PurpCode让代码生成模型更安全，能主动避开漏洞和恶意行为。
PurpCode: Reasoning for Safer Code Generation
- 分两阶段训练：先学网络安全规则，再通过强化学习优化安全与实用性。
- 生成的代码零漏洞，相比前沿模型安全性提升显著。
- 适合开发安全型AI编码助手，尤其关注网络安全的团队用得上。
我们提出PurpCode，首个用于训练安全代码推理模型的后训练方案，旨在生成无漏洞代码并防御恶意网络活动。该方法分两阶段：(i) 规则学习，显式教导模型参考网络安全规则以生成无漏洞代码并避免助长恶意行为；(ii) 强化学习，通过多样化的多目标奖励机制优化模型安全性，同时保持代码生成与通用安全知识的能力。为构建全面的网络安全训练数据，我们通过内部红队测试，基于真实任务合成高覆盖率提示，诱导模型暴露不安全行为。基于此，我们开发了推理型编码模型PurpCode-32B，其在网络安全性方面达到当前最佳表现，优于多个前沿模型。同时，该对齐方法在通用及网络安全场景下均降低了模型过度拒绝率，且未牺牲模型实用性。
原文摘要 · Abstract (English)
We introduce PurpCode, the first post-training recipe for training safe code reasoning models towards generating secure code and defending against malicious cyberactivities. PurpCode trains a reasoning model in two stages: (i) Rule Learning, which explicitly teaches the model to reference cybersafety rules to generate vulnerability-free code and to avoid facilitating malicious cyberactivities; and (ii) Reinforcement Learning, which optimizes model safety and preserves model utility through diverse, multi-objective reward mechanisms. To empower the training pipelines with comprehensive cybersafety data, we conduct internal red-teaming to synthesize comprehensive and high-coverage prompts based on real-world tasks for inducing unsafe cyberactivities in the model. Based on PurpCode, we develop a reasoning-based coding model, namely PurpCode-32B, which demonstrates state-of-the-art cybersafety, outperforming various frontier models. Meanwhile, our alignment method decreases the model overrefusal rates in both general and cybersafety-specific scenarios, while preserving model utility in both code generation and common security knowledge.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。