Systems and methods for mitigating third-party code vulnerabilities in ai-assisted code generation

Abstract

Systems and methods are provided for mitigating third-party code vulnerabilities in AI code generation services. A large language model generates an inference based on a user's code generation request. A middleware layer intercepts the inference before its availability within an AI-to-programming client and parses the inference to identify third-party packages. A verification module checks the identified third-party packages against one or more authenticated package registries. If an unauthenticated third-party package is detected, the middleware layer either edits the inference or modifies the inference by replacing with an identified authenticated third-party package replacement. The system enhances the security of AI-assisted code generation by ensuring the use of authenticated third-party packages.

Description

Background Technology

[0001] Artificial intelligence (AI) has become an indispensable part of modern software development. For example, AI-assisted code generation services such as GitHub Copilot utilize large language models (LLMs) such as Generative Pre-trained Transformers (GPTs) to generate code based on user requests. These services can accelerate the code development process by suggesting previously generated code snippets and functions, or even complete modules, to solve a given problem.

[0002] A common practice in software development is to use third-party packages or libraries. These packages are often open-source, providing developers with pre-built functionality that they can incorporate into their applications, thus reducing the time and effort spent coding from scratch. However, using third-party packages can introduce potential security risks. These packages may contain exploitable vulnerabilities, leading to security flaws in applications that use them.

[0003] The large language models used in AI-assisted code generation services are trained on massive amounts of data, including code snippets incorporating third-party packages. When generating code in response to user requests, these models can suggest the use of third-party packages based on patterns learned from the training data. However, the training data is static and does not reflect the real-time updates and patches applied to these third-party packages after the model was trained. Therefore, the model may suggest using outdated or vulnerable versions of third-party packages.

[0004] Furthermore, in enterprise environments, organizations typically maintain lists of certified or approved third-party packages to ensure the security and integrity of their software. These approved packages are usually stored in private registries and undergo security vulnerability reviews. However, AI-assisted code generation services may be unaware of these organization-specific restrictions and may recommend the use of unapproved or uncertified software packages.

[0005] In view of the above, we hope to improve the way AI-assisted code generation services are implemented, while mitigating third-party code vulnerabilities during AI-assisted code generation.

[0006] The subject matter claimed herein is not limited to embodiments that address any shortcomings or operate only in environments such as those described above. Rather, this background is provided merely to illustrate an example technical field in which some of the embodiments described herein can be practiced. Summary of the Invention

[0007] The disclosed embodiments include systems and methods for mitigating third-party code vulnerabilities in AI code generation services.

[0008] In some embodiments, a system for mitigating third-party code vulnerabilities in an AI code generation service is provided, wherein the system includes or utilizes: a large language model configured to generate inference based on a user's code generation request; a middleware layer configured to intercept the inference prior to its availability within an AI client user interface, and to parse the inference to identify third-party packages included in the inference; and a verification module utilized by the middleware layer to determine whether the identified third-party packages included in the inference are certified by checking the identified third-party packages against at least one or more certified package registries, the middleware layer being further configured to, after determining that the inference includes an uncertified third-party package not included in one or more certified package registries, (i) edit the inference or the uncertified third-party package, or (ii) modify the inference by at least including the identification of a certified third-party package as an alternative to the uncertified third-party package.

[0009] In some respects, the techniques described herein relate to a method for mitigating third-party code vulnerabilities in an AI code generation service, the method comprising: receiving a code generation request from a user; generating inference based on the code generation request using a large language model; intercepting the inference prior to its availability within an AI client user interface; parsing the inference to identify third-party packages included in the inference; checking the identified third-party packages against one or more certified package registries; and, after determining that the inference includes an uncertified third-party package not included in one or more certified package registries, at least one of the following: (i) editing the inference or the uncertified third-party package, or (ii) modifying the inference by at least including the identifier of a certified third-party package as an alternative to the uncertified third-party package.

[0010] In some aspects, the techniques described herein relate to a hardware storage device including stored computer-executable instructions executable by one or more hardware processors of a system for mitigating third-party code vulnerabilities in AI code generation, such that the system: receives a code generation request from a user; generates inference based on the code generation request using a large language model; intercepts the inference prior to its availability within an AI client user interface; parses the inference to identify third-party packages included in the inference; checks the identified third-party packages against one or more certified package registries; and, after determining that the inference includes an uncertified third-party package not included in one or more certified package registries, at least one of the following: (i) edits the inference or the uncertified third-party package, or (ii) modifies the inference by at least including the identifier of a certified third-party package as an alternative to the uncertified third-party package.

[0011] This invention is provided to introduce a series of concepts, which will be further described in the following detailed description. This invention is not intended to identify key or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.

[0012] Additional features and advantages will be set forth in the description which follows, and will be apparent in part from that description, or may be learned by practice as taught herein. The features and advantages of the invention can be realized and obtained by means of the instruments and combinations particularly pointed out in the appended claims. The features of the invention will become more apparent from the following description and the appended claims, or may be learned by practice of the invention as described below. Attached Figure Description

[0013] To describe how the above and other advantages and features can be obtained, the subject matter briefly described above will be described in more detail with reference to specific embodiments shown in the accompanying drawings. It should be understood that these drawings depict only typical embodiments and therefore should not be used to limit the scope; the embodiments will be described and explained with additional specificity and detail using the drawings, in which:

[0014] Figure 1 An example embodiment is illustrated, in which the middleware layer of the system interfaces with one or more third-party package registries and includes or interfaces with a Large Language Model (LLM) to process LLM prompts received from a client user interface, to process inference generated by the LLM in response to the prompts, and wherein the inference is modified to replace or edit uncertified packages from the inference, and is processed into an LLM response for the AI ​​client user interface in response to the LLM prompts.

[0015] Figure 2 The diagram illustrates a process flow chart that provides further details on how inference from an LLM is processed into modified inference and corresponding LLM responses.

[0016] Figure 3 An example embodiment is illustrated, with Figure 1 Similar to the example implementation, the system's middleware layer interfaces with one or more third-party package registries and includes or interfaces with a Large Language Model (LLM) to process an initial LLM prompt received from a client user interface, to process initial inference generated by the LLM in response to the initial prompt, and wherein a verification process performed on the initial inference causes the middleware layer to generate one or more new prompts for the LLM to obtain one or more new inferences, which omit at least one uncertified package included in the initial inference, wherein the new inferences(s) can be used to generate an LLM response to the initial LLM prompt.

[0017] Figure 4The diagram illustrates a process flow chart including actions associated with performing aspects of the disclosed embodiments.

[0018] Figure 5 An example computing environment is illustrated, in which a computing system is incorporated into and / or used to perform aspects of the disclosed embodiments. Detailed Implementation

[0019] The disclosed embodiments include systems, methods, and apparatuses that can be used to mitigate vulnerabilities in third-party code during AI-assisted code generation.

[0020] As described herein, the disclosed embodiments advantageously handle AI-generated inference (which is generated in response to code generation prompts) to modify the inference to omit uncertified packages and code vulnerabilities before the inference is processed into a response to the prompts. In this way, the propagation of code vulnerabilities during code development using AI-assisted code generation tools can be helped to reduce this. Therefore, the disclosed system advantageously enhances the security and reliability of code generated by AI services by ensuring that third-party packages included in the generated code are certified and free of known vulnerabilities. This is particularly important in the context of AI-driven programming services such as GitHub Copilot, which rely on large language models to generate code based on user requests.

[0021] In a typical scenario, a user submits a code generation request to an AI service. The AI ​​service uses a large language model to generate inference or a proposed solution based on the user's request. This inference often involves the use of third-party packages, which are software components developed by third parties and are commonly used in software development to accelerate the development process and avoid reinventing the wheel. However, using third-party packages introduces the risk of incorporating code containing known vulnerabilities, which could compromise the security of the application being developed.

[0022] To address this issue, the disclosed system includes a middleware layer that intercepts the inference generated by a large language model before it becomes available within the AI ​​client user interface. This middleware layer parses the inference to identify third-party packages included in it. This parsing process may involve identifying the programming language of the code in the inference and applying language-specific rules to identify the third-party packages.

[0023] Once a third-party package has been identified, the system uses a verification module to determine whether the identified package is certified. This involves checking the identified package against one or more certified package registries. Registries may include third-party registries such as Artifactory's or others. These registries may be updated in real time to reflect the latest security patches and updates, and may be private registries maintained by the user's organization. Registries may also include or utilize approved dependency hash tables or indexes of approved packages.

[0024] If the verification module determines that the inference includes an uncertified third-party package not included in one or more certified package registries, the middleware layer takes action to mitigate the risk. Specifically, the middleware layer can edit the inference or the uncertified third-party package, or modify the inference by including an identifier of a certified third-party package as an alternative to the uncertified third-party package. In this way, the system ensures that the code generated by the AI ​​service is secure and reliable, and complies with the user's or organization's policies regarding the use of third-party packages.

[0025] In some cases, the system employs (e.g., incorporates or leverages) a Large Language Model (LLM) to generate inference based on the user's code generation request. An LLM is an artificial intelligence model trained on large amounts of text data. It uses this training to generate human-like text relevant to the context of the input it receives. In the context of code generation, the LLM receives a code generation request from the user and generates inference—a proposed solution to the user's request. This inference often involves the use of third-party packages, which are software components developed by third parties.

[0026] In some cases, the LLM used in this system can be a Generative Pre-trained Transformer (GPT). GPT is an LLM that uses a transformer architecture that allows it to handle long-range dependencies in the input data and generate high-quality text. GPT is pre-trained on large amounts of text data and can generate text that is context-dependent on the input it receives. In the context of code generation, a GPT-based LLM can generate syntactically correct code that is context-dependent on the user's request.

[0027] By using a GPT-based LLM, this system can generate high-quality inferences relevant to the user's code generation request context. However, using third-party packages in these inferences introduces the risk of incorporating code with known vulnerabilities. To mitigate this risk, the system includes a middleware layer that intercepts the inferences generated by the LLM and checks the third-party packages included in the inferences against one or more certified package registries, as previously described.

[0028] In some cases, the inference middleware layer intercepts and processes the inference generated by a large language model before it becomes available in the AI ​​client user interface. This interception allows the middleware layer to parse and process the inference to identify any third-party packages included in it. The parsing process may involve identifying the programming language of the code in the inference, identifying the names, elements, patterns, and other characteristics of the code, and applying language-specific rules to identify third-party packages. In some cases, the middleware layer may also generate hints to the index or LLM to query more information or identifiers of third-party packages included in the inference.

[0029] The parsing and processing of inference may also include generating a hash value for the identified third-party package, which is then compared with hash values ​​in the registry of approved or certified third-party packages. This ensures that the system has a comprehensive understanding of the components of the inference and can accurately identify any third-party packages that can be included.

[0030] In some cases, if the inference fails to include any certified third-party packages, the middleware layer can modify the inference into a new / modified inference with alternative certified third-party packages that are identified by the system as suitable replacements for the uncertified third-party packages included in the inference, and perform similar functionality. The middleware layer can use rules and / or trained logic to identify packages with similar functionality. Alternatively, the middleware layer can interact with remote modules to query suitable replacements for any identified uncertified third-party packages.

[0031] In some cases, the system can also interface with an LLM to enable the LLM to generate new replacement inference by sending a new set of one or more prompts to the LLM to generate new / replacement inference that omits at least one uncertified third-party package included in the initial inference. Generating new inference from the LLM may include a process of generating an exclusion list and providing it to a large language model of the uncertified packages to exclude them from future inference.

[0032] In a preferred embodiment, any new or modified inference created by the above process will exclude any uncertified packets included in the initial inference. If the new or modified inference still contains uncertified packets, the system can iterate the previous process to obtain another new and / or modified inference that excludes any uncertified packets.

[0033] Furthermore, the middleware layer can also provide a warning to the user when an uncertified third-party package is identified during inference. This warning informs the user of the potential security risks associated with the uncertified package. In addition to providing warnings, the middleware layer can also modify the inference to offer the user recommendations for certified third-party packages that can replace the uncertified package identified during inference. If the uncertified package is ultimately identified in the LLM response provided to the user at the AI ​​client user interface, this provides the user with a safe alternative to the uncertified package.

[0034] In some cases, the middleware layer can use a caching mechanism to store the latest version of the certified package registry. This reduces the number of queries to the registry service and improves system efficiency. The middleware layer can store such registry information in a hash map or other data structure for efficient package lookup. This allows the middleware layer to quickly determine whether a package is certified, further improving system efficiency and effectiveness.

[0035] Given the foregoing, it is understood that the system includes or utilizes a verification module that can facilitate and, sometimes even ensure, the security and reliability of code generated using the AI ​​code generation service. Notably, the verification module is utilized by the middleware layer to determine whether the identified third-party packages included in the inference are certified. This determination is made by checking the identified third-party packages against one or more certified package registries, which have been verified as secure and free of known vulnerabilities.

[0036] In some cases, these certified package registries are updated in real time to reflect the latest security patches and updates. This ensures the system is aware of the latest security information and can accurately determine whether a third-party package is certified. Real-time registry updates enhance the system's ability to mitigate the risk of code with known vulnerabilities being incorporated into generated code.

[0037] In some configurations, one or more certified package registries are private registries maintained by the user's organization. This allows the system to be customized according to the user's organization's specific security policies and requirements. By checking the identified third-party packages against these private registries, the system ensures that the generated code complies with the organization's policies regarding the use of third-party packages.

[0038] Now let's turn our attention to... Figure 1 , Figure 1An example embodiment is illustrated, in which the system's middleware layer 130 interfaces with one or more third-party package registries 160 and includes or interfaces with a Large Language Model (LLM) 120 to process LLM prompts 112 received from the AI ​​client user interface 110. The middleware layer 130 uses a verification module 140 to process inference 150 generated by the LLM 120 in response to the LLM prompt 112, and wherein the inference 150 is modified to replace or edit uncertified packages from the inference 150, and further processed into an LLM response 114 for the AI ​​client user interface 110 in response to the LLM prompt 112.

[0039] Figure 2 A process flowchart is shown, illustrating more details of the process used to process LLM inference into modified inference and corresponding LLM responses.

[0040] Figure 3 An example embodiment is illustrated, with Figure 1 Similar to the example implementation, the middleware layer of the system interfaces with one or more third-party package registries and includes or interfaces with a Large Language Model (LLM) to process an initial LLM prompt received from a client user interface, to process initial inference generated by the LLM in response to the initial prompt, and wherein a verification process performed by the verification module 140 on the initial inference causes the middleware layer to generate one or more new prompts for the LLM to obtain one or more new inferences, which omit at least one uncertified package included in the initial inference, wherein the new inferences(s) can be used to generate an LLM response to the initial LLM prompt.

[0041] Figure 2 The diagram illustrates a process flow that includes further details regarding the processing of inference into modified inference and the corresponding LLM response to the initial LLM hint. For example, as shown, the LLM hint is processed into inference by the LLM, which is then processed by the verification module of the exposed system. This verification module may be stored locally and / or distributed across different but connected systems. For instance, the verification module may be instantiated as a dependency verification service, which is invoked by a system situated between the client system and the LLM system.

[0042] In some cases, as previously described, inference may include one or more uncertified packages. During the processing of inference by the verification module, uncertified packages are identified and removed, and optionally replaced. The processing of inference involves the verification module parsing the inference to generate a dependency manifest that identifies the different packages identified in the inference. The verification module then verifies these packages by comparing their hashes with hashes contained in a dependency hash table or index of approved and certified packages, which may be maintained by a remote third-party registry and / or a local enterprise registry.

[0043] Importantly, the reasoning is intercepted before it is provided to the client in the LLM response corresponding to the initial code-generated LLM hint. This allows the verification module to remove any uncertified packages identified in the dependency manifest, and optionally replace any such uncertified packages with certified alternative packages that perform similar functionality. Sometimes, the alternative package may simply be a patch or a newer version of a previously indexed package, for example, a package that is no longer certified due to a legacy or newer update to an older version of the package.

[0044] Importantly, the verification module intercepts the reasoning before the LLM response is generated and / or provided to the client based on the reasoning of the initial LLM hint.

[0045] Figure 3 and Figure 1 Similarly, a system including a middleware layer 130 is also illustrated, which interfaces with one or more third-party or private package registries 160, and includes or interfaces with a Large Language Model (LLM) 120 to process an initial LLM prompt 112 received from a client user interface 110, to process initial inference 150 generated by the LLM in response to the initial prompt, and wherein a verification process performed on the initial inference 150 causes the middleware layer 130 to generate one or more new prompts 142 for the LLM 120 to obtain one or more new inferences 152, which omit at least one uncertified package included in the initial inference 150, wherein the new inferences(s) can be used to generate an LLM response 114 to the initial LLM prompt 112. The LLM response 114 can also be at least partially based on a modified inference 170 and / or the new inferences 152, which are generated by the verification module in response to replacing and / or removing one or more uncertified packages from the initial inference 150.

[0046] Figure 4 A process flow diagram 400 is illustrated, which includes actions associated with performing aspects of the disclosed embodiments and can be performed by the system disclosed herein.

[0047] As shown in the figure, flowchart 400 includes the action (action 410) of the system receiving a code generation request from a user. For example, the request may include prompts entered into an AI client interface (such as a browser, GPT interface, or dedicated code generation application). Next, the system uses a large language model to obtain, enable LLM generation, or (when incorporated into LLM) generate inference based on the code generation request (action 420).

[0048] Next, the system determines whether the inference includes any uncertified third-party packages (Action 430). This includes the system intercepting the inference before it becomes available within the AI ​​client user interface, and using the previously described processing to parse the inference to identify the third-party packages included in it.

[0049] The disclosed process also includes, after determining that the inference includes an uncertified third-party package not included in one or more certified package registries, generating or obtaining a new or modified inference that omits at least one uncertified package included in the initial or previously obtained inference (action 440). For example, this may include the following corresponding actions: (i) editing the inference or the uncertified third-party package (action 450), or (ii) modifying the inference by at least including the identifier of a certified third-party package as a substitute for the uncertified third-party package (action 460).

[0050] The system can also iteratively perform any of these actions, such as the one shown by dashed line 470, where the system processes new and / or modified inference to ensure that the new and modified inference does not include any uncertified packages. Example computing system

[0051] Now let's turn our attention to... Figure 5 The illustration depicts an example computing environment in which a computing system is incorporated into and / or used to perform aspects of the disclosed embodiments. As shown, computing system 500 includes a processor system 510 and one or more hardware storage devices. The processor system includes one or more processors (such as one or more hardware processors), and the hardware storage devices include a storage system 520 storing computer-readable instructions 530. Storage system 520 is capable of accommodating any number of data types and any number of computer-executable instructions, through which computing system 500 is configured to implement one or more aspects of the disclosed embodiments when the computer-executable instructions are executed by one or more hardware processors.

[0052] Although not shown, the computing system 500 also includes multiple interfaces and multiple input / output (I / O) devices to facilitate communication between different system components.

[0053] As shown in the figure, storage system 520 is illustrated as a single storage unit. However, it should be understood that the hardware storage devices of storage system 520 may also be distributed storage, distributed to several separate, sometimes remote, systems and / or multiple third-party systems.

[0054] The computing system 500 may also include a distributed system in which one or more components of the computing system 500 are maintained / operated by different discrete systems that are remotely connected to each other and connected via a network 540, such as the Internet or any network that includes a combination of wired and wireless connections. In such a distributed environment, each system performs different tasks. In some cases, multiple distributed systems perform similar and / or shared tasks to achieve the disclosed functionality, such as in a distributed cloud environment.

[0055] Embodiments of the present invention may include or utilize dedicated or general-purpose computers including computer hardware, as discussed in more detail below. Embodiments within the scope of the present invention also include physical and other computer-readable media for carrying or storing computer-executable instructions and / or data structures. Such computer-readable media may be any available media accessible by a general-purpose or dedicated computer system. Computer-readable media storing computer-executable / computer-readable instructions (e.g., hardware storage devices) are physical hardware storage media / devices, excluding transmission media. Computer-readable media carrying computer-executable or computer-readable instructions in one or more carrier waves or signals are transmission media. Therefore, by way of example and not limitation, embodiments of the present invention may include at least two distinct types of computer-readable media: physical computer-readable storage media / devices and transmission computer-readable media.

[0056] A physical computer-readable storage medium / device is hardware and includes RAM, ROM, EEPROM, CD-ROM or other optical disc storage (such as CD, DVD, etc.), disk storage or other magnetic storage devices, or any other hardware that can be used to store desired program code in the form of computer-executable instructions or data structures and that can be accessed by a general-purpose or special-purpose computer.

[0057] A “network” (e.g., network 540) is defined as one or more data links that enable the transmission of electronic data between computer systems and / or modules and / or other electronic devices. When information is transmitted or provided to a computer via a network or other communication connection (hardwired, wireless, or a combination of hardwired and wireless), the computer correctly regards the connection as a transmission medium. The transmission medium may include networks and / or data links that can be used to carry desired program code in the form of computer-executable instructions or data structures and that are accessible by a general-purpose or special-purpose computer. Combinations of the foregoing are also included within the scope of computer-readable media.

[0058] Furthermore, upon arrival at various computer system components, program code in the form of computer-executable instructions or data structures can be automatically transferred from the transmission computer-readable medium to the physical computer-readable storage medium (and vice versa). For example, computer-executable instructions or data structures received via a network or data link can be buffered in RAM within a network interface module (e.g., a "NIC") and then ultimately transferred to the computer system RAM and / or a less volatile computer-readable physical storage medium at the computer system. Therefore, computer-readable physical storage media can be included in computer system components that also (or even primarily) utilize the transmission medium.

[0059] For example, computer-executable instructions include instructions and data that cause a general-purpose computer, special-purpose computer, or special-purpose processing device to perform a specific function or group of functions. Computer-executable instructions can be, for example, binary files, intermediate format instructions such as assembly language, or even source code. Although the subject matter has been described in language specific to structural features and / or methodological actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the features or actions described above. Rather, the described features and actions are disclosed as exemplary forms for implementing the claims.

[0060] Those skilled in the art will understand that this invention can be implemented in network computing environments with many types of computer system configurations, including personal computers, desktop computers, laptops, message processors, handheld devices, multiprocessor systems, microprocessor-based or programmable consumer electronics, network PCs, minicomputers, mainframes, mobile phones, PDAs, pagers, routers, switches, etc. This invention can also be practiced in distributed system environments, where both local and remote computer systems linked via a network (via hardwired data links, wireless data links, or a combination of hardwired and wireless data links) perform tasks. In a distributed system environment, program modules can reside both locally and remotely on memory storage devices.

[0061] Alternatively or additionally, the functions described herein may be performed at least in part by one or more hardware logic components. For example, but not limited to, illustrative types of hardware logic components that may be used include field-programmable gate arrays (FPGAs), program-specific integrated circuits (ASICs), program-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), etc.

[0062] This invention may be embodied in other specific forms without departing from its essential characteristics. The described embodiments are to be considered illustrative in all respects only, and not restrictive. Therefore, the scope of the invention is indicated by the appended claims rather than by the foregoing description. All variations within the equivalent meaning and scope of the claims should be included within their scope. Numbering Clauses

[0063] The present invention may also be described according to the following numbered clauses.

[0064] Clause 1. A system for mitigating third-party code vulnerabilities in an AI code generation service, the system comprising: a large language model configured to generate inference based on a user's code generation request; a middleware layer configured to intercept the inference prior to its availability within an AI client user interface, and to parse the inference to identify third-party packages included in the inference; and a verification module utilized by the middleware layer to determine whether the identified third-party packages included in the inference are certified by checking the identified third-party packages against at least one or more certified package registries, the middleware layer further configured to, after determining that the inference includes an uncertified third-party package not included in one or more certified package registries, (i) edit the inference or the uncertified third-party package, or (ii) modify the inference by at least including the identification of a certified third-party package as an alternative to the uncertified third-party package.

[0065] Clause 2. The system according to Clause 1, wherein the large language model is a generative pre-trained transformer.

[0066] Clause 3. The system as described in Clause 1, wherein the middleware layer is further configured to generate a new inference if the inference fails to include any certified third-party packages, wherein the new inference excludes any uncertified packages included in the inference.

[0067] Clause 4. The system according to Clause 1, wherein the parsing of inference by the middleware layer includes identifying the programming language of the code in the inference and applying language-specific rules to identify third-party packages.

[0068] Clause 5. In the system described in Clause 1, one or more certified package registries are updated in real time to reflect the latest security patches and updates.

[0069] Clause 6. In the system described in Clause 1, one or more certified package registries are private registries maintained by the user's organization.

[0070] Clause 7. The system as described in Clause 3, wherein generating new inference includes providing an exclusion list to a large language model, the exclusion list including identifiers of uncertified packages.

[0071] Clause 8. The system as described in Clause 1, wherein the middleware layer is further configured to modify inference by replacing the uncertified third-party package with an alternative certified third-party package that provides functionality similar to that of the uncertified third-party package.

[0072] Clause 9. The system as described in Clause 1, wherein the middleware layer is also configured to provide a warning to the user when an uncertified third-party package is identified during inference.

[0073] Clause 10. The system as described in Clause 1, wherein the middleware layer is configured to modify inference to provide the user with recommendations for certified third-party packages that can replace the uncertified third-party packages identified in the inference.

[0074] Clause 11. A method for mitigating third-party code vulnerabilities in an AI code generation service, the method comprising: receiving a code generation request from a user; generating request-generated inference based on the code using a large language model; intercepting the inference prior to its availability within an AI client user interface; parsing the inference to identify third-party packages included in the inference; checking the identified third-party packages against one or more certified package registries; and after determining that the inference includes an uncertified third-party package not included in one or more certified package registries, at least one of the following: (i) editing the inference or the uncertified third-party package, or (ii) modifying the inference by at least including the identifier of a certified third-party package as an alternative to the uncertified third-party package.

[0075] Clause 12. The method described in Clause 11, wherein the large language model is a generative pre-trained transformer.

[0076] Clause 13. The method described in Clause 11 further includes: if all identified third-party packages in the initial inference are determined to be uncertified because they are not included in one or more certified package registries, then a new inference is generated, wherein the new inference excludes uncertified third-party packages.

[0077] Clause 14. The method described in Clause 11, wherein parsing the inference includes identifying the programming language of the code in the inference and applying language-specific rules to identify third-party packages.

[0078] Clause 15. The method described in Clause 11, wherein the certified package registry is updated in real time to reflect the latest security patches and updates.

[0079] Clause 16. The method described in Clause 11, wherein the certified package registry is a private registry maintained by the user's organization.

[0080] Clause 17. A hardware storage device including stored computer-executable instructions executable by one or more hardware processors for a system for mitigating third-party code vulnerabilities in AI code generation, such that the system: receives a code generation request from a user; generates inference based on the code generation request using a large language model; intercepts the inference prior to its availability within an AI client user interface; parses the inference to identify third-party packages included in the inference; checks the identified third-party packages against one or more certified package registries; and after determining that the inference includes an uncertified third-party package not included in one or more certified package registries, at least one of the following: (i) edits the inference or the uncertified third-party package, or (ii) modifies the inference by at least including the identifier of a certified third-party package as an alternative to the uncertified third-party package.

[0081] Clause 18. The hardware storage device as described in Clause 17, wherein the system is enabled to edit uncertified third-party packages based on reasoning.

[0082] Clause 19. The hardware storage device as described in Clause 17, wherein the system is enabled to modify reasoning by including at least the identifier of a certified third-party package as an alternative to an uncertified third-party package.

[0083] Clause 20. The hardware storage device described in Clause 19 also includes presenting modified inference to the AI ​​client user interface.

Claims

1. A system for mitigating third-party code vulnerabilities in AI code generation services, the system comprising: The large language model is configured to generate inference based on the user's code generation request; A middleware layer is configured to intercept the inference before it becomes available within the AI ​​client user interface, and to parse the inference to identify third-party packages included in the inference. as well as The verification module, used by the middleware layer, checks the identified third-party package by at least comparing it with one or more certified package registries to determine whether the identified third-party package included in the inference is certified; The middleware layer is also configured to, after determining that the inference includes an uncertified third-party package not included in the one or more certified package registries, (i) edit the inference or the uncertified third-party package, or (ii) modify the inference by including at least the identifier of a certified third-party package as a replacement for the uncertified third-party package.

2. The system according to claim 1, wherein the large language model is a generative pre-trained transformer.

3. The system of claim 1, wherein the middleware layer is further configured to generate a new inference if the inference fails to include any certified third-party packages, wherein the new inference excludes any uncertified packages included in the inference.

4. The system of claim 1, wherein the parsing of the inference by the middleware layer includes identifying the programming language of the code in the inference, and applying language-specific rules to identify the third-party package.

5. The system of claim 1, wherein the one or more certified package registry entries are updated in real time to reflect security patches and updates.

6. The system of claim 1, wherein the one or more certified package registries are private registries maintained by the user's organization.

7. The system of claim 3, wherein generating new inference includes providing an exclusion list to the large language model, the exclusion list including identifiers of uncertified packages.

8. The system of claim 1, wherein the middleware layer is further configured to modify the inference by replacing the uncertified third-party package with an authorized third-party package, the authorized third-party package providing similar functionality to the uncertified third-party package.

9. The system of claim 1, wherein the middleware layer is further configured to provide a warning to the user when an uncertified third-party package is identified in the inference.

10. The system of claim 1, wherein the middleware layer is configured to modify the inference to provide a suggestion to the user, the suggestion being for an authorized third-party package capable of replacing an unauthorized third-party package identified in the inference.

11. A method for mitigating third-party code vulnerabilities in AI code generation services, the method comprising: Receive code generation requests from users; Use a large language model to generate inference based on the code generation request; Intercept the inference before it becomes available within the AI ​​client user interface; Parse the inference to identify the third-party packages included in the inference; Check the identified third-party package against one or more certified package registry entries; as well as After determining that the inference includes an uncertified third-party package not included in the one or more certified package registries, at least one of the following is done: (i) the inference or the uncertified third-party package is edited, or (ii) the inference is modified by including at least the identifier of a certified third-party package as a replacement for the uncertified third-party package.

12. The method of claim 11, wherein the large language model is a generative pre-trained transformer.

13. The method of claim 11, further comprising: When all identified third-party packages in the inference are determined to be uncertified because they are not included in the one or more certified package registries, a new inference is generated, wherein the new inference excludes the uncertified third-party packages.

14. The method of claim 11, wherein parsing the inference includes identifying the programming language of the code in the inference and applying language-specific rules to identify the third-party package.

15. The method of claim 11, wherein the certified package registry is updated in real time to reflect security patches and updates.

Images