Secure Code Generation at Scale with Reflexion
Open accessPublished version of a preprint
Abstract
Large language models (LLMs) are now widely used to draft and refactor code, but code that works is not necessarily secure. We evaluate secure code generation using the Instruct Prime, which eliminated compliance-required prompts and cue contamination, and evaluate five instruction-tuned code LLMs using a zero-shot baseline and a three-round reflexion prompting approach. Security is measured using the Insecure Code Detector (ICD), and results are reported by measuring Repair, Regression, and NetGain metrics, considering the programming language and CWE family. Our findings show that insecurity remains common at the first round: roughly$\mathbf{2 5 - 3 3 \%}$of programs are insecure at a zero-shot baseline ($t_{0}$). Weak cryptography/configdependent bugs are the hardest to avoid while templated ones like XSS, code injection, and hard-coded secrets are handled more reliably. Python yields the highest secure rates;$\mathbf{C}$and$\mathbf{C \#}$are the lowest, with Java, JS, PHP, and C++ in the middle. Reflexion prompting improves security for all models, improving average accuracy from$\mathbf{7 0. 7 4 \%}$at$t_{0}$to$\mathbf{7 9. 4 3 \%}$at$t_{3}$, with the largest gains in the first round followed by diminishing returns. The trends with Repair, Regression, and NetGain metrics show that applying one to two rounds produces most of the benefits. A replication package is available at https://doi.org/10.5281/zenodo.17065846.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Prior iterative self-revision work suggests that a small number of rounds, such as three, is often sufficient for repair.
“Prior iterative self-revision work suggests that a small number of rounds (e.g., three) is often sufficient for repair [24]”
From A Multi-Agent Framework for Accessible Web Code Generation (2026) · cites this paper as [24]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Asleep at the keyboard? Assessing the security of GitHub copilot’s code contributions
Pearce, H., Ahmad, B., Tan, B., Dolan-Gavitt, B., & Karri, R. (2025) · Communications of the ACM · doi:10.1145/3610721 · Cited by 140 · cited 4× · see citing works
“Early work on the security of LLM-generated code was established by Pearce et al. [6], who analyzed 1,689 GitHub Copilot completions across 89 scenarios and found that approximately 40% were insecure.”
InfluentialSiddiq, M. L., & Santos, J. C. S. (2022) · Proceedings of the 1st International Workshop on Mining Software Repositories Applications for Privacy and Security · doi:10.1145/3549035.3561184 · Cited by 101 · see citing works
LLMSecEval: A Dataset of Natural Language Prompts for Security Evaluations
Tony, C., Mutas, M., Ferreyra, N. E. D., & Scandariato, R. (2023) · 2023 IEEE/ACM 20th International Conference on Mining Software Repositories (MSR) · doi:10.1109/msr59073.2023.00084 · Cited by 61 · see citing works
Hajipour, H., Haßler, K., Holz, T., Schönherr, L., & Fritz, M. (2024) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml59370.2024.00040 · Cited by 51 · see citing works
CWEval: Outcome-driven Evaluation on Functionality and Security of LLM Code Generation
Peng, J., Cui, L., Huang, K., Yang, J., & Ray, B. (2025) · International Workshop on Large Language Models for Code (LLM4Code) · doi:10.1109/llm4code66737.2025.00009 · Cited by 29 · see citing works
OpenCoder: The Open Cookbook for Top-Tier Code Large Language Models
Huang, S., Cheng, T., Liu, J., Xu, W., Hao, J., Song, L., Xu, Y., Yang, J., Liu, J., Zhang, C., et al. (2025) · Proceedings of the conference - Association for Computational Linguistics. Meeting · doi:10.18653/v1/2025.acl-long.1591 · Cited by 15 · see citing works
Prompting in the Wild: An Empirical Study of Prompt Evolution in Software Repositories
Tafreshipour, M., Imani, A., Huang, E., de Almeida, E. S., Zimmermann, T., & Ahmed, I. (2025) · International Conference on Mining Software Repositories (MSR) · doi:10.1109/msr66628.2025.00106 · Cited by 13 · see citing works
How Propense Are Large Language Models at Producing Code Smells? A Benchmarking Study
Velasco, A., Rodríguez-Cárdenas, D., Alif, L. R., Palacio, D. N., & Poshyvanyk, D. (2025) · IEEE/ACM International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER) · doi:10.1109/icse-nier66352.2025.00025 · Cited by 12 · see citing works
Aljohani, A., & Do, H. (2024) · ACM Symposium on Applied Computing · doi:10.1145/3605098.3636058 · Cited by 6 · see citing works
Self-citationPromptSet: A Programmer's Prompting Dataset
Pister, K. S., Paul, D. J., Joshi, I., & Brophy, P. (2024) · International Workshop on Large Language Models for Code (LLM4Code) · doi:10.1145/3643795.3648395 · Cited by 5 · see citing works
Flagged first, then by citations
Research works printed but not linked: 17
- M. Chen, J. Tworek, H. Jun, Q. Yuan, H. P. de Oliveira Pinto, J. Kaplan, H. Edwards, Y. Burda, N. Joseph, G. Brockman, A. Ray, R. Puri, G. Krueger, M. Petrov, H. Khlaaf, G. Sastry, P. Mishkin, B. Chan, S. Gray, N. Ryder, M. Pavlov, A. Power, L. Kaiser, M. Bavarian, C. Winter, P. Tillet, F. P. Such, D. Cummings, M. Plappert, F. Chantzis, E. Barnes, A. Herbert-Voss, W. H. Guss, A. Nichol, A. Paino, N. Tezak, J. Tang, I. Babuschkin, S. Balaji, S. Jain, W. Saunders, C. Hesse, A. N. Carr, J. Leike, J. Achiam, V. Misra, E. Morikawa, A. Radford, M. Knight, M. Brundage, M. Murati, K. Mayer, P. Welinder, B. McGrew, D. Amodei, S. McCandlish, I. Sutskever, and W. Zaremba, "Evaluating large language models trained on code," 2021.
- J. Liu, C. S. Xia, Y. Wang, and L. Zhang, "Is your code generated by chatgpt really correct? rigorous evaluation of large language models for code generation," Advances in Neural Information Processing Systems, vol. 36, pp. 21 558-21 572, 2023.
- E. Basic and A. Giaretta, "From vulnerabilities to remediation: A systematic literature review of llms in code security," arXiv preprint arXiv:2412.15004, 2024. · arXiv
- B. Yetis ¸tiren, I. Özsoy, M. Ayerdem, and E. Tüzün, "Evaluating the code quality of ai-assisted code generation tools: An empirical study on github copilot, amazon codewhisperer, and chatgpt," arXiv preprint arXiv:2304.10778, 2023. · arXiv
- M. Bhatt, S. Chennabasappa, C. Nikolaidis, S. Wan, I. Evtimov, D. Gabi, D. Song, F. Ahmad, C. Aschermann, L. Fontana et al., "Purple llama cyberseceval: A secure coding benchmark for language models," arXiv preprint arXiv:2312.04724, 2023. · arXiv
- M. Bhatt, S. Chennabasappa, Y. Li, C. Nikolaidis, D. Song, S. Wan, F. Ahmad, C. Aschermann, Y. Chen, D. Kapil et al., "Cyberseceval 2: A wide-ranging cybersecurity evaluation suite for large language models," arXiv preprint arXiv:2404.13161, 2024. · arXiv
- S. Hariharan, Z. A. Majid, J. R. Veuthey, and J. Haimes, "Rethinking cyberseceval: An llm-aided approach to evaluation critique," arXiv preprint arXiv:2411.08813, 2024. · arXiv
- A. Madaan, N. Tandon, P. Gupta, S. Hallinan, L. Gao, S. Wiegreffe, U. Alon, N. Dziri, S. Prabhumoye, Y. Yang, S. Gupta, B. P. Majumder, K. Hermann, S. Welleck, A. Yazdanbakhsh, and P. Clark, "Self-refine: iterative refinement with self-feedback," in Proceedings of the 37th International Conference on Neural Information Processing Systems, ser. NIPS '23. Red Hook, NY, USA: Curran Associates Inc., 2023.
- Q. Shi, M. Tang, K. Narasimhan, and S. Yao, "Can language models solve olympiad programming?" arXiv preprint arXiv:2404.10952, 2024. · arXiv
- J. Wang, X. Luo, L. Cao, H. He, H. Huang, J. Xie, A. Jatowt, and Y. Cai, "Is your ai-generated code really safe? evaluating large language models on secure code generation with codeseceval," arXiv preprint arXiv:2407.02395, 2024. · arXiv
- Y. Yang, Y. Nie, Z. Wang, Y. Tang, W. Guo, B. Li, and D. Song, "Seccodeplt: A unified platform for evaluating the security of code genai," arXiv preprint arXiv:2410.11096, 2024. · arXiv
- Y. Fu, E. Baker, Y. Ding, and Y. Chen, "Constrained decoding for secure code generation," arXiv preprint arXiv:2405.00218, 2024. · arXiv
- C. Dilgren, P. Chiniya, L. Griffith, Y. Ding, and Y. Chen, "Secrepobench: Benchmarking llms for secure code generation in real-world reposito- ries," arXiv preprint arXiv:2504.21205, 2025. · arXiv
- B. Hui, J. Yang, Z. Cui, J. Yang, D. Liu, L. Zhang, T. Liu, J. Zhang, B. Yu, K. Dang et al., "Qwen2. 5-coder technical report," arXiv preprint arXiv:2409.12186, 2024. · arXiv
- B. Roziere, J. Gehring, F. Gloeckle, S. Sootla, I. Gat, X. E. Tan, Y. Adi, J. Liu, R. Sauvestre, T. Remez et al., "Code llama: Open foundation models for code," arXiv preprint arXiv:2308.12950, 2023. · arXiv
- D. Guo, Q. Zhu, D. Yang, Z. Xie, K. Dong, W. Zhang, G. Chen, X. Bi, Y. Wu, Y. Li et al., "Deepseek-coder: When the large language model meets programming-the rise of code intelligence," arXiv preprint arXiv:2401.14196, 2024. · arXiv
- W. X. Zhao, K. Zhou, J. Li, T. Tang, X. Wang, Y. Hou, Y. Min, B. Zhang, J. Zhang, Z. Dong et al., "A survey of large language models," arXiv preprint arXiv:2303.18223, 2023. · arXiv
Cited by
Sorted by citations
A Multi-Agent Framework for Accessible Web Code Generation
Aljedaani, W., Shaik, M. A., & Aljohani, A. (2026) · Proceedings of the 23rd International Web for All Conference · doi:10.1145/3800424.3800453 · Cited by 1 · see citing works
“Prior iterative self-revision work suggests that a small number of rounds (e.g., three) is often sufficient for repair [24]; we therefore adopt a slightly higher upper bound to improve robustness across diverse prompts and tool feedback.”
Self-citation
- Authors
- Datta, A., Aljohani, A., & Do, H.
- Affiliations
- University of North Texas (US)
- ORCID
- Do, Hyunsook
- Venue
- 2025 2nd IEEE/ACM International Conference on AI-powered Software (AIware)
- Publisher
- IEEE
- Published
- 2025-11-19
- Pages
- 01-09
- OpenAlex
- W4416022645
- Cited by
- 1
- References
- 10
- Citations by year
- 2026: 1
- FWCI
- 1.20
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- ACM International Conference on AI-Powered Software (AIware) (publishedVersion)
- arXiv (Cornell University) (submittedVersion, cc-by)
- arXiv (Cornell University) (cc-by)
- Topics
- Physical Sciences › Computer Science › Information Systems › Software Engineering Research
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- secure code generation, large language models, code security, CWE, code injection, cross-site scripting, programming languages
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
