secure-coding-drift-llm-pqc

name	secure-coding-drift-llm-pqc
description	Gamified methodology for detecting and fixing secure coding drift in LLM-assisted post-quantum cryptography development. Identifies gradual degradation of secure coding practices from sustained reliance on LLM-generated code in security-critical domains.
metadata	{"arxiv_id":"2606.19474","published":"2026-06-17","authors":"R. D. N. Shakya, C. P. Wijesiriwardana, S. M. Vidanagamachchi, Nalin A. G. Arachchilage","tags":["quantum","post-quantum-cryptography","llm","secure-coding","gamification"]}

Secure Coding Drift in LLM-Assisted PQC Development

Description

Methodology for detecting and mitigating "secure coding drift" — the gradual degradation of secure coding practices due to sustained reliance on LLM-generated code in post-quantum cryptography (PQC) development. Proposes a gamified, LLM-augmented secure coding framework that embeds adversarial evaluation, behavioral feedback, and security scoring into development workflows.

Activation Keywords

• secure coding drift
• llm cryptography security
• post-quantum coding
• gamified secure coding
• pqc implementation security
• 安全编码漂移
• 量子密码开发

Core Concepts

Secure Coding Drift Model

• Socio-technical vulnerability: Security risk as longitudinal behavioral phenomenon, not static vulnerability
• Root cause: Sustained reliance on LLM-generated code in security-critical domains
• PQC-specific risks: Constant-time execution violations, side-channel vulnerabilities, parameter misconfigurations
• Gradual degradation: Not single bugs but systematic erosion of security practices over time

Gamified Mitigation Framework

• Adversarial evaluation: LLM-generated code is actively tested against security benchmarks
• Behavioral feedback: Developers receive continuous security scoring and trend analysis
• Security scoring: Quantified metrics for code quality, constant-time compliance, side-channel resistance
• LLM as security co-pilot: Reframe LLM from passive code generator to active security partner

Usage Patterns

Pattern 1: Secure Coding Drift Assessment

When auditing PQC codebases for LLM-induced security degradation:

1. Identify code regions generated by LLMs
2. Evaluate against PQC-specific security criteria (constant-time, side-channel resistance)
3. Track security score trends over time
4. Identify drift patterns (increasing violations, decreasing review quality)

Pattern 2: Gamified Security Framework Design

When building secure development workflows for PQC:

1. Embed adversarial testing into CI/CD pipeline
2. Implement security scoring with visible leaderboards
3. Provide behavioral feedback on developer coding patterns
4. Position LLM as active security co-pilot with explicit security constraints

Pattern 3: PQC Implementation Security Review

When reviewing LLM-assisted PQC implementations:

1. Check constant-time execution properties
2. Verify side-channel resistance (timing, power, electromagnetic)
3. Validate parameter selection against NIST standards
4. Assess whether LLM suggestions introduce subtle vulnerabilities

Methodology

Step 1: Define Security Criteria

• Constant-time execution requirements
• Side-channel resistance thresholds
• NIST PQC parameter compliance
• Memory safety constraints

Step 2: Implement Gamified Framework

• Security scoring algorithm
• Behavioral feedback loop
• Adversarial test suite
• Progress tracking dashboard

Step 3: Monitor and Iterate

• Track security scores over time
• Identify drift patterns early
• Adjust framework based on developer behavior
• Update security criteria as PQC standards evolve

Error Handling

False Positives in Drift Detection

• Not all LLM-assisted code is insecure — distinguish drift from legitimate pattern changes
• Calibrate scoring thresholds based on project-specific risk profiles

Framework Overhead

• Gamification must not slow development — keep feedback immediate and lightweight
• Balance security rigor with developer productivity

Examples

Example: Detecting Constant-Time Drift

A PQC implementation team uses LLMs for code generation. Over 6 months, timing analysis reveals increasing variance in execution paths — the secure coding drift model catches this before production deployment. The gamified framework scores this drift and provides targeted feedback.

Resources

• arXiv: 2606.19474 - "Secure Coding Drift in LLM-Assisted Post-Quantum Cryptography Development"
• NIST Post-Quantum Cryptography Standards
• Related: post-quantum-cryptographic-protocol-analysis, pqc-tls-deployment