AI models churn out thousands of flawed SHA-1 code rewrites

Generative pre-trained transformer models asked to rewrite a cryptographic hash function in C produced more than 150,000 function rewrites, and the vast majority of them were unusable, incorrect, or riddled with software flaws. In a systematic study published in Frontiers in Computer Science, researchers at Sandia National Laboratories and the New Mexico Cybersecurity Center of Excellence prompted three open-source language models to rewrite the four component functions of a SHA-1 implementation, then compiled and tested the results against the official test vectors. The work demonstrates both a striking capability—generating over 100,000 distinct, output-verified versions of the full codebase—and a sobering security risk, since many rewrites were correct for some inputs but wrong for others, contained memory leaks, or behaved differently depending on compiler optimization settings.

The team used Llama-2-70b-chat-hf, Mistral-7B-Instruct-v0.1, and zephyr-7b-alpha, three pre-trained models chosen for their relatively large context windows and general competence with computer code. Rather than prompting the models in isolation, the researchers anchored each request in the full source code and header file using a modified version of the localGPT framework, a retrieval augmented generation approach that feeds word embeddings of the entire codebase into the model before each inference call. Ten hand-crafted prompts were tested, each asking the model to rewrite a function while preserving its functionality, using different variable names, control flow, or obfuscated syntax.

The researchers evaluated each rewrite by substituting it directly into the reference implementation, compiling with both gcc and clang across multiple optimization levels, and running the resulting binaries against the four NIST test vectors for SHA-1. Memory leaks, integer overflows, out-of-bounds writes, and use of uninitialized values were checked using address sanitizers and Valgrind. The testing suite also measured whether the code was stable across compiler optimization settings, whether it produced output at all, and how far the generated hash strings deviated from the correct SHA-1 digest.

Among the rewrites that did compile, the researchers found a wide spectrum of failure modes. Some functions were correct for a subset of test vectors but wrong for others, a particularly dangerous category because such code could pass casual testing and then fail to authenticate data integrity in production. Others were incorrect for all test vectors yet still produced 40-character hexadecimal strings that superficially resembled legitimate hash output, a property the authors flag as a risk because these fake hashes could evade human visual inspection. Several rewrites crashed with segmentation faults, entered apparent infinite loops, or produced different results depending on which compiler optimization level was used, a symptom of undefined behavior in the C source that the compiler is free to interpret in different ways.

The memory analysis revealed over 1,000 instances of use of uninitialized value and conditional jump errors across the rewrites, alongside smaller counts of invalid reads, invalid frees, and integer overflows.

Yet the study also demonstrates a genuine capability. Using SHA-256 checksums of the compiled binaries to cluster implementations that are equivalent despite different syntax, the researchers identified unique correct rewrites of each of the four component functions. By composing these unique versions—one representative from each cluster for each function—they generated 193,024 distinct SHA-1 codebase variants. The vast majority of these composed versions were entirely correct, compilable, output-verified, free of memory leaks and out-of-bounds writes, and stable across compiler settings. The authors note that this composability shows the models can, in effect, act as code mutation tools, generating large numbers of functionally equivalent but syntactically distinct implementations of a cryptographic algorithm.

The choice of SHA-1 as the test case is deliberate. The algorithm is considered cryptographically broken—a practical collision attack was demonstrated in 2017—and is no longer considered secure for validating data integrity, but it remains widely deployed and its implementation is relatively short compared to other cryptographic algorithms, making it a manageable proof-of-concept target. The authors are careful to state that the study does not claim any of the produced variants are cryptographically secure implementations; correctness was assessed only through output verification on the original NIST test vectors, and edge cases were not systematically tested.

The findings carry a clear warning for software security. The researchers caution that arbitrarily using GPT models to create or rewrite source code can introduce serious flaws, some of which would be difficult to detect without rigorous validation and testing. The study also found that some rewrites unintentionally produced hash functions that fit the basic properties of a hash function but are not correct implementations of SHA-1, which could make automated cryptographic algorithm detection in binaries harder, since such detection often relies on identifying known cryptographic constants.

Among the three models tested, Llama-2-70b-chat-hf performed best overall. The proportion of compilable functions increased consistently as inference temperature decreased, but the count of correct rewrites that differed from the original source peaked at temperatures between 0.2 and 0.4, suggesting that some stochasticity is needed to produce genuinely different code but too much randomness degrades quality. Prompt 7, which asked for different variable names and control flow while keeping the function name the same, yielded the best results, while the vaguest prompt, which simply said to obfuscate the code, performed worst. The authors suggest that automated prompt engineering techniques could further improve performance, and that future work should apply the same testing methodology to other cryptographic algorithms and to more complex codebases.

They can produce a remarkable variety of correct implementations when given enough attempts, but the success rate is low enough that any practical use requires extensive automated testing of every output. The researchers frame the technique as a research tool for studying source code variants and fuzzing computer code, not as a solution for writing correct software.

Subject of Research: Using generative pre-trained transformer models to automatically rewrite a SHA-1 cryptographic hash function implementation in C and evaluate the security flaws and correctness of the generated code variants

Article Title: Automated creation of source code variants of a cryptographic hash function implementation using generative pre-trained transformer models

Article References: Pelofske, E., Urias, V., & Liebrock, L. M. (2026). Automated creation of source code variants of a cryptographic hash function implementation using generative pre-trained transformer models. Frontiers in Computer Science, 8, Article 1823339. https://doi.org/10.3389/fcomp.2026.1823339

Image Credits: AI Generated

DOI: 10.3389/fcomp.2026.1823339

Keywords: generative pre-trained transformers, SHA-1, code generation, software security, cryptographic hash function, compiler optimization instability, memory leaks, LLM code rewriting, undefined behavior, malware polymorphism, retrieval augmented generation, C programming