Research map / Large language models / Instruction and fine-tuning
ProSec: Fortifying Code LLMs with Proactive Security Alignment
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes ProSec, a proactive security alignment pipeline that synthesizes CWE-triggering coding instructions and builds preference data (secure fixes vs. vulnerable code plus utility-preserving pairs) for an extra offline preference-optimization stage on post-trained code LLMs.
Problem
Code LLMs frequently generate insecure code, and existing security alignment via instruction tuning on sparse real-world vulnerability data (SafeCoder) is data-limited and hard to integrate into multi-stage post-training pipelines.
Approach
Synthesize vulnerability-inducing instructions from CWE definitions with a general LLM, sample vulnerable and fixed code from the target model itself, and apply preference optimization (SimPO) as an extra stage, with training-dynamics-based selection of utility-preserving normal pairs.
Key results
- On Phi3-mini-Inst, ProSec reduces average vulnerable code ratio to 33.47% vs 44.72% for SafeCoder-aligned model (25.2% more secure).
- On CodeLlama-7B-Inst, ProSec reaches 26.04% vulnerable ratio vs 40.33% for SafeCoder (35.4% more secure), and utility is maintained or slightly improved (HumanEval-Multi avg 29.02 vs 24.88).
- ProSec synthesized instructions induce about 25x more vulnerable code than a standard instruction-tuning dataset; generalizes to Llama3.2-1B, Phi4-mini, and Qwen2.5-Coder-3B with 7.3 to 12.5 point reductions in vulnerable ratio.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| align with ProSec rather than SafeCoder | Phi3-mini-Inst · PurpleLlama | Vulnerable Code Ratio (Avg.): 44.72 v.s. 33.47 | Helped |
| align with ProSec rather than SafeCoder | CodeLlama-7B-Inst · PurpleLlama | Vulnerable Code Ratio (Avg.): 40.33 v.s. 26.04 | Helped |
| align with ProSec rather than the original model | Phi3-mini-Inst · HumanEval-Multi | pass@1 (Avg.): 32.39 -> 34.15 | Helped |
| align with ProSec rather than the original model | CodeLlama-7B-Inst · MXEval | pass@1 (Avg.): 34.52 -> 39.89 | Helped |
| use ProSec training-dynamics selection instead of random selection at D_norm ratio 0.1 (ablation) | preference data selection · sampled PurpleLlama subset | Vul (%): 6.02 -> 5.92 | Helped |
| use ProSec training-dynamics selection instead of random selection at D_norm ratio 0.1 (ablation) | preference data selection · sampled MXEval subset | Util (%): 12.30 -> 15.28 | Helped |
| use ProSec training-dynamics selection instead of random selection at D_norm ratio 0.3 (ablation) | preference data selection · sampled PurpleLlama subset | Vul (%): 32.78 -> 27.54 | Helped |
| use ProSec training-dynamics selection instead of random selection at D_norm ratio 0.7 (ablation) | preference data selection · sampled PurpleLlama subset | Vul (%): 30.92 -> 25.58 | Helped |
| add -r(x_n,y_f) to f (ablation) | training-dynamics influence score · sampled PurpleLlama subset | Vul (%): 23.02 -> 23.17 | No clear effect |
| replace g with DECREASE (ablation) | training-dynamics influence score · sampled PurpleLlama subset | Vul (%): 23.02 -> 27.12 | Hurt |
| replace g with DECREASE (ablation) | training-dynamics influence score · sampled MXEval subset | Util (%): 45.94 -> 46.44 | Helped |
| add D_norm examples to SafeCoder alignment data (ablation) | SafeCoder alignment · sampled PurpleLlama subset | Vul (%): 33.1 -> 34.4 | No clear effect |
Surprising findings
- Using the static analyzer to select secure fixed code (rather than any non-triggering response) is necessary because non-triggering code can still bypass dangerous logic without being secure.
- Aligned models sometimes slightly improve utility over the original model, which the authors attribute to the greater complexity of security-related scenarios.
Limitations
- Offline preference optimization only; no online RL with static analyzer or compiler feedback explored.
- Relies on a static analyzer as oracle, which limits detected vulnerability types; evaluation on a random subset of PurpleLlama due to resource limits.
- Only 38 language-CWE pairs overlapping with SafeCoder are evaluated.
Experimental setup
Datasets: Infinity-Instruct (code subset) SafeCoder dataset PurpleLlama HumanEval-Multi MXEval
Benchmarks: PurpleLlama HumanEval-Multi MXEval
Metrics: vulnerable code ratio pass@1
Baselines: SafeCoder SafeCoder-Inst iterative refinement Phi3-mini-Inst CodeLlama-7B-Inst
Builds on: SimPO SafeCoder Infinity-Instruct Kendall Tau correlation
Closest papers by meaning
- Instruction Tuning for Secure Code Generation (ICML 2024 · similarity 0.89)
- CodeMimicry: Exploiting Safety Generalization Lag in Large Language Models via Structured Code Completion (NeurIPS 2026 · similarity 0.88)
- SecCodePRM: A Process Reward Model for Code Security (ICML 2026 · similarity 0.88)
- Security Attacks on LLM-based Code Completion Tools (AAAI 2025 · similarity 0.88)
- Safety Alignment Should be Made More Than Just a Few Tokens Deep (ICLR 2025 · similarity 0.87)
- DOMAINEVAL: An Auto-Constructed Benchmark for Multi-Domain Code Generation (AAAI 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.