Research map / Large language models / Agents, code and math
BaxBench: Can LLMs Generate Correct and Secure Backends?
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Introduces BaxBench, a benchmark of 392 backend-generation tasks (28 scenarios x 14 frameworks) that jointly tests functional correctness via test suites and security via expert-written end-to-end exploits, and evaluates 11 LLMs.
Problem
Existing code benchmarks test function-level or algorithmic code and rarely assess security jointly with correctness, leaving it unclear whether LLMs can generate correct and secure deployment-ready backend applications.
Approach
Framework-agnostic end-to-end backend scenarios specified in OpenAPI, combined with manually written functional tests and expert-written security exploits executed against the running app in Docker, yielding pass@k and secure pass@k metrics across many frameworks and languages.
Key results
- OpenAI o1 achieves 62% pass@1 on functional correctness across BaxBench tasks.
- Around half of the functionally correct programs generated by each model are exploitable.
- Best secure pass@1 is about 35% for OpenAI o3-mini; reasoning models improve notably with generic security reminders while non-reasoning models do not.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use an OpenAPI specification instead of a plaintext prompt | OpenAI o3-mini · BaxBench | Pass@1 correctness: +8.1% | Helped |
| Use an OpenAPI specification instead of a plaintext prompt | GPT-4o · BaxBench | Pass@1 correctness: +9.3% | Helped |
| Use an OpenAPI specification instead of a plaintext prompt | Claude-3.5 Sonnet · BaxBench | Pass@1 correctness: +6.8% | Helped |
| Add OpenHands agent scaffolding | Claude-3.5 Sonnet · BaxBench, no security reminder | Pass@1 correctness: 53.6% -> 59.5% | Helped |
| Add OpenHands agent scaffolding | Claude-3.5 Sonnet · BaxBench, no security reminder | SecPass@1: 32.9% -> 31.8% | Hurt |
| Add OpenHands agent scaffolding | Claude-3.5 Sonnet · BaxBench, generic security reminder | Pass@1 correctness: 45.5% -> 47.7% | Helped |
| Add OpenHands agent scaffolding | Claude-3.5 Sonnet · BaxBench, generic security reminder | SecPass@1: 34.5% -> 35.1% | Helped |
| Add OpenHands agent scaffolding | Claude-3.5 Sonnet · BaxBench, oracle security reminder | Pass@1 correctness: 41.0% -> 45.9% | Helped |
| Add OpenHands agent scaffolding | Claude-3.5 Sonnet · BaxBench, oracle security reminder | SecPass@1: 35.4% -> 39.0% | Helped |
| Use a generic security reminder instead of no security reminder | Reasoning models: OpenAI o1, OpenAI o3-mini, DeepSeek-R1 · BaxBench | SecPass@1 | Helped |
| Use a generic security reminder instead of no security reminder | Non-reasoning models · BaxBench | SecPass@1 | No clear effect |
| Use an oracle security reminder instead of no security reminder | Models evaluated with oracle security instructions · BaxBench | SecPass@1 | Helped |
Surprising findings
- The model with the highest functional correctness (o1) is not the best on security; o3-mini has higher secure pass@1.
- Models often fail on trivial boilerplate such as adhering to API response codes and producing compilable code, despite strong algorithmic benchmark performance.
Limitations
- Benchmark may face contamination once publicly released; golden solutions withheld to mitigate.
- Exploits provide only an upper bound on security; coverage limited to 13 CWEs and finite exploits.
- Only 28 scenarios and 14 frameworks; agent evaluation excludes Python-Django and Compiler environments.
Experimental setup
Datasets: BaxBench scenarios (28 backend scenarios with functional tests and security exploits)
Benchmarks: BaxBench
Metrics: pass@k secure pass@k
Baselines: OpenAI o1 OpenAI o3-mini GPT-4o Claude-3.5 Sonnet DeepSeek-R1 DeepSeek-V3 Codestral Qwen2.5 Coder Llama-3.3 70B Qwen2.5 72B Qwen2.5 7B
Builds on: HumanEval pass@k OpenAPI
Closest papers by meaning
- SEC-bench: Automated Benchmarking of LLM Agents on Real-World Software Security Tasks (NeurIPS 2025 · similarity 0.90)
- LiveCodeBench: Holistic and Contamination Free Evaluation of Large Language Models for Code (ICLR 2025 · similarity 0.88)
- EffiBench-X: A Multi-Language Benchmark for Measuring Efficiency of LLM-Generated Code (NeurIPS 2025 · similarity 0.88)
- Beyond Accuracy: Evaluating Self-Consistency of Code Large Language Models with IdentityChain (ICLR 2024 · similarity 0.88)
- How efficient is LLM-generated code? A rigorous & high-standard benchmark (ICLR 2025 · similarity 0.88)
- DOMAINEVAL: An Auto-Constructed Benchmark for Multi-Domain Code Generation (AAAI 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.