CASTLE: CWE Automated Security Testing and Low-Level Evaluation

CASTLE evaluates LLM vulnerability detection on 250 hand-crafted, compilable C programs covering 25 CWE types (6 vulnerable, 4 non-vulnerable per CWE). Models receive a system prompt requesting JSON output indicating vulnerability presence and CWE number. Scoring uses the CASTLE Score: +5 for correct vulnerability detection (minus 1 per extra false positive reported), +2 for correct true-negative identification, and -1 per false positive otherwise. TPR and FPR are also reported.

Maintained By

@AI-Sec-dev

Code

castle

Paper

https://arxiv.org/abs/2503.09433

Overview

⚠️ External evaluation. Code lives in an upstream repository. inspect_evals lists it for discoverability; review the upstream repo and pinned commit before running.

Source: AI-Sec-dev/inspect-eval-castle@dc4d5aa

CASTLE evaluates LLM vulnerability detection on 250 hand-crafted, compilable C programs covering 25 CWE types (6 vulnerable, 4 non-vulnerable per CWE). Models receive a system prompt requesting JSON output indicating vulnerability presence and CWE number. Scoring uses the CASTLE Score: +5 for correct vulnerability detection (minus 1 per extra false positive reported), +2 for correct true-negative identification, and -1 per false positive otherwise. TPR and FPR are also reported.

Usage

Installation

This is an externally-maintained evaluation. Clone the upstream repository at the pinned commit and install its dependencies:

git clone https://github.com/AI-Sec-dev/inspect-eval-castle
cd inspect-eval-castle
git checkout dc4d5aa275120b6cc7943b54b67e2278c80f6f4c
uv sync

Running evaluations

CLI

uv run inspect eval src/castle/castle.py@castle --model openai/gpt-5-nano

Python

from inspect_ai import eval
from castle.castle import castle

eval(castle(), model="openai/gpt-5-nano")

View logs

uv run inspect view

More information

For the dataset, scorer, task parameters, and validation, see the upstream repo: AI-Sec-dev/inspect-eval-castle.

Options

You can control a variety of options from the command line. For example:

uv run inspect eval src/castle/castle.py@castle --limit 10 --sample-shuffle
uv run inspect eval src/castle/castle.py@castle --max-connections 10
uv run inspect eval src/castle/castle.py@castle --temperature 0.5

See uv run inspect eval --help for all available options.

More command-line options: Inspect docs ↗