Domain-conditioned prompting does not make generated code more secure — pick a different model instead

arXiv 2607.25225·medium signalXBlueskyLinkedInCopy link

SecDrift ran 5,355 matched-baseline evaluations across 7 LLMs, 8 CISA critical-infrastructure sectors, and 9 CWE categories to test whether telling the model it's writing for healthcare or energy changes vulnerability rates. Industry-conditioned prompts looked 2.7 percentage points safer (14.0% vs 11.4%) but the gap was not significant (Fisher's exact p = 0.24, Cohen's h = -0.08), was driven entirely by CWE-502 and CWE-22, and reversed slightly when those were excluded. Zero of eight sectors showed drift distinguishable from baseline, while model choice moved vulnerability rates from 11.6% to 16.1% — so spend your effort on model selection and scanning, not on sector framing in the prompt.