Buckle Up, Buttercup - Our Experience Competing in AIxCC

Quick Overview

Trail of Bits' AI system, Buttercup, secured second place in the AIxCC competition, winning $3 million by effectively integrating conventional software analysis with AI/ML techniques to discover and patch vulnerabilities in open-source software, achieving over 90% accuracy and demonstrating a cost-effective approach to automated cybersecurity.

Key Points: Buttercup achieved second place in the AIxCC finals, securing a $3 million prize by effectively finding and patching vulnerabilities in open-source software. The system's success was attributed to its high accuracy rate of over 90% and its ability to perform well across all competition phases, particularly in patching vulnerabilities which contributed significantly to scoring. Buttercup utilized a hybrid approach, combining static analysis, dynamic analysis, and large language models (LLMs) to discover vulnerabilities, and employed a multi-agent system for patch generation and validation. During the semi-finals, Trail of Bits won 10 out of 42 achievements, demonstrating strong performance, but identified gaps in handling Java challenges and certain CWE types that were addressed for the finals. The finals presented a significant scaling challenge with vastly increased budgets for compute and LLM credits compared to the semi-finals, requiring a rebuild of Buttercup into version 2.0. Buttercup's design prioritized using the best technique for each sub-problem, acknowledging LLM limitations and strengths, and focusing on discovering/proving vulnerabilities, contextualizing them, creating/validating patches, and orchestrating these tasks. Trail of Bits has open-sourced both the semi-final and final versions of Buttercup, as well as a scaled-down standalone variant for laptop use, to promote the advancement of cybersecurity tools.

Context: The AI Cyber Challenge (AIxCC) was a two-year competition where teams designed AI-driven cyber reasoning systems to automatically find and patch bugs in open-source software. Trail of Bits, represented by the team discussing their system 'Buttercup,' participated in this challenge. They began by winning a white paper contest, advancing through semi-finals held at Defcon, and ultimately competing in the finals where Buttercup secured second place and a $3 million prize.