💻 computer science

AutoBaxBuilder: Bootstrapping Code Security Benchmarking

The paper introduces AutoBaxBuilder, an automated pipeline that leverages large language models to rapidly and cost-effectively generate high-quality code security benchmarks, significantly reducing the manual effort required for benchmark construction while addressing issues of data contamination and scalability.

Original authors: Tobias von Arx, Niels Mündler, Mark Vero, Maximilian Baader, Martin Vechev

Published 2026-05-22

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Tobias von Arx, Niels Mündler, Mark Vero, Maximilian Baader, Martin Vechev

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a teacher trying to grade a class of very advanced students (Large Language Models, or LLMs) who are learning to write computer code. The problem is, these students are getting very good at writing code that looks correct but contains hidden security traps, like backdoors or weak locks, that hackers could use.

To test them, you need a "final exam" (a benchmark) that checks not just if the code works, but if it's safe.

The Problem: The "Human-Grading" Bottleneck
Previously, creating these security exams was like hand-crafting a unique, complex escape room for every single student. It required security experts to spend hours designing scenarios, writing test questions, and building specific "hacks" (exploits) to see if the code would break.

The Catch: By the time an expert finishes building one exam, the students might have already memorized the answers (because the exam questions leaked into their training data).
The Result: We ran out of fresh, difficult exams faster than we could write them, and the exams we had were becoming too easy for the smartest students.

The Solution: AUTOBAXBUILDER (The "Self-Replicating Exam Factory")
The authors built a new system called AUTOBAXBUILDER. Think of this as an AI-powered "exam factory" that can build its own security tests from scratch, without needing a human to hold the pen.

Here is how the factory works, step-by-step, using a simple analogy:

1. The Architect (Scenario Generation)

First, the system acts like an architect. It is told: "Design a new web application scenario, like a badge generator or a file uploader." It invents a brand new idea that hasn't been seen before, ensuring the students can't cheat by memorizing old answers.

2. The Builder & The Inspector (Functional Tests)

Next, the system asks a few different AI "builders" to construct the application based on that new idea.

The Twist: The system then acts as a strict inspector. It writes a checklist (functional tests) to see if the building stands up.
The Loop: If the building falls down, the system tells the builder, "Fix it!" If the checklist is too strict (e.g., "The door must be exactly 3.00 inches wide" when the rules just said "a door"), the system realizes the checklist is wrong and fixes the checklist. It keeps refining the building and the checklist until they match perfectly.

3. The Hacker (Security Exploits)

This is the most critical part. Once the building is solid, the system puts on a "hacker hat."

It looks at the building and asks, "How could a burglar break in?"
It tries to break in. If it succeeds, it records the method.
The Crucial Check: To make sure the "hacker" isn't just guessing, the system builds a second version of the building that is secure (reinforced doors, alarms). It runs the hacker's trick on the secure building.
- If the trick breaks the secure building, the hacker is wrong (the trick is too broad).
- If the trick breaks the weak building but fails to break the secure one, the test is valid.
This process repeats until the system finds a "key" that opens the weak door but not the strong one.

The Results: A Faster, Cheaper, Better Exam

The authors used this factory to create AUTOBAXBENCH, a massive new collection of 40 security exams (more than doubling the previous best collection).

Speed & Cost: Instead of a human taking 3 hours to build one exam, the factory does it in under 2 hours for less than $4. It reduces human effort by 12 times.
Quality: When they compared the factory's exams to the old human-made ones, the factory's tests were just as good, but often stricter. They caught more security flaws that the human experts had missed.
The Reality Check: When they tested the world's smartest AI coding models on these new exams, the results were sobering. Even the best models could only pass about 36% of the security tests. This means that while AI is great at writing code that works, it is still terrible at writing code that is safe.

In Summary
The paper presents a tool that automates the creation of security tests for AI code. It's like having a tireless security guard who can invent new mazes, build the walls, and then immediately try to break them to ensure the walls are strong enough. This allows researchers to keep testing AI models with fresh, difficult challenges without waiting for humans to manually write every single test.

Technical Summary: AUTOBAXBUILDER

Problem Statement

As Large Language Models (LLMs) are increasingly integrated into software engineering, the reliable assessment of the correctness and security of LLM-generated code has become critical. Prior research indicates that LLMs frequently generate code with security vulnerabilities, often overlooking security in favor of functional correctness. Existing evaluation frameworks suffer from three primary limitations:

Data Contamination: Manually crafted benchmarks inevitably leak into the training data of future models, compromising evaluation validity.
Scalability and Extensibility: Creating new benchmarks requires significant human effort to design scenarios, write functional tests, and develop security exploits, making it difficult to keep pace with rapidly improving models.
Difficulty Scaling: Benchmarks must continuously increase in difficulty to challenge more capable LLMs, a task that is resource-intensive for human experts.

Current benchmarks often evaluate correctness and security on separate tasks or focus only on function-level generation, failing to capture the complexities of entire application backends. While the BAXBENCH benchmark addressed this by evaluating end-to-end web application backends, its creation relied heavily on manual human effort, limiting its longevity and scalability.

Methodology: AUTOBAXBUILDER

The authors propose AUTOBAXBUILDER, an automated, agentic pipeline that bootstraps the creation of code security benchmarking tasks from scratch. The system leverages the code-understanding capabilities of LLMs combined with robust execution-based reliability checks to generate scenario specifications, functional tests, and end-to-end security exploits without human intervention.

The pipeline operates in three iterative refinement steps, orchestrated by a central LLM (the "Orchestrator") and validated against reference solutions generated by "Solution LLMs":

Scenario Proposal: The orchestrator generates a novel backend service specification (in OpenAPI format) designed to expose a clear attack surface. It ensures novelty by checking against existing scenario titles. Solution LLMs then generate initial reference implementations.
Functional Test Generation: The orchestrator extracts functional requirements and constructs functional tests. To ensure correctness, the pipeline employs a two-phase refinement loop:
- Refine Solutions: Failing reference solutions are corrected based on execution logs, without the orchestrator seeing the test code to prevent overfitting.
- Refine Tests: The orchestrator analyzes the relationship between test code, solution code, and execution logs to determine if a failure stems from a flawed test or a flawed solution. It iterates until a global consensus is reached, ensuring at least one reference solution passes all tests.
Security Exploit Generation: The orchestrator identifies potential vulnerabilities (CWEs) in the scenario and reference solutions. For each target vulnerability, it generates an exploit and validates it using a contrastive approach:
- The exploit is run on a reference solution.
- If the result is correct (e.g., a vulnerable solution is flagged), the orchestrator generates a "contrastive" solution by either patching the vulnerability or introducing it, based solely on the vulnerability's natural language description (not the exploit logic).
- The exploit is accepted only if it correctly distinguishes between the secure and insecure versions of the solution. This process iterates until a precise pair of secure/insecure solutions is found.

The pipeline includes guardrails such as YAML verification for OpenAPI specs, Python compilation checks for code, and self-criticism mechanisms to handle LLM failures.

Key Contributions

Automated Benchmark Construction: A robust method to construct entirely new benchmarks following the design principles of BAXBENCH with minimal human intervention.
Validation against Expert Baselines: Demonstration that the method reproduces or outperforms expert-written functional tests and exploits on the same tasks, effectively tightening the security upper bound reported by BAXBENCH.
AUTOBAXBENCH: The construction and release of a new benchmark comprising 40 novel scenarios, split into three subsets of increasing difficulty (Easy, Medium, Hard), which more than doubles the available backend scenarios for code security benchmarking.

Experimental Results

The authors evaluated the pipeline and the resulting AUTOBAXBENCH benchmark using a wide range of state-of-the-art LLMs (including GPT-5, Claude 4.5 Sonnet, Gemini 3 Pro, and various open-weight models).

Pipeline Validation: When applied to existing BAXBENCH scenarios, AUTOBAXBUILDER's generated tests and exploits showed high agreement with human-written ones. Specifically, functional tests matched on 80.9% of solutions. Security exploits generated by the pipeline flagged more instances as insecure than the original human-written exploits, attributed to the discovery of additional CWEs and attack variants. Manual auditing of 71 generated exploits found only one unsound exploit.
Benchmark Performance: On AUTOBAXBENCH, even the strongest evaluated model (Claude 4.5 Sonnet) achieved an overall sec_pass@1 (ratio of secure and correct solutions) of only 36%. On the "Hard" split, this dropped to 25%. The gap between pass@1 (functional correctness) and sec_pass@1 highlights that many functionally correct implementations remain exploitable.
Efficiency: The pipeline generates new tasks in under 2 hours with an API cost of less than $4 per task. Including manual verification, this reduces human effort by a factor of 12 compared to manual construction.
Robustness: Ablation studies using disjoint sets of models for construction showed high rank correlation (Spearman $\rho > 0.9$ ) in model performance, indicating the benchmark is not biased toward the models used to generate it.

Significance and Claims

The paper claims that AUTOBAXBUILDER addresses the critical challenge of benchmark contamination and scalability in LLM security evaluation. By automating the generation of uncontaminated, high-quality benchmarks, the framework enables long-term, reliable assessment of LLMs' secure coding capabilities.

The authors emphasize that their method provides a sound upper bound on security by using execution-based exploits rather than static analysis, which is prone to false positives and negatives. They assert that the framework is "future-proof," capable of generating increasingly difficult tasks as model capabilities improve, approaching the complexity of deployed backend APIs. The work concludes that while LLMs have made progress in functional code generation, a significant gap remains in their ability to reliably generate secure code, a gap that AUTOBAXBENCH effectively exposes.