinations in Generated CodearXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 19, 08:24 AM
Code generated by large language models often passes every functional test while remaining insecure.
We introduce SPLASH, which is guided by a new measure called audit pressure.
Extractive summary: sentences quoted from the sources.
Before this
- Oct 18, 2026TIRE: Top-Down Formula Instantiation with Reliable Execution for Physics Problem Synthesis
- Oct 17, 2026A Cross-Domain Evaluation of Prompting Techniques for Large Language Models
- Oct 17, 2026Medical Fine-Tuning Reshapes, Not Reduces, Patient-Facing AI Risk: A Rubric-Based, LLM-Judge Evaluation Framework
- Oct 17, 2026EpochGo: Local-first multi-agent AutoML engine using offline Ollama LLMs and deterministic Scikit-Learn pipelines [P]
- Oct 16, 2026"You" Is Not Toxic: How LLM Labelers Rewrite the Web's Conversation Laws
- Oct 16, 2026Self-Reflective Chain-of-Thought (SRCoT): Evidence-Based Text Generation via a Closed-Loop Retrieve--Reflect--Revise Pipeline on Edge LLMs