C-to-Rust Fallacy: Automatic Refactoring != Memory Security (arxiv.org)

A recent study evaluates the effectiveness of automatic refactoring tools designed to convert C code into Rust, aiming to improve memory security by leveraging static analysis and Large Language Models (LLMs). While Rust is praised for its strong memory and type safety, the research reveals that merely transforming C code into Rust does not necessarily enhance security. An empirical analysis of four prominent refactoring tools—C2Rust-analyze, CROWN, C2SaferRust, and FLOURINE—examined a dataset of 116 C programs with known memory security bugs. The findings are significant: out of 464 generated Rust programs, over half failed to compile, and a notable number either retained or introduced new memory security vulnerabilities. This research underscores the "C-to-Rust fallacy," demonstrating that automatic refactoring, while improving memory safety, does not equate to enhanced memory security. The results prompt a reevaluation of these automated tools, highlighting the need for a deeper understanding of their limitations and the potential risks of transitioning from C to Rust without comprehensive knowledge of the language's features. The findings are vital for the AI/ML community, as they relate to the broader implications of integrating AI-driven tools in critical programming tasks where safety and security are paramount.