Large Language Models (LLMs) show remarkable capabilities in understanding natural language and generating complex code. However, as practitioners adopt CodeLLMs for increasingly critical development tasks, research reveals that these models frequently generate functionally correct yet insecure code, posing significant security risks. While multiple approaches have been proposed to improve security in AI-based code generation, combined benchmarks show these methods remain insufficient for practical use, achieving only limited improvements in both functional correctness and security. This stems from a fundamental gap in understanding the internal mechanisms of code generation and the root causes of security vulnerabilities, forcing researchers to rely on heuristics and empirical observations. In this work, we investigate the internal representation of security concepts in CodeLLMs, revealing that models are often aware of vulnerabilities as they generate insecure code. Through systematic evaluation, we demonstrate that CodeLLMs can distinguish between security subconcepts, enabling a more fine-grained analysis than prior black-box approaches. Leveraging these insights, we propose Secure Concept Steering for CodeLLMs (SCS-Code). During token generation, SCS-Code steers LLMs' internal representations toward secure and functional code output, enabling a lightweight and modular mechanism that can be integrated into existing code models. Our approach achieves superior performance compared to state-of-the-art methods across multiple secure coding benchmarks.
Figures & tables
Fig. 1: Overview of the general framework for concept extraction and model steering.
Fig. 2: Overview of different analysis dimensions for the code security (sub-) concepts.
Fig. 3: Residual stream activations for different layers of Llama3.1-8B projected onto the second principal component, corresponding to the contrastive samples in the Python code security dataset.
Model
Params
Layers
Residual Dim.
Llama2 [ 31 ]
7B
32
4096
Llama3.1 [ 30 ]
8B
32
4096
Mistral-v0.1 [ 32 ]
7B
32
4096
Codellama [ 33 ]
7B
32
4096
Deepseek-Coder-V2-Lite [ 29 ]
16B
27
2048
StarCoder2 [ 34 ]
7B
32
4608
TABLE I: Overview of models used in the experiments, including the number of layers and the dimensionality of the residual stream.
Fig. 4: Alignment of residual stream activations and code security concept vector for Python code, where we color the three highest and lowest alignment values in blue and red shades, respectively.
Fig. 5: PCA and t-SNE projections of concept vectors for a range of concepts from [ 25 ] , and code security concepts for different programming languages.
Model
csp-csc
csp-csj
csc-csj
csp-ccp
csp-halluc.
Llama2
0.92
0.72
0.80
0.09
- 0.21
Llama3
0.85
0.58
0.73
0.02
- 0.13
Deepseek
0.92
0.84
0.88
0.44
N/A
Codellama
0.95
0.86
0.90
0.19
- 0.31
StarCoder
0.89
0.88
0.87
0.30
N/A
TABLE II: Cosine similarities between security concept vectors from different languages, as well as security versus functional correctness and security versus hallucination comparisons.
Fig. 6: PCA and t-SNE projections of Llama3.1-8B activations, where different types of vulnerabilities are marked by color.
Fig. 7: Changes in model decision by positive and negative vsec steering, across all layers of Llama3.1-8B model. For l∈[13,15] , a significant ratio of model decisions changes by adding or subtracting vsec .
TABLE III: Example of the code security steering effect. The code completion generated by the LLM can be manipulated remarkably, changing between insecure and proper input handling depending on steering direction.
Large language models (LLMs) are widely used for code generation, but their security reliability remains inconsistent across languages and prompting strategies. Existing prompt engineering improves functional correctness but rarely ensures consistent security outcomes. We introduce the Mitigation-Aware Chain-of-Thought (MA-CoT) framework, which embeds task-specific CWE mitigation guidance and language-aware safeguards to reduce recurring vulnerabilities in generated code. We evaluate MA-CoT across three LLMs (gpt-5, claude-4.5, gemini-2.5), three programming languages (C, Java, Python), and four prompting strategies (Vanilla, Zero-shot, CoT, MA-CoT) on a 200-task primary dataset, with external validation on LLMSecEval. Using static analysis with expert validation, MA-CoT reduces total security findings from 92 to 39 (57.6%) on the primary dataset and from 73 to 4 (94.5%) on LLMSecEval. High-severity findings (Blocker + Critical) drop from 90 to 39 (56.7%) and from 45 to 2 (95.6%), respectively. Across both datasets, MA-CoT is the only strategy that consistently improves security reliability; Zero-shot and CoT are less reliable and may increase vulnerability, especially in C. We further introduce a strict layered attribution of vulnerability drivers (language-core vs. stack layers) and show that residual risk concentrates in hardening-oriented patterns (e.g., OS- and toolchain-dependent), motivating secure-by-construction primitives alongside prompting.
Mohammed F. Kharma, Mohammad Alkhanafseh, Ahmed Sabbah +1
the Department of Computer Science, Birzeit University, Ramallah, Palestine · the Department of Computer Science, University of Central Florida, Orlando, FL 32816 USA
Large language models (LLMs) are increasingly used for program synthesis, yet they often generate code that is functionally plausible but insecure. Progress in secure code generation has been hindered by benchmarks that are small, non-executable, leak mitigation details, or rely on noisy analyzers and subjective judgments, making it difficult to measure whether security improves without sacrificing correctness. We address these gaps with CodeSecEval, an execution-based benchmark for secure code generation, comprising 255 Python tasks spanning 77 CWE categories. Each task provides paired insecure and secure implementations together with executable functional and vulnerability-targeted security tests, enabling precise and reproducible evaluation of secure code generation and insecure-code repair. Building on CodeSecEval, we propose SecAwareCoder, an agent-based framework that shifts code generation toward secure-by-construction synthesis. SecAwareCoder performs task-adaptive threat modeling to identify security-sensitive regions and derive task-grounded vulnerability hypotheses, uses these hypotheses to guide both constraint-aware code generation and security-aware test synthesis, and leverages execution feedback for targeted refinement. Experiments across multiple LLM backbones show that SecAwareCoder consistently improves Pass@1 and security robustness over prompting and analyzer-driven baselines, narrowing the security--correctness gap in LLM code generation.
Jiexin Wang, Liuwen Cao, Xitong Luo +6
South China University of Technology, Guangzhou, China · University of Innsbruck, Innsbruck, Austria
Large Language Models (LLMs) are widely used for code generation, yet their security behavior in realistic development workflows remains underexplored. Existing benchmarks often rely on explicitly specified security requirements, failing to capture real-world scenarios where prompts are frequently ambiguous or incomplete. In this paper, we adopt a developer-centric perspective and identify three representative risk scenarios that commonly lead to security vulnerabilities in LLM-generated code: Ambiguous Requirements, Under-Specified Operational Context, and Security--Functionality Conflict. Based on these scenarios, we construct a large-scale benchmark comprising 2,700 test cases, enabling fine-grained evaluation of LLM security under realistic conditions. Extensive evaluation of eight state-of-the-art LLMs reveals that all models exhibit average vulnerability rates exceeding 56% across risk scenarios. We further demonstrate that security-aware prompting can substantially mitigate these risks, achieving up to 45% improvement.
Lixun Ma, Ruolong Ma, Bei Wang +4
Zhejiang University, Hangzhou, China · University College London, London, United Kingdom · Artificial Intelligence Institute, CAICT, Beijing, China +1