CodeLLMExp: An Annotated Dataset for Automated Vulnerability Localization and Explanation in AI-Generated Code

CodeLLMExp is a comprehensive, large-scale, multi-language, and multi-vulnerability dataset created to advance research into the security of AI-generated code. It is specifically designed to train and evaluate machine learning models, such as Large Language Models (LLMs), on the joint tasks of Automated Vulnerability Localization (AVL) and Explainable AI (XAI). The dataset was constructed through a rigorous pipeline that involved sourcing prompts from established security benchmarks (CodeLMSec, SecurityEval, Copilot CWE Scenarios), employing seed augmentation to ensure coverage of under-represented Common Weakness Enumerations (CWEs), and using a chain of LLMs to generate vulnerable code snippets. This raw data was then automatically evaluated for quality by an "LLM-as-judge" (validated against human experts with a Spearman correlation of 0.8545) and enriched with structured annotations. CodeLLMExp covers three of the most widely used programming languages : Python, Java and C. It contains 10,400 high-quality examples across Python (44.3%), Java (29.6%), and C (26.1%). It focuses on 29 distinct CWEs, including the complete CWE Top 25 Most Dangerous Software Errors (2024. Each record in the dataset provides a vulnerable code snippet, the precise line number of the flaw, a structured explanation (root cause, impact, mitigation), and a fixed version of the code. By providing richly annotated data for detection, classification, localization, and explanation, CodeLLMExp enables the development of more robust and transparent security analysis tools. It facilitates research into LLM adaptation strategies (e.g., prompting, fine-tuning, Retrieval-Augmented Generation), automated program repair, and the inherent security patterns of code produced by AI.CodeLLMExp是一款全面、大规模、多语言、多漏洞的数据集，旨在推动AI生成代码的安全性研究。该数据集专为训练和评估机器学习模型而设计，可用于完成自动化漏洞定位（Automated Vulnerability Localization，AVL）与可解释AI（Explainable AI，XAI）的联合任务，适配模型包括大语言模型（Large Language Models，LLMs）。 该数据集的构建流程十分严谨：首先从现有安全基准数据集（CodeLMSec、SecurityEval、Copilot CWE Scenarios）中采集提示词，采用种子增强策略以确保覆盖占比偏低的通用弱点枚举（Common Weakness Enumerations，CWEs），并通过大语言模型链生成含漏洞的代码片段。随后，通过"LLM-as-judge"（经人类专家验证，斯皮尔曼相关系数达0.8545）对原始数据进行自动化质量评估，并补充结构化标注。 CodeLLMExp涵盖Python、Java、C三种主流编程语言，共计10400个高质量样本，其中Python占比44.3%、Java占比29.6%、C占比26.1%。该数据集聚焦29种不同的通用弱点枚举（CWEs），涵盖2024年版《CWE最危险软件错误25强》全部条目。数据集中的每条记录均包含含漏洞的代码片段、漏洞所在的精确行号、结构化解释（涵盖根本原因、影响及缓解措施），以及代码的修复版本。 通过为漏洞检测、分类、定位及解释任务提供富含标注的数据集，CodeLLMExp可助力开发更健壮且透明的安全分析工具。它推动多项研究的开展：包括大语言模型适配策略（如提示工程、微调、检索增强生成（Retrieval-Augmented Generation，RAG））、自动化程序修复，以及AI生成代码的固有安全模式。