Many Repairs, One Direction: Steering Code Models Toward Safer Cryptographic API Use

Tianhe Lu; Sakuna Harinda Jayasundara; Eric Spero; Ewan Tempero; Robert Biddle; Giovanni Russello

cs.CROct 18, 2026

Many Repairs, One Direction: Steering Code Models Toward Safer Cryptographic API Use

Authors: Tianhe Lu, Sakuna Harinda Jayasundara, Eric Spero, Ewan Tempero, Robert Biddle, Giovanni Russello

Organizations: University of Auckland Auckland, New Zealand

Abstract

Cryptographic API misuse in large language model-generated code can compromise software security. While many existing approaches improve code security by modifying model parameters or inputs, how representation changes associated with different cryptographic API repairs can support a shared intervention for safer code generation remains underexplored. To investigate this, we construct 48,000 matched program pairs across four programming languages and ten cryptographic API misuse categories. Each pair changes a specified API decision while preserving the programming task. Subtracting the misuse program's internal representation from its secure counterpart's gives a repair vector. Across five models, comparisons of mean repair vectors reveal stronger organization by misuse category than by language. These category-specific patterns also support a shared intervention. We introduce CrypSteer, which extracts a shared direction by normalizing repair differences and selecting a principal component aligned with repairs across misuse categories. With model weights fixed, adding one shared direction per model to its internal activations during generation improves aggregate target security rates by 5.28--15.00 percentage points over unsteered generation across languages and misuse categories. These findings connect the shared structure of cryptographic repair representations to a reusable intervention for safer code generation.

Figures & tables

Figure 1: Matched repairs support representation analysis and CrypSteer’s shared generation intervention. Secure-minus-misuse program representations provide repair vectors for analysis and direction construction. The three-dimensional inset visualizes Llama’s 40 repair directions for each language-misuse category combination, using uncentered principal component analysis (PCA). CrypSteer selects a repair-aligned principal component (security PC) and adds a scaled version to token activations during generation, reusing one direction per model across languages and misuse categories.

ID	Misuse definition	Dataset contrast (secure / misuse)
M01	Predictable cryptographic keys	Random / fixed literal key
M02	Insecure mode of encryption	CBC mode / ECB mode
M03	Predictable IVs in CBC mode	Random / constant IV
M04	Short cryptographic keys	2048 / 1024 bits for RSA
M05	Predictable random output	Cryptographic / general-purpose PRNG
M06	Predictable salts for key derivation	Random / constant salt

Table 1: Misuse categories adapted from Mousavi et al. (2024) and instantiated in four languages. Each contrast lists the secure and misuse implementations used to construct a matched pair. CBC and ECB denote cipher block chaining and electronic codebook modes, respectively. IV denotes initialization vector. PRNG denotes pseudorandom number generator. MAC denotes message authentication code. Appendix H specifies the label policies.

Figure 2: Geometry of Llama repair vectors at layer 14. (a) Cosine similarities between 40 cell-mean directions. (b) Row/column ratios of 40 cell-average repair norms. On both axes, 1–10 denote misuse categories M01–M10. Within each category, rows and columns follow the order Java, TypeScript, C#, and Python.

Model	Mean cosine same category across languages	Mean cosine different categories within a language	Category matches	Norm ratio
Llama	0.607	0.130	40/40	19.2
CodeGemma	0.673	0.111	40/40	22.5
Qwen	0.673	0.095	38/40	14.6
Qwen-Coder	0.694	0.118	38/40	14.3
DeepSeek	0.650	0.112	38/40	16.2

Table 2: Full-corpus repair geometry at the selected layer. Category matches use references from other languages. Norm ratio compares the largest and smallest cell-average repair norms.

Model	Positive repairs (%)	Mean cosine	Positive cells
Llama	95.36	0.343	38/40
CodeGemma	88.86	0.332	36/40
Qwen	95.22	0.324	38/40
Qwen-Coder	91.11	0.318	37/40
DeepSeek	97.86	0.337	40/40

Table 3: Held-out alignment of repair vectors. Positive repairs have cosine above zero. Positive cells have positive mean cosine.

Model	Java	TypeScript	C#	Python
Llama	0.930	0.819	0.971	0.990
CodeGemma	0.770	0.615	0.838	0.946
Qwen	0.986	0.996	0.997	0.987
Qwen-Coder	0.950	0.964	0.866	0.986
DeepSeek	0.978	0.991	0.985	0.965

Table 4: Prediction

R^{2}

for 1,013 multi-repair combinations per language using the all-misuse and ten single-repair programs as references.

Figure 3: Python M09 paired span projections using the Llama layer-14 CrypSteer direction. Green and red indicate positive and negative paired projection differences.

Model	Metric (%)	$\alpha=0$	$\alpha=-1$				$\alpha=+1$
Model	Metric (%)	Baseline	Cell DiffMean	Pooled DiffMean	Normalized DiffMean	CrypSteer	Cell DiffMean	Pooled DiffMean	Normalized DiffMean	CrypSteer
Llama	secure@1	62.08	39.28	45.97	37.58	33.22	71.90	72.12	74.88	77.08
	valid@1	72.67	66.97	64.73	58.67	53.78	68.23	70.02	69.47	69.50
	secure-valid@1	47.52	28.25	32.12	23.08	18.20	52.33	54.40	56.33	57.18
CodeGemma	secure@1	46.27	32.23	33.03	30.57	28.63	54.07	53.73	55.45	56.68
	valid@1	37.92	36.27	38.30	36.47	35.25	39.43	36.95	38.37	39.30

Table 5: Single-generation success rates over 6,000 outputs per model and condition. Bold marks the highest secure@1 and secure-valid@1 among the four directions at

\alpha=+1

for each model. Underlining marks the lowest secure@1 at

\alpha=-1

, corresponding to the largest observed decrease.

		Excluded from direction fitting
Model	Metric	None	Language	Misuse	Both
Llama	secure@1	$15.00$	$15.00$	$13.20$	$13.42$
Llama	secure-valid@1	$9.67$	$9.80$	$8.57$	$9.05$
Code Gemma	secure@1	$10.42$	$9.53$	$8.27$	$8.02$
Code Gemma	secure-valid@1	$5.20$	$5.05$	$4.40$	$4.50$
Qwen	secure@1	$10.80$	$11.37$	$10.20$	$9.88$

Table 6: CrypSteer gains over the unsteered baseline in percentage points at

+1\sigma

. None denotes full-source fitting.

Model	Method	secure@1	valid@1	secure- valid@1
Llama	SCS-Code	75.45	72.62	58.47
	Surgical Repair	66.57	70.87	50.62
	CrypSteer	77.08	69.50	57.18
CodeGemma	SCS-Code	51.50	40.35	25.02
	Surgical Repair	51.20	39.58	23.80
	CrypSteer	56.68	39.30	26.53

Table 7: Direction construction comparisons under common

+1\sigma

steering. Bold marks the highest secure@1 and secure-valid@1 among the three methods.

Figure 4: CrypSteer strength responses, with 6,000 outputs per point. Zero is the unsteered baseline.

Appendix figures & tables16 assets

Supplementary material from the paper’s appendix.

Appendix

Functionality	Description	Categories
F1: Symmetric encryption	Encrypt and decrypt data with the same secret key.	M01, M02
F2: Symmetric encryption in CBC mode	Encrypt data using cipher block chaining (CBC) and an IV.	M03
F3: Asymmetric encryption	Encrypt with a public key and decrypt with the private key.	M04
F4: Digital signature	Produce a signature with a private key and verify it with a public key.	M04
F5: Hash functions	Compute a fixed-length digest for detecting changes to data.	M09
F6: Message authentication code (MAC)	Compute a keyed authentication tag to check integrity and authenticity.	M01, M10

Appendix

Table 8: Cryptographic functionalities from Mousavi et al. (2024) , retaining their IDs. Categories identify the targeted misuses in our resource.

Structure	Value placement	Construction
variable_inline	Variable	Inline
variable_helper	Variable	Helper return
callsite_inline	Call site	Inline
callsite_helper	Call site	Helper return

Appendix

Table 9: Four forms of each secure/misuse pair.

Model	Para- meters	Total layers	Selected layer	AUROC $J_{\ell}$	Selected PC	$\sigma$
Llama	8B	32	14	0.783	1	$1.45$
CodeGemma	7B	28	18	0.803	1	$3.74$
Qwen	7B	28	17	0.793	2	$12.26$
Qwen-Coder	7B	28	16	0.821	1	$17.58$
DeepSeek	16B	27	11	0.784	1	$2.72$

Appendix

Table 10: Model settings: layers indexed from zero, layer selection AUROC

J_{\ell}

(Equation 8 ), PCs indexed from one, and intervention scales

\sigma

Figure 6: Structure agreement for 300 originals in Llama layer 14 TypeScript–M02 cell. (a) Each structure contributes 900 cosine values from comparisons with the other three structures within each original. (b) Each structure contributes 300 raw repair norms.

Figure 7: Repair representation geometry for the other four models. Panel definitions and color scales follow Figure 2 .

Model	Category main effect	Language main effect
Llama	64.42%	5.52%
CodeGemma	70.80%	4.67%
Qwen	71.24%	4.67%
Qwen-Coder	72.39%	4.57%
DeepSeek	68.86%	5.17%

Appendix

Table 11: Category and language shares of total centered variation among 40 unit cell directions.

Model	Category ARI	Language ARI
Llama	0.565	$-0.046$
CodeGemma	0.657	$-0.064$
Qwen	0.771	$-0.110$
Qwen-Coder	0.798	$-0.112$
DeepSeek	0.895	$-0.119$

Appendix

Table 12: Agreement of the

k=10

clustering of 40 unit cell directions with category and language labels at the selected layer.

Figure 8: DeepSeek cell directions at the selected layer, visualized with MDS. Colors denote clusters, shapes indicate languages, and point labels identify misuse categories.

Figure 9: Cross-layer repair geometry in all five models.

Figure 10: Full-configuration additive fits for Java across all five models, using their selected layer and shared direction. Each panel contains 1,024 combinations. Dashed lines mark equality.

Model	Comparator	$\Delta$ secure@1		$\Delta$ valid@1		$\Delta$ secure-valid@1
Llama	Baseline	$15.00$	$[12.83,17.18]^{*}$	$-3.17$	$[-5.13,-1.25]^{*}$	$9.67$	$[7.35,11.98]^{*}$
	Cell DiffMean	$5.18$	$[3.25,7.12]^{*}$	$1.27$	$[-0.68,3.22]$	$4.85$	$[2.75,6.95]^{*}$
	Pooled DiffMean	$4.97$	$[3.33,6.62]^{*}$	$-0.52$	$[-2.28,1.22]$	$2.78$	$[0.87,4.68]^{*}$
	Normalized DiffMean	$2.20$	$[0.95,3.47]^{*}$	$0.03$	$[-1.50,1.53]$	$0.85$	$[-0.73,2.43]$
CodeGemma	Baseline	$10.42$	$[8.28,12.60]^{*}$	$1.38$	$[-0.92,3.68]$	$5.20$	$[3.23,7.17]^{*}$
	Cell DiffMean	$2.62$	$[0.73,4.47]^{*}$	$-0.13$	$[-2.27,2.02]$	$0.87$	$[-1.05,2.78]$

Appendix

Table 13: CrypSteer minus each comparator at

+1\sigma

. The baseline is unsteered. Differences are in percentage points, with 95% confidence intervals over 6,000 paired attempts. ∗ denotes Holm-adjusted

p<0.05

		Baseline			Cell DiffMean			Pooled DiffMean			Normalized DiffMean			CrypSteer
Model	Language	secure @1	valid @1	secure- valid@1	secure @1	valid @1	secure- valid@1	secure @1	valid @1	secure- valid@1	secure @1	valid @1	secure- valid@1	secure @1	valid @1	secure- valid@1
Llama	Java	53.53	59.87	33.47	74.33	55.47	42.60	76.73	59.00	46.53	81.00	57.67	48.93	81.33	57.00	48.33
	TypeScript	62.00	73.47	48.47	68.07	66.60	52.87	63.80	67.53	52.73	68.27	67.67	55.20	72.07	67.47	56.47
	C#	62.67	70.47	43.93	70.67	68.93	49.47	71.80	67.33	49.40	72.93	67.87	52.20	74.47	68.07	52.27
	Python	70.13	86.87	64.20	74.53	81.93	64.40	76.13	86.20	68.93	77.33	84.67	69.00	80.47	85.47	71.67
CodeGemma	Java	56.20	37.87	25.80	68.40	39.07	30.93	68.33	37.33	29.47	70.67	37.40	30.47	72.47	39.93	32.00

Appendix

Table 14: Single-generation success rates over 1,500 outputs per model and condition for each language. Bold and underlining mark the highest and second-highest secure@1 and secure-valid@1 among the four directions at

+1\sigma

		Baseline			Cell DiffMean			Pooled DiffMean			Normalized DiffMean			CrypSteer
Model	Category	secure @1	valid @1	secure- valid@1	secure @1	valid @1	secure- valid@1	secure @1	valid @1	secure- valid@1	secure @1	valid @1	secure- valid@1	secure @1	valid @1	secure- valid@1
Llama	M01	55.17	66.17	43.17	68.00	59.50	45.67	66.33	63.17	49.33	68.50	61.00	48.17	67.33	57.67	43.33
	M02	73.17	63.67	48.50	78.67	65.50	56.50	70.50	59.00	50.00	77.50	61.00	56.33	82.33	64.00	61.17
	M03	67.67	50.83	40.33	68.17	43.83	37.33	69.00	39.33	35.50	70.33	44.50	39.67	74.33	48.33	44.17
	M04	63.67	64.50	44.50	82.67	54.33	51.33	80.33	68.17	59.67	82.33	63.83	58.50	83.33	60.17	56.83
	M05	58.00	84.17	46.83	48.83	83.83	38.33	58.83	84.67	46.50	60.17	85.33	49.67	62.83	83.17	50.67

Appendix

Table 15: Single-generation success rates over 600 outputs per model and condition for each misuse category. Bold and underlining mark the highest and second-highest secure@1 and secure-valid@1 among the four directions at

+1\sigma

Model	Comparator	$\Delta$ secure@1		$\Delta$ valid@1		$\Delta$ secure-valid@1
Llama	SCS-Code	$+1.63$	$[-0.17,3.43]$	$-3.12$	$[-5.05,-1.18]^{*}$	$-1.28$	$[-3.38,0.80]$
Llama	Surgical Repair	$+10.52$	$[8.42,12.65]^{*}$	$-1.37$	$[-3.42,0.68]$	$+6.57$	$[4.27,8.87]^{*}$
CodeGemma	SCS-Code	$+5.18$	$[3.02,7.32]^{*}$	$-1.05$	$[-3.13,1.05]$	$+1.52$	$[-0.38,3.42]$
CodeGemma	Surgical Repair	$+5.48$	$[3.40,7.55]^{*}$	$-0.28$	$[-2.42,1.85]$	$+2.73$	$[0.90,4.55]^{*}$
Qwen	SCS-Code	$+3.80$	$[1.57,6.03]^{*}$	$-1.93$	$[-4.33,0.35]$	$+0.48$	$[-2.15,3.00]$
Qwen	Surgical Repair	$+6.67$	$[4.62,8.75]^{*}$	$+0.58$	$[-1.53,2.68]$	$+5.42$	$[3.10,7.77]^{*}$

Appendix

Table 16: CrypSteer minus each comparator at

+1\sigma

. Differences are in percentage points, with 95% confidence intervals over 6,000 paired attempts. ∗ denotes Holm-adjusted

p<0.05

ID	Misuse	Secure use
M01	Cryptographic key from a fixed string, fixed byte array, or general-purpose PRNG	Cryptographic key generated by a CSPRNG or derived by a KDF
M02	AES with ECB mode	AES encryption with other secure modes, such as CBC, CTR, GCM, CCM, OFB, CFB
M03	AES CBC encryption with IV from fixed bytes, a fixed string, or predictable randomness	AES CBC encryption with IV generated by a CSPRNG
M04	RSA key size $<2{,}048$ bits	RSA key size $\geq 2{,}048$ bits
M05	General-purpose PRNG output or a predictable generator seed	CSPRNG output
M06	Fixed salt, or predictably reused salt	Fresh random salt

Appendix

Table 17: Security rules for each misuse category. CSPRNG denotes a cryptographically secure pseudorandom number generator.

Model	Activation extraction	Layer probes	Full-source generation	Source-exclusion generation
Llama	$1.8$	$1.1$	$124.0$	$65.1$
CodeGemma	$2.5$	$0.8$	$104.5$	$56.1$
Qwen	$1.8$	$1.1$	$60.6$	$33.0$
Qwen-Coder	$1.9$	$1.3$	$72.0$	$39.3$
DeepSeek	$3.0$	$1.0$	$194.7$	$103.2$

Appendix

Table 18: Approximate elapsed hours by model and stage. Full source generation includes the unsteered baseline.

Secure Code Generation

Secure code generation studies how to produce code that meets functional requirements while avoiding security vulnerabilities.

See all 48 papers

Surgical Repair of Insecure Code Generation in LLMs
Apr 17, 2026Gustavo Sandoval, Brendan Dolan-Gavitt, Siddharth GargMechanistic Interpretability Secure Code Generation
Tandon School of Engineering New York University · XBOW
JevVibe: Efficient Classification-Guided Secure Code Generation
Sep 28, 2026Arshak Rezvani, Sasha Behrouzi, Ahmad-Reza SadeghiAutomated Program Repair Software Vulnerability Detection
Technical University of Darmstadt, Germany
Interpreting and Steering for Safe and Correct Code Generation
Aug 30, 2026Hao Yan, Ziyu YaoMechanistic Interpretability LLM Security
Department of Computer Science George Mason University, Fairfax, VA

Apr 17, 2026J/K move · Enter open · S save

Surgical Repair of Insecure Code Generation in LLMs

Gustavo Sandoval, Brendan Dolan-Gavitt, Siddharth Garg

Tandon School of Engineering New York University · XBOW

Mechanistic Interpretability Secure Code Generation Activation Steering LLM Code Generation

Open paper AskPDF arXiv

Large language models write production code, and yet they routinely introduce well-known vulnerabilities. We show that this is not a knowledge deficit: the same models that generate insecure code, correctly identify and explain the vulnerability when asked directly, this is a gap we call the Format-Reliability Gap. Mechanistic analysis reveals the cause: security representations are encoded from the earliest layers but remain computationally inert until the final layer, where format-compliance demands compete with them. Because the failure is localized to a single layer, per-vulnerability steering vectors reduce insecure generation by up to 74% with negligible overhead. The mechanism and the fix generalize across five models, three architecture families, and six vulnerability types, suggesting insecure code generation is an interpretability problem, not a training artifact.

Abstract

Secure Code Generation

Explore similar work

Surgical Repair of Insecure Code Generation in LLMs

JevVibe: Efficient Classification-Guided Secure Code Generation

Interpreting and Steering for Safe and Correct Code Generation