CS-Guard: Benchmarking LLM Guardrails for Code Generation Security

2026-09-09

AI Summary

本文通过引入CS-Guard基准，系统评估了针对代码生成安全性的防护措施的有效性，揭示了现有防护措施在抵御恶意代码生成请求上的不足。

Abstract

Large language models (LLMs) have been ex- ploited to generate malware, but the effective- ness of guardrails for code generation secu- rity remains unclear. We introduce CS-Guard, the first benchmark to systematically evalu- ate guardrails for code generation security. It covers 1) text-to-code generation with 1000 high-quality malware-generation prompts, 7 jailbreak attacks, and a novel fictional scenario attack (FSA) that embeds malicious intent in a legitimate fictional software-development sce- nario; and 2) code-to-code generation with 331 code prompts spanning code infilling, code completion, and code translation. We empiri- cally evaluate 9 guardrails across seven LLMs. We find that current guardrails perform poorly against malicious code-generation re- quests: for text-to-code, the average attack success rate (ASR) after jailbreaks reaches about 50% for many guardrails; for code-to- code, average ASR approaches 100% on base LLMs and remains high across many guardrails (14.4% to nearly 100%). Our FSA also achieves ASR close to 100% across many guardrails, raising major reliability concerns for real-world software development. To sup- port future research, CS-Guard uses a modular three-layer guardrail taxonomy that lets devel- opers register guardrails for evaluation. We release the benchmark and data to enable fur- ther community evaluation.

Problem

• code generation security
• LLM guardrails
• malware generation

Innovation

• Benchmarking
• LLM Guardrails
• Code Generation Security
• Fictional Scenario Attack (FSA)
• Modular Three-layer Guardrail Taxonomy