Optimization of Few-Shot Prompting Examples for Vulnerability Detection in Code

Vulnerability detection in code is an important element of ensuring code security. Recently, a number of studies have considered the role of LLMs in doing this, with the prevailing direction of travel being increasing the amount and complexity of information presented to an LLM in its prompt when asking it to solve a vulnerability detection task. In this study, we consider the opposite approach, finding that a single pair of minimal examples works significantly better than larger numbers of more complex examples, at least within the specific case of detecting memory management vulnerabilities. This suggests that an LLM can be better guided by providing simple hand-crafted examples of vulnerabilities rather than using larger examples extracted from real world code. We also show how the design space of vulnerability detection prompts can be efficiently explored using grammatical evolution.