Education DCL: EAGER: Advancing Secure Coding Education: Empowering Students to Safely Utilize AI-powered Coding Assistant Tools

人工智能(AI)的出现改变了软件工程生态系统的面貌。特别是，人工智能支持的编码助手工具(如ChatGPT和GitHub Copilot)被认为有可能彻底改变软件开发格局。这些工具可以通过为开发人员生成样板代码来提高软件开发人员的效率和生产力。不幸的是，这些工具可能会为开发人员生成(或建议)不安全的代码，因为(1)工具依赖的模型可能会无意中从不受信任、未经验证的开源项目的不安全代码片段中学习，或者(2)模型也容易受到中毒攻击。该项目的创新之处在于为计算机科学专业的学生和软件开发人员开发新的课程模块和动手练习，以增强他们在使用这些工具时的安全编码实践。该项目的更广泛的意义和重要性是，在使用人工智能支持的编码助理工具时，让学生和员工掌握安全的编码实践，从而使他们能够在未来开发安全的程序。此外，该项目的活动将用于吸引来自代表性不足群体的本科生学习网络安全。该教育项目的主要目标是帮助学生和劳动力拥有安全的编码实践。首先，这个项目开发了新的动手练习，学生和工作人员可以学习建议的不安全代码如何影响他们的软件，以及软件如何容易受到攻击和被对手利用。这使他们参与到积极的面向安全的学习中，以培养他们在使用人工智能支持的编码助手工具时的安全编码实践。这些动手材料包括一个真实世界的编程环境，学习者应该在那里体验有毒的模型。第二，该项目积极推动本科生/高中生参与研究，包括代表性不足的群体(特别是阿巴拉契亚地区)。第三，项目团队在夏季举办研讨会，帮助参与项目的教师学习如何使用通过该项目开发的动手实验材料。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

The advent of Artificial Intelligence (AI) has transformed the landscape of the software engineering ecosystem. Particularly, AI-powered coding assistant tools (e.g., ChatGPT and GitHub Copilot) are believed to potentially revolutionize the software development landscape. The tools can enhance software developers' efficiency and productivity in software development by generating boilerplate code for developers. Unfortunately, the tools can generate (or suggest) insecure code for developers because (1) the models that the tools rely on can inadvertently learn from insecure code snippets of untrusted, unverified open-source projects, or (2) the models are also vulnerable to poisoning attacks. The project's novelties are to develop new curricular modules and hands-on exercises for computer science students and the software development workforce to enhance their secure coding practices when using the tools. The project's broader significance and importance are to equip students and the workforce with secure coding practices when using AI-powered coding assistant tools, thereby enabling them to develop secure programs in the future. Moreover, this project's activities will be used to attract undergraduate students from underrepresented groups to cybersecurity.The main objective of this education project is to help students and the workforce have secure coding practices. First, this project develops new hands-on exercises where the students and the workforce can learn how suggested insecure code can impact their software and how the software can be vulnerable and exploited by adversaries. This engages them in active security-oriented learning to cultivate their secure coding practices when using AI-powered coding assistant tools. The hands-on materials include a real-world programming environment where the learners are expected to have experience with poisoned models. Second, this project actively pursues the involvement of undergraduate/high school students in research, including underrepresented groups (specifically the Appalachia region). Third, the project team host workshops in the summer to assist participating faculty in learning how to use our hands-on lab materials developed through this projectThis award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.