DualGauge: Automated Joint Security-Functionality Benchmarking of Specification-Only Code Generation by LLMs and Coding Agents

DualGauge is a fully automated framework for jointly evaluating the functional correctness and security of specification-only LLM code generation. This record contains the code, benchmark, and experimental data accompanying the paper "DualGauge: Automated Joint Security-Functionality Benchmarking of Specification-Only Code Generation". DualGauge-Bench.zip contains 307 language-agnostic coding tasks each paired with a functional test suite and a security test suite derived from OWASP and CERT principles, covering 90 CWE categories across Python, C++, and JavaScript. BenchmarkingExperiments.zip contains pre-computed results for all evaluated configurations: 10 representative LLMs (GPT-5 medium, GPT-4.1, Claude Opus 4.7, Claude Sonnet 4.5, Claude Haiku 4.5, Llama-3.1-8B, Qwen3-14B, Qwen2.5-Coder-32B, Codestral-22B, Gemma-3-27B) across Python, C++, and JavaScript; 3 agentic coding systems (Codex, OpenHands, Claude Code); and 45+ Python-only factor sweep configurations covering scale, quantization, extended thinking, instruction tuning, and code specialization. Key finding: Functional correctness substantially overestimates reliable code generation. Even the strongest model achieves only 14.8% joint security-functionality success on Python despite a 38.6% functional pass rate. No model-side factor reliably closes this gap, and agentic scaffolding provides no advantage over direct generation on specification-only tasks.