Secure Code Generation

Follow this topic Ask about this topic

The field asks whether code-generating models can produce programs that work as intended and resist vulnerabilities such as injection, insecure defaults, and memory-safety flaws. Researchers evaluate both properties with CWE-based benchmarks, executable security and functional tests, and static or dynamic analysis across languages and settings from small functions to repositories and infrastructure code. Common approaches include security-aware prompting, fine-tuning and reward-based training, retrieval and tool-guided repair, multi-agent workflows, and inference-time steering of model representations. A central tension is that functional success or knowledge of secure coding does not guarantee secure outputs; results can vary with prompts and context, and methods must reduce vulnerabilities without breaking functionality or relying on unrealistic tests.

Latest papers

48 papers10 papers in the last four weeks, against 1 the four weeks before. 0.1% of all new papers.

Secure and Functional Code Generation with Self-Evaluation
Oct 24, 2026Md Afif Al Mamun, Gias UddinSecure Code Generation Retrieval-Augmented Code Generation
University of Calgary, Calgary, Canada · York University, Toronto, Canada
SPLASH: Contrastive Audit Pressure for Detecting and Localizing Security Hallucinations in Generated Code
Oct 19, 2026Mirza Masfiqur Rahman, MD Ajwad Akil, Imtiaz Karim +3LLM Security Software Vulnerability Detection
Purdue University, USA · University of Texas at Dallas, USA · Cisco Research, USA
Secure Agentic Coding through Counterexample-Grounded Feedback
Oct 19, 2026Tue Le, Anh Nguyen Hoang, Gabriel Sasseville +3Secure Code Generation Agentic Code Generation
Quantum AI & Cyber Security Institute (QACI), FPT Corporation · Mila - Quebec Artificial Intelligence Institute · Université de Montréal +1
Many Repairs, One Direction: Steering Code Models Toward Safer Cryptographic API Use
Oct 18, 2026Tianhe Lu, Sakuna Harinda Jayasundara, Eric Spero +3Secure Code Generation LLM Code Generation
University of Auckland Auckland, New Zealand
Security in LLM-Assisted Coding: A Systematic Literature Review
Oct 11, 2026Liang Yuan, Maryam Khanian Najafabadi, Mashud Rana +1LLM Security Software Security
Australian Catholic University, North Sydney, New South Wales, Australia
SEEK: Agentic Knowledge Graph Retrieval for Secure Code Generation
Oct 10, 2026Varun Gadey, Markus Tohn, Lichao Wu +2Secure Code Generation RAG Security
University of Duisburg-Essen, Germany · University of Bristol, UK · Technical University of Darmstadt, Germany
Last Secure Code Benchmark: Is the Code You Vibe Secure?
Oct 10, 2026Tianyi Wu, Chao Ge, Peng Chen +12Secure Code Generation AI Agent Security Benchmarks
National University of Singapore · Qwen Team, Alibaba Token Hub, Alibaba Group · Cloud Safety and Security, Alibaba Cloud, Alibaba Group
AuraForge: Scaling Security Supervision for Training Coding Agents
Oct 1, 2026Danqing Wang, Songwen Zhao, Harsh Sharma +4AI Coding Agents Software Security
Carnegie Mellon University · University of California, Los Angeles · ScOp Venture Capital.
SecureVibe: Making Vibe Coding More Secure
Sep 29, 2026Danqing Wang, Baolin Peng, Zhepei Wei +8Secure Code Generation Software Security
Carnegie Mellon University · Microsoft Research · University of Virginia, Charlottesville +1
JevVibe: Efficient Classification-Guided Secure Code Generation
Sep 28, 2026Arshak Rezvani, Sasha Behrouzi, Ahmad-Reza SadeghiAutomated Program Repair Software Vulnerability Detection
Technical University of Darmstadt, Germany
CS-Guard: Benchmarking LLM Guardrails for Code Generation Security
Sep 9, 2026Jinyang Li, Mingyu Guo, Hung X. NguyenLLM Guardrails Adversarial Attacks on LLMs
Adelaide University Adelaide, Australia
Interpreting and Steering for Safe and Correct Code Generation
Aug 30, 2026Hao Yan, Ziyu YaoMechanistic Interpretability LLM Security
Department of Computer Science George Mason University, Fairfax, VA
MACGen: Toward Functionally Correct and Secure Code Generation via Multi-Agent Collaboration
Aug 26, 2026Miseon Yu, Jaehoon Choi, Younghan Lee +1Code Generation Secure Code Generation
Seoul National University · Seoul, Republic of Korea · Sungshin Women’s University
Evaluating and Preventing Security Smells in AI-Generated Ansible Code
Aug 25, 2026Pandu Ranga Reddy Konala, Vimal Kumar, David Bainbridge +1Secure Code Generation Software Security
School of Computing and Mathematical Sciences, University of Waikato, Hamilton, New Zealand 3240
Large Language Models at the Intersection of Software Engineering and Software Security:An Evidence-Centered Structured Survey and Research Agenda
Aug 21, 2026Wei Lin, Tao Zhou, Zhaofei Xie +1LLM Evaluation Software Security
Nanjing Liancheng Intelligent Technology Group, Nanjing, China
Vibe Coding and Web Application Security: A Twin-Prompt Study
Aug 21, 2026Darko AndročecSecure Code Generation Software Security
University of Zagreb Faculty of Organization and Informatics Department of Information Systems Development Pavlinska 2, 42000 Varaždin, Croatia
Securing AI-Generated Code: A Just-in-Time Vulnerability Detection and Remediation Pipeline
Aug 17, 2026Mikhail SurikovSecure Code Generation Software Vulnerability Detection
Georgia Institute of Technology Atlanta, Georgia, USA
Security-First Evaluation of Text-to-Terraform: Benchmarking LLMs and SLMs for Secure IaC Generation
Aug 2, 2026Francis Luis Santos Vargas, Rodrigo Brandão Mansilha, Diego KreutzLLM Evaluation Code Generation
AI Horizon Labs, PPGES, Universidade Federal do Pampa (UNIPAMPA), Alegrete, Brazil
EduPluginBench: Executable Assurance for AI-Generated Educational Plugins
Aug 1, 2026Nizam KadirSoftware Security Runtime Assurance
Singapore University of Technology and Design, Science, Mathematics and Technology, Singapore, Singapore
SecDrift: Measuring Sector-Conditioned Security Drift in AI-Generated Code
Jul 28, 2026Narayanaswami Natraj Bharadwaj, Dhivya ChandramouleeswaranCybersecurity LLM Security
Independent Researcher USA
The Illusion of Secure LLM Code: Closing the Security Gap via Iterative Reprompting
Jul 26, 2026Ishpuneet Singh, Shreyas Mahajan, Gurjot Singh +1LLM Prompting Cybersecurity
Department of Computer Science and Engineering, Thapar Institute of Engineering and Technology, Patiala, India · David R. Cheriton School of Computer Science, University of Waterloo, Waterloo, Canada
Poster: Rethinking Security in LLM Code Generation through Real-World Risk Scenarios
Jul 25, 2026Lixun Ma, Ruolong Ma, Bei Wang +4LLM Safety Benchmarks LLM Security
Zhejiang University, Hangzhou, China · University College London, London, United Kingdom · Artificial Intelligence Institute, CAICT, Beijing, China +1
Tool-Guided Retrieval-Augmented Repair for Securing LLM-Generated C Code
Jul 21, 2026Vidyut Sriram, Saatvik Pradhan, Suman SahaAutomated Program Repair Code Generation
The Pennsylvania State University
Functional and Secure Code Generation with Task Vectors
Jul 8, 2026Felix Wang, Anudeep Das, Mei Nagappan +1Code Generation LLM Safety Alignment
University of Waterloo, Waterloo, ON, Canada · KTH Royal Institute of Technology, Stockholm, Sweden
An Empirical Study of Security Calibration in Large Language Models for Code
Jun 30, 2026Mohammed Latif Siddiq, Md. Nafiu Rahman, Joanna C. S. SantosLLM Security Language Model Calibration
University of Notre Dame Notre Dame, IN, USA · Brac University Dhaka, Bangladesh
SoK: AI Secure Code Generation: Progress, Pitfalls, and Paths Forward
Jun 23, 2026Rupam Patir, Keyan Guo, Haipeng Cai +1AI Coding Agents Code Generation Evaluation
University at Buffalo, SUNY
Secure Coding Drift in LLM-Assisted Post-Quantum Cryptography Development: A Gamified Fix
Jun 17, 2026R. D. N. Shakya, C. P. Wijesiriwardana, S. M. Vidanagamachchi +1LLMs for Cybersecurity Secure Code Generation
University of Moratuwa Sri-Lanka, Moratuwa · University of Ruhuna Sri-Lanka, Matara · RMIT University Australia, Melbourne
SPARK: Security Knowledge Priming and Representation-Guided Knowledge Activation for LLM-based Secure Code Generation
Jun 15, 2026Xiaoyun Xu, Lichao Wu, Jona te Lintelo +2Knowledge Augmentation for Language Models LLM Security
Radboud University · University of Bristol · University of Zagreb
Learn from Your Mistakes: Tree-like Self-Play for Secure Code LLMs
Jun 2, 2026Wenqi Chen, Ziyan Zhang, Bin Wang +3RL for Code Generation LLM Self-Correction
University of Electronic Science and Technology of China, Chengdu, China · Peking University, Beijing, China · University of Science and Technology of China, Hefei, China +2
Minimal Prompt Perturbations Lead to Code Vulnerabilities: Prompt Fragility and Hidden-State Signals in Coding LLMs
May 28, 2026Alexander Sternfeld, Andrei Kucharavy, Ljiljana DolamicPrompt Sensitivity Adversarial Attacks on LLMs
IEM, HES-SO, Le Foyer, Techno-Pôle 1, Sierre, Switzerland · Cyber-Defence Campus, armasuisse Science and Technology, Thun, Switzerland

Oct 24, 2026J/K move · Enter open · S save

Secure and Functional Code Generation with Self-Evaluation

Md Afif Al Mamun, Gias Uddin

University of Calgary, Calgary, Canada · York University, Toronto, Canada

Secure Code Generation Retrieval-Augmented Code Generation Execution-Guided Code Generation Code Generation Evaluation

Open paper AskPDF arXiv

Large Language Models (LLMs) can generate functionally correct code that remains insecure. Security-focused fine-tuning can be expensive and is not always available, motivating inference-time approaches. Security-oriented prompting and retrieval can reduce vulnerabilities, but may also remove required behavior or apply defenses incompatible with the task. The challenge is to identify relevant security knowledge and use it to improve security without sacrificing functionality. We present SecGent, an inference-time framework that retrieves weakness context from the Common Weakness Enumeration (CWE) database and applies it to secure code generation. By connecting task specifications to relevant textual CWE records, SecGent provides task-specific security guidance without relying on retrieved vulnerable or patched code examples. Complementary functional and security tests check the resulting implementation, and their execution feedback guides repairs toward satisfying both objectives. We evaluate SecGent with four open-source LLMs and Claude Sonnet 5.5 across five programming languages on the CWEval benchmark. It achieves the highest joint functional--security success against four inference-time baselines for all five models. Across the open-weight models, mean functional-security@1 (FS@1) improves by 15.5% over RAG, with gains in both functionality and security, and by 19.8% over the strongest prompt optimizer compiled for each model. On Sonnet, FS@1 reaches 92.1%, outperforming the strongest baseline AutoGen by 4.8%. In a separate comparison, SecGent outperforms Claude Code with security-focused prompting by over 6% in FS@1. Feedback-guided repair further improves FS@1 by up to 6.7% over generation without feedback, primarily by recovering functionality while checking security.