CIPHER: Cryptographic Insecurity Profiling via Hybrid Evaluation of Responses
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2026
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866910013317971968 |
|---|---|
| author | Manolov, Max Gao, Tony Shukla, Siddharth Chou, Cheng-Ting Lagasse, Ryan |
| author_facet | Manolov, Max Gao, Tony Shukla, Siddharth Chou, Cheng-Ting Lagasse, Ryan |
| contents | Large language models (LLMs) are increasingly used to assist developers with code, yet their implementations of cryptographic functionality often contain exploitable flaws. Minor design choices (e.g., static initialization vectors or missing authentication) can silently invalidate security guarantees. We introduce CIPHER(Cryptographic Insecurity Profiling via Hybrid Evaluation of Responses), a benchmark for measuring cryptographic vulnerability incidence in LLM-generated Python code under controlled security-guidance conditions. CIPHER uses insecure/neutral/secure prompt variants per task, a cryptography-specific vulnerability taxonomy, and line-level attribution via an automated scoring pipeline. Across a diverse set of widely used LLMs, we find that explicit secure prompting reduces some targeted issues but does not reliably eliminate cryptographic vulnerabilities overall. The benchmark and reproducible scoring pipeline will be publicly released upon publication. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2602_01438 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | CIPHER: Cryptographic Insecurity Profiling via Hybrid Evaluation of Responses Manolov, Max Gao, Tony Shukla, Siddharth Chou, Cheng-Ting Lagasse, Ryan Cryptography and Security Artificial Intelligence Large language models (LLMs) are increasingly used to assist developers with code, yet their implementations of cryptographic functionality often contain exploitable flaws. Minor design choices (e.g., static initialization vectors or missing authentication) can silently invalidate security guarantees. We introduce CIPHER(Cryptographic Insecurity Profiling via Hybrid Evaluation of Responses), a benchmark for measuring cryptographic vulnerability incidence in LLM-generated Python code under controlled security-guidance conditions. CIPHER uses insecure/neutral/secure prompt variants per task, a cryptography-specific vulnerability taxonomy, and line-level attribution via an automated scoring pipeline. Across a diverse set of widely used LLMs, we find that explicit secure prompting reduces some targeted issues but does not reliably eliminate cryptographic vulnerabilities overall. The benchmark and reproducible scoring pipeline will be publicly released upon publication. |
| title | CIPHER: Cryptographic Insecurity Profiling via Hybrid Evaluation of Responses |
| topic | Cryptography and Security Artificial Intelligence |
| url | https://arxiv.org/abs/2602.01438 |