Saad Ullah

It’s was a crazy Journey through @DARPA’s AIxCC and now using what we’ve learned, we’re trying to ease the flood caused by the vulnpocolypse at Artiphishell! Alongside my amazing cofounders @degrigis @dreselli @_saadullah01 @jay_vadayath /🧵

g. SecLLMHolmes can be used to: - benchmark LLMs for vulnerability detection - highlight their strengths and weaknesses - build better LLMs for cybersecurity

f. Our test cases to assess 'robustness' break chain-of-thought and step-by-step reasoning of LLMs - gpt-4 fails 17% tests - palm2 fails 26% tests - codellama-34b fails 27% tests e.g., models flip their answers by slight code augmentations

"Can LLMs be used as helpful security assistants for vulnerability detection?" Our tool "SecLLMHolmes", published at IEEE S&P '24, answers this question by evaluating capabilities of LLMs for identifying and reasoning about security vulnerabilities. computer.org/csdl/proceedin…