通过分析代码大模型内部状态,实现可扩展的代码生成风险评估。
Risk Assessment Framework for Code LLMs via Leveraging Internal States
- 利用无监督预训练学习模型内部状态的通用表征,再用少量标注数据训练风险预测器。
- 在多语言、多任务下实现细粒度代码行级风险检测,准确率显著提升。
- 结果可解释性强,适合企业级软件开发中快速集成使用。
预训练范式是大型语言模型(LLMs)成功的关键,代码类大模型因其强大的编码能力正深刻影响软件工程,有望成为开发者日常工具。然而,现有代码大模型在可信性方面仍面临严峻挑战,可能生成错误、不安全或不可靠的代码。近期研究发现,通过分析模型内部状态可有效识别此类风险输出,类似人类大脑对自身错误的潜意识觉察。但现有方法多局限于特定子领域,难以满足工业级可扩展性和实用性要求。为此,本文提出PtTrust,一种基于内部状态预训练的两阶段代码大模型风险评估框架,可无缝集成至企业现有基础设施。核心思路是将风险评估框架本身也进行预训练:首先在大规模未标注源码上进行无监督预训练,学习模型状态的通用表示;随后利用少量标注数据训练风险预测器。实验表明,PtTrust可在代码行级别实现精细风险评估,并在不同任务与编程语言间良好泛化。进一步分析显示,该框架提供高度直观且可解释的特征,有助于增强用户信任。我们认为,PtTrust为构建可扩展、可信的代码大模型保障体系迈出关键一步。
原文摘要 · Abstract (English)
The pre-training paradigm plays a key role in the success of Large Language Models (LLMs), which have been recognized as one of the most significant advancements of AI recently. Building on these breakthroughs, code LLMs with advanced coding capabilities bring huge impacts on software engineering, showing the tendency to become an essential part of developers' daily routines. However, the current code LLMs still face serious challenges related to trustworthiness, as they can generate incorrect, insecure, or unreliable code. Recent exploratory studies find that it can be promising to detect such risky outputs by analyzing LLMs' internal states, akin to how the human brain unconsciously recognizes its own mistakes. Yet, most of these approaches are limited to narrow sub-domains of LLM operations and fall short of achieving industry-level scalability and practicability. To address these challenges, in this paper, we propose PtTrust, a two-stage risk assessment framework for code LLM based on internal state pre-training, designed to integrate seamlessly with the existing infrastructure of software companies. The core idea is that the risk assessment framework could also undergo a pre-training process similar to LLMs. Specifically, PtTrust first performs unsupervised pre-training on large-scale unlabeled source code to learn general representations of LLM states. Then, it uses a small, labeled dataset to train a risk predictor. We demonstrate the effectiveness of PtTrust through fine-grained, code line-level risk assessment and demonstrate that it generalizes across tasks and different programming languages. Further experiments also reveal that PtTrust provides highly intuitive and interpretable features, fostering greater user trust. We believe PtTrust makes a promising step toward scalable and trustworthy assurance for code LLMs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。