>If I make my code available, AI can be used to more easily discover vulnerabilities to abuse my coding errors,

Keeping your source code private doesn't save you. These LLMs are really good at decompilation efforts. I've seen an insane number of clean room ports of games the last few weeks (just saw a Zelda 2 PC port this morning). Even with that, I don't share the gloomy perspective of the author.

▲

JoshTriplett 18 hours ago | parent [-]

Anything done with an LLM is not a "clean room".

▲

TeMPOraL 18 hours ago | parent [-]

In this sense, anything done with human experts isn't really "clean room" either.

▲

JoshTriplett 17 hours ago | parent [-]

It absolutely can be.

Suppose you're trying to reverse-engineer some proprietary tool, for instance. If you're doing that with human experts, you pick experts who haven't seen the code of the tool, or any disassembly of the tool, or any potentially tainted non-clean-room analysis of the tool.

Even if you have two separate AI instances do the RE and the reimplementation (which most people don't), the AI you use may well have been trained on the proprietary source code, or on any number of disassemblies/analyses/reimplementations/etc that aren't clean-room.

That's doubly true when people do ridiculous things like AI reimplementations of publicly available GPLed source code, where the AI definitely was trained on the GPLed implementation.

	▲	TeMPOraL 13 hours ago \| parent [-]
		The AI may have been. But so do the humans. You don't know what they did or did not saw over the years, especially before they were employed with you, especially when the topic is RE of some project that has OSS components in it. Chances are, they used or otherwise seen those OSS components, or their clones/copies/forks in the past. This is meaningful because presumably you're not choosing any random SEs for the job - you're choosing people with experience in the same area as the project you're RE-ing, to have a remote chance of completing the work. So with people, much like LLM, there's a good chance they saw the same code and papers the implementers of your target did, and whether your work is clean-room or not boils down to believing or disproving they were not aware of the association.