Abstract

Large language models (LLMs) are increasingly used in software development for code generation and editing, yet how security properties evolve under such model-driven code transformations remains poorly understood. Existing benchmarks primarily evaluate functional correctness or discrete vulnerability detection, but do not explicitly characterize the security drift induced by single-step code edits. In this work, we introduce WeSCE, a benchmark for quantifying security drift in code editing under weak-security constraints, where tasks specify only functional objectives without explicit security requirements. WeSCE consists of 400 executable programs derived from real-world code, covering feature addition, feature removal, bug fixing, and refactoring. To quantify security drift, we propose a continuous risk representation that aggregates heterogeneous vulnerability signals through a unified formulation, and define drift measures capturing changes in overall risk, worstcase severity, and vulnerability distribution under code transformations, providing a multi-scale view of security spanning average-case behavior to worst-case emphasis.