用任务向量让代码生成既正确又安全，无需事后检查。
Functional and Secure Code Generation with Task Vectors
- 通过任务向量修改模型权重，直接提升代码功能与安全性的双重表现。
- 在六种模型上提升可信代码生成率2.1%至36.0%，未见漏洞类型提升达39.1%。
- 无额外解码开销，推理延迟仅比原模型高0.6%，适合实际部署。
大型语言模型在代码生成中日益普及，但常生成存在功能缺陷或安全漏洞的代码。现有方法多分别评估功能与安全，或在生成后检测漏洞。本文提出新方法 SecVecCoder，利用任务向量算术直接调整模型权重，使代码在生成时即具备功能正确性与安全性，无需后期修正。在 CodeGuard+ 基准上，对三种家族共六种编码大模型测试，相比基线模型，可信代码生成率提升2.1%至36.0个百分点，对未见过的 CWE 漏洞类型提升最高达39.1个百分点。由于仅需修改权重，无需特定解码策略，平均解码延迟仅增加0.6%，可高效集成于实际系统。
原文摘要 · Abstract (English)
Large language models (LLMs) are increasingly used for code generation, but they struggle to generate functional code free of security vulnerabilities. Prior work to improve the secure code generation abilities of such coding LLMs has largely focused on evaluating code functionality and security separately using different datasets, or focused on finding vulnerabilities post-generation. At the same time, the text-generation domain has seen significant work on alignment techniques, where models are tuned such that their outputs exhibit certain qualities (e.g., helpfulness, harmlessness). Of particular interest is task-vector arithmetic, where linear operations on LLM weights can be used to arbitrarily enhance alignment while incurring only minimal computational overhead. We develop a novel method, SecVecCoder, leveraging task vectors to produce trustworthy code that is simultaneously functional and secure without the need for post-generation adjustment. Across six coding LLMs from three families on the CodeGuard+ benchmark, SecVecCoder improves the rate of trustworthy code completions by 2.1-36.0 percentage points over the base model, with improvements on unseen CWE types reaching up to 39.1 percentage points. Since the effectiveness of the coding LLM relies only on changing the model weights, SecVecCoder requires no method-specific decoding and hence achieves a decoding latency within 0.6% of the base model's, on average.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。