| name | llm-pqc-coding-security |
| description | LLM-assisted post-quantum cryptography coding security patterns — analyzing secure coding drift, constant-time execution requirements, side-channel resistance, and gamified remediation strategies for PQC implementations. |
| version | 1 |
| author | R. D. N. Shakya, C. P. Wijesiriwardana, S. M. Vidanagamachchi, Nalin A. G. Arachchilage |
| arxiv_id | 2606.19474 |
| published | 2026-06-17T00:00:00.000Z |
| categories | ["cs.CR","cs.AI","cs.SE"] |
| keywords | ["post-quantum cryptography","LLM code generation","secure coding","constant-time execution","side-channel resistance","gamified security","coding drift","PQC implementation"] |
| activation_keywords | ["PQC coding","post-quantum security","LLM code audit","constant-time implementation","side-channel attack prevention","gamified security training","量子密码实现","PQC代码安全","LLM生成代码安全"] |
LLM-Assisted Post-Quantum Cryptography Coding Security
Core Problem
The transition to Post-Quantum Cryptography (PQC) introduces significant implementation complexity:
- Constant-time execution: PQC algorithms must execute in constant time to prevent timing attacks
- Side-channel resistance: Protection against power analysis, electromagnetic, and cache-based attacks
- Precise parameter selection: NIST PQC standards require exact parameter configurations
- Compiler optimization hazards: Compilers may introduce timing variations despite source-level constant-time code
New phenomenon: LLM-assisted PQC development exhibits secure coding drift — gradual degradation of security-critical patterns as LLMs generate code that appears correct but violates subtle security constraints.
Secure Coding Drift in LLM Development
What is Coding Drift?
When LLMs generate PQC code, security violations accumulate gradually:
Iteration 1: Perfectly secure implementation (reference)
Iteration 2: Minor timing variance introduced (compiler hint missing)
Iteration 3: Side-channel vulnerable pattern (data-dependent branching)
Iteration N: Multiple vulnerabilities compound → exploitable
Why LLMs Drift
- Training data gap: Most training data predates PQC standards (NIST FIPS 203/204/205 published 2024)
- Security-blind optimization: LLMs optimize for functionality, not security invariants
- Context window limits: Security constraints span multiple code regions beyond context window
- No security feedback: Standard LLM workflows lack security validation loops
Gamified Fix Framework
The paper proposes gamified remediation to combat coding drift:
Gamification Components
| Component | Description |
|---|
| Security Score | Quantitative measure of code security posture |
| Challenge Levels | Progressive difficulty in identifying vulnerabilities |
| Immediate Feedback | Real-time vulnerability detection and explanation |
| Achievement System | Rewards for maintaining security over iterations |
