Improta, Cristina (2025) Assessing and enhancing code quality in the era of AI-developed software. [Tesi di dottorato]

Documento PDF improta_cristina_38.pdf Visibile a [TBR] Amministratori dell'archivio Download (5MB) | Richiedi una copia

Abstract

The rapid evolution of AI-based code assistants is reshaping the way software is developed, shifting the developer's role from manual implementation to high-level orchestration and review of AI-generated code. Large Language Models (LLMs) are now capable of producing entire software components from natural language prompts, with this code increasingly integrated into production systems. While productivity gains are clear, this shift raises critical concerns about the reliability, security, and overall quality of AI-developed software. Although AI-generated code often appears functionally correct, it may still be prone to critical defects and security vulnerabilities, issues largely overlooked by popular benchmarks focused solely on correctness. Existing research tends to treat these as isolated symptoms without tracing them back to a root cause: the quality of the training data. Evaluation practices are also fragmented, relying on inconsistent tools, metrics, and taxonomies that hinder comparison and reproducibility. This thesis addresses both limitations by systematically linking code quality issues to training data integrity and introducing a standardized evaluation methodology to enable consistent comparisons of AI-generated and human-written code. First, it shows that AI-generated code differs systematically from human-authored code, being shorter, more predictable, and less lexically diverse. Second, it identifies training data corruption as a root cause for low-quality code generation. Through controlled experiments, it demonstrates that both malicious data poisoning and unintentional collection of low-quality code can bias models, leading to low-quality outputs without degrading functional accuracy. As a mitigation, it introduces an automated data cleaning pipeline using static analysis, improving the quality of generated code. Finally, the thesis proposes a standardized quality evaluation methodology that maps tool outputs to established taxonomies such as Orthogonal Defect Classification (ODC) and MITRE’s CWE, enabling rigorous, cross-language and cross-author comparisons. Applied at scale, it reveals consistent disparities between human and AI-generated code in both defect density and vulnerability profiles, particularly in high-severity CWEs.

Downloads

Actions (login required)

Modifica documento