Beyond AI Delegation: A Prompt Pattern Framework for Productive Struggle and Evaluative Judgement in Secure Coding Education

Technical Summary: Beyond AI Delegation: A Prompt Pattern Framework for Productive Struggle and Evaluative Judgement in Secure Coding Education

Problem Identification
The rapid integration of Generative AI (GenAI) into higher education has introduced a "delegation dynamic" where students offload cognitive work—writing, analysis, and problem-solving—to automated systems. While this yields immediate outputs, it bypasses the "Productive Struggle" (PS), a critical pedagogical phase where learners grapple with tasks exceeding their current competence to reorganize knowledge structures. In fields like computer security, where shallow understanding carries significant risks, the ability to generate code without reasoning is detrimental. Furthermore, the capacity for "Evaluative Judgement" (EJ)—the ability to critically assess the quality of work, including AI-generated outputs—is often eroded when students passively consume AI solutions. Current institutional responses, such as banning tools or redesigning assessments to detect AI, are deemed unsustainable. The core problem is the lack of practical guidance for educators on how to integrate AI into courses without replacing the student's cognitive role.

Methodology
The authors employ Design Science Research (DSR) to develop and demonstrate a practical artifact: a taxonomy of prompt engineering patterns mapped to pedagogical goals. The research followed four phases:

1. Problem Identification: Defining the erosion of PS and the absence of integration guidance.
2. Objectives: Creating an artifact specific enough for course activities, general enough for various CS topics, and grounded in established pedagogical constructs (PS and EJ).
3. Artifact Design: The authors reviewed HE literature to identify PS and EJ as key competencies threatened by GenAI. They synthesized a taxonomy by adapting prompt patterns from software engineering catalogs (specifically White et al. and Pai), organizing them into four categories and mapping each to specific pedagogical functions (e.g., scaffolding analysis, eliciting comparison).
4. Demonstration: The framework was initially deployed in a master's-level research methods course to observe student usage. Subsequently, the authors applied the framework to design a complete module for an "Advanced Secure Coding" course using the DELTA framework (Context, Outcomes, Activities, Assessment, Reflection) to demonstrate applicability.

Key Contributions
The paper introduces a taxonomy of nine prompt patterns designed to maintain student agency in AI-augmented learning. These patterns are categorized and mapped to pedagogical functions:

• Output Customization:
  • Persona: Shapes AI tone to act as a consistent interlocutor (e.g., a skeptical code reviewer) rather than an answer machine.
  • Template: Forces structured output (e.g., standardized vulnerability reports) to aid student parsing and evaluation.
• Error Identification:
  • Fact Check List: Requires the AI to list underlying factual claims, making them visible and checkable.
  • Reflection: Prompts the AI to articulate its own reasoning limits, exposing gaps for student investigation.
• Prompt Improvement:
  • Cognitive Verifier: Breaks problems into explicit steps (chain-of-thought) to create a visible reasoning trace for students to follow or challenge.
  • Question Refinement: The AI improves the student's vague questions, teaching problem formulation.
  • Alternative Approaches: Generates multiple options to force comparison and prevent acceptance of the first solution.
• Interaction:
  • Flipped Interaction: The AI asks questions (Socratic method) rather than providing answers, keeping the student in the reasoning role.
  • Game Play: Frames interaction as a simulation (e.g., attacker vs. defender) to sustain engagement.

Results and Application
The framework was applied to a master's-level Secure Coding Module. The design utilized three specific patterns to scaffold learning activities:

1. Guided Vulnerability Discovery: Using the Flipped Interaction pattern, students identified SQL injection flaws by answering AI-generated questions one at a time. This preserved Productive Struggle by ensuring the student performed the analysis before receiving confirmation.
2. Comparative Remediation: Using the Alternative Approaches and Template patterns, students were required to propose and compare three distinct mitigation strategies (e.g., parameterized queries vs. ORM) in a table. This explicitly exercised Evaluative Judgement by requiring justification of trade-offs rather than simple selection.
3. Supervised Implementation: Using the Cognitive Verifier pattern, students refactored code while the AI provided a step-by-step reasoning trace. This allowed students to dispute or confirm the AI's logic, creating an audit trail for assessment.

The assessment design (chat logs, written justifications, refactored code, and pull request descriptions) was constructed to be resistant to academic dishonesty, as outsourcing the entire process would result in a lack of analytical depth in the logs and reasoning.

Significance and Claims
The paper claims that the framework provides a replicable approach for designing AI-augmented learning experiences that preserve student reasoning. By mapping engineering prompt patterns to pedagogical goals, the taxonomy offers instructors a vocabulary to deliberately structure AI interactions. The authors position this as a necessary shift from "restriction" to "design," arguing that well-chosen prompts can force the specific type of thinking a course aims to develop.

The authors remain modest regarding the scope of their claims. They acknowledge that the secure coding module described is a design artifact and that the initial deployment occurred in a different context (research methods) without controlled measurement. Consequently, the paper does not claim empirical proof of improved student performance or engagement. Instead, it establishes a structured basis for future empirical evaluation in live course settings, noting that the taxonomy should be treated as a versioned artifact subject to refinement as LLM capabilities evolve. The primary contribution is conceptual: bridging the gap between pedagogical intent and practical course design in the era of GenAI.