Towards Personalizing Secure Programming Education with LLM-Injected Vulnerabilities

2026-04-15

AI Summary

This study addresses the limited effectiveness of generic secure coding examples, which often fail to connect with students’ existing code and thus diminish learning outcomes. Grounded in constructivist theory, this work proposes the first approach to integrate large language model (LLM)-driven personalized vulnerability injection into secure programming education. Leveraging a multi-agent framework, the method automatically injects Common Weakness Enumeration (CWE) vulnerabilities into students’ assignment code to generate contextualized instructional materials, followed by automated assessment, prioritization, and learning outcome reporting. An empirical evaluation with 71 undergraduate students demonstrates that the approach significantly enhances the relevance, clarity, and engagement of teaching examples. Although quantitative improvements did not reach statistical significance, the results validate the feasibility and potential of personalized vulnerability injection, establishing a foundation for future refinements.

Technology Category

• Natural Language Processing: Code Generation / Program Synthesis from Natural Language
• Search and Optimization: Learning to Search
• Machine Learning: Large Multimodal Models (LMMs)

Application Category

• Security and Privacy: Large-scale security measurements
• User Modeling, Personalization and Recommendation: Large Language Models (LLM) for user modeling and recommendation
• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information

Abstract

According to constructivist theory, students learn software security more effectively when examples are grounded in their own code. Generic examples often fail to connect with students' prior work, limiting engagement and understanding. Advances in LLMs are now making it possible to automatically generate personalized examples by embedding security vulnerabilities directly into student-authored code. This paper introduces a method that uses LLMs to inject instances of specific Common Weakness Enumerations (CWEs) into students' own assignment code, creating individualized instructional materials. We present an agentic AI framework, using autonomous LLM-based agents equipped with task-specific tools to orchestrate injection, evaluation, ranking, and learning outcome generation. We report the experience of deploying this system in two undergraduate computer science courses (N=71), where students reviewed code samples containing LLM-injected vulnerabilities and completed a post-project survey. We compared responses with a baseline using a widely adopted set of generic security instructional materials. Students qualitatively reported finding CWE injections into their own code more relevant, clearer, and more engaging than the textbook-style examples. However, our quantitative findings revealed limited statistically significant differences, suggesting that while students valued the personalization, further studies and refinement of the approach are needed to establish stronger empirical support.

Problem

• personalized education
• secure programming
• LLM-injected vulnerabilities
• Common Weakness Enumeration
• constructivist learning

Innovation

• LLM-injected vulnerabilities
• personalized security education
• Common Weakness Enumeration (CWE)
• agentic AI framework
• constructivist learning