arXiv:2604.09089cs.SEcs.AI2026-04ACL被引 2

通过多层语义聚合提升代码生成安全性,有效减少漏洞产生。

DeepGuard: Secure Code Generation via Multi-Layer Semantic Aggregation

论文配图:DeepGuard: Secure Code Generation via Multi-Layer Semantic Aggregation
图 1 · 摘自论文原文
  • 从多个上层隐藏表示中聚合安全线索,避免最终层信号衰减。
  • 在五种代码模型上平均提升安全正确率11.9%,优于现有基线。
  • 适合关注生成代码安全性的研究人员与工业应用开发者。

用于代码生成的大语言模型可能复制训练数据中的不安全模式。当前主流的安全加固方法是利用最终Transformer层的监督信号进行微调,但该设计存在最终层瓶颈:漏洞判别线索分布在各层,而在优化下一个词预测的输出表示中逐渐减弱。我们通过逐层线性探测发现,漏洞相关信号在中间到上层最为显著,但在最终层明显衰减。基于此,我们提出DeepGuard框架,通过注意力机制聚合多个上层表示,构建分布式安全线索信号。该信号驱动多目标训练中的专用安全分析器,平衡安全性和功能正确性,并支持轻量级推理时引导策略。在五种代码LLM上的实验表明,DeepGuard相比强基线(如SVEN)平均提升安全且正确的生成率11.9%。同时保持功能正确性,并展现出对未见漏洞类型的泛化能力。代码已公开于https://github.com/unknownhl/DeepGuard。

原文摘要 · Abstract (English)

Large Language Models (LLMs) for code generation can replicate insecure patterns from their training data. To mitigate this, a common strategy for security hardening is to fine-tune models using supervision derived from the final transformer layer. However, this design may suffer from a final-layer bottleneck: vulnerability-discriminative cues can be distributed across layers and become less detectable near the output representations optimized for next-token prediction. To diagnose this issue, we perform layer-wise linear probing. We observe that vulnerability-related signals are most detectable in a band of intermediate-to-upper layers yet attenuate toward the final layers. Motivated by this observation, we introduce DeepGuard, a framework that leverages distributed security-relevant cues by aggregating representations from multiple upper layers via an attention-based module. The aggregated signal powers a dedicated security analyzer within a multi-objective training objective that balances security enhancement and functional correctness, and further supports a lightweight inference-time steering strategy. Extensive experiments across five code LLMs demonstrate that DeepGuard improves the secure-and-correct generation rate by an average of 11.9% over strong baselines such as SVEN. It also preserves functional correctness while exhibiting generalization to held-out vulnerability types. Our code is public at https://github.com/unknownhl/DeepGuard.

代码安全LLM多层聚合生成模型

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。