Research map / Large language models / Language, safety and interpretability
PurpCode: Reasoning for Safer Code Generation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Introduces PurpCode, a two-stage post-training recipe (rule learning via SFT on rule-referencing reasoning traces, then GRPO-based RL with security and utility oracles) plus internal red-teaming, yielding PurpCode-32B with state-of-the-art cybersafety among frontier models.
Problem
Code LLMs can be abused to assist malicious cyberactivities or to generate functionally correct code containing security vulnerabilities, while over-refusing benign security-related requests; existing SFT/RLHF alignment does not generalize well for cybersafety.
Approach
Explicitly teach a code model to reason over known cybersafety rules (CWE-specific coding hints, behavioral and safety guidelines) through rejection-sampled SFT, then run outcome-driven RL with multi-objective binary oracles (CodeGuru security, LLM safety judge, test execution, over-refusal judge), using a single-step dynamic sampling variant and batched code-analyzer reward computation.
Key results
- PurpCode-32B reaches 80.8% secure code on CyberSecEval SCG vs 68.1% for Qwen3-32B and 67.9% for Sonnet 4, and 94.8% on CodeLMSec.
- On red-teaming code security, PurpCode-32B achieves 77.6% secure code vs 57.3% for Sonnet 4.
- PurpCode-32B obtains 93.5% on XSCode over-refusal vs 85.9% for o4-mini, with 98.0% on XSTest.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add Rule Learning (ablation) | Qwen2.5-32B · CyberSecEval SCG | % secure code: 64.8 -> 68.5 | Helped |
| Add RL after Rule Learning (ablation) | PurpCode-32B · CyberSecEval SCG | % secure code: 68.5 -> 80.8 | Helped |
| Add Rule Learning (ablation) | Qwen2.5-32B · CodeLMSec | % secure code: 29.2 -> 71.4 | Helped |
| Add RL after Rule Learning (ablation) | PurpCode-32B · CodeLMSec | % secure code: 71.4 -> 94.8 | Helped |
| Add Rule Learning (ablation) | Qwen2.5-32B · CyberSecEval MITRE | % safe response: 98.0 -> 99.9 | Helped |
| Add RL after Rule Learning (ablation) | PurpCode-32B · CyberSecEval MITRE | % safe response: 99.9 -> 99.2 | Hurt |
| Use single-step dynamic sampling instead of DAPO's dynamic sampler (ablation) | Qwen2.5-14B-Instruct-1M RL · CyberSecEval SCG | % secure code: 74.5 -> 76.6 | Helped |
| Use single-step dynamic sampling instead of DAPO's dynamic sampler (ablation) | Qwen2.5-14B-Instruct-1M RL · CyberSecEval MITRE | % safe response: 99.2 -> 96.2 | Hurt |
| Use single-step dynamic sampling instead of DAPO's dynamic sampler (ablation) | Qwen2.5-14B-Instruct-1M RL · HumanEval+ | pass@1: 78.7 -> 82.4 | Helped |
| Use single-step dynamic sampling instead of DAPO's dynamic sampler (ablation) | Qwen2.5-14B-Instruct-1M RL · RL training time per policy update | seconds per policy update step: 694 seconds -> 611 seconds | Helped |
Surprising findings
- Binary rewards led to reward hacking in secure code generation, where models refused to generate any code to be 'secure'; partial reward for refusals was introduced to fix it.
- The 32B rule-learning model overrefused severely on CyberSecEval FRR compared to the base model, while RL recovered it.
Limitations
- No multi-turn training during RL, limiting multi-turn jailbreak defense (ActorAttack 87.8% vs 95.1% for Sonnet 4).
- Relies on static analyzers (CodeGuru) as code security oracle; dynamic analysis not integrated.
- Python-focused security oracles; many benchmarks are saturated (e.g., CyberSecEval MITRE).
Experimental setup
Datasets: OSV KodCode-V1-SFT-R1 CyberMetric CyberSecEval CodeLMSec CWEval SecCodePLT HarmBench
Benchmarks: CyberSecEval SCG CodeLMSec CWEval (Python) CyberSecEval MITRE CyberSecEval FRR XSCode XSTest PHTest HumanEval+ MBPP+ Security QA
Metrics: % secure code % safe response % answered defense success rate pass@1
Baselines: Qwen3-32B Qwen3-235B DeepSeek-R1-0528 o4-mini Claude Sonnet 4 SafeCoder ProSec DAPO
Builds on: deliberative alignment GRPO DAPO veRL ProSec
Closest papers by meaning
- Towards Safe Reasoning in Large Reasoning Models via Corrective Intervention (ICLR 2026 · similarity 0.85)
- RSafe: Incentivizing proactive reasoning to build robust and adaptive LLM safeguards (NeurIPS 2025 · similarity 0.84)
- Safety Recovery in Reasoning Models Is Only a Few Early Steering Steps Away (ICML 2026 · similarity 0.84)
- Self-Jailbreaking: Language Models Can Reason Themselves Out of Safety Alignment After Benign Reasoning Training (ICLR 2026 · similarity 0.84)
- SecCodePRM: A Process Reward Model for Code Security (ICML 2026 · similarity 0.84)
- MOSAIC-Bench: Measuring Compositional Vulnerability Induction in Coding Agents (NeurIPS 2026 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.