SecGent improves secure code generation without dropping required behavior
Original title: Secure and Functional Code Generation with Self-Evaluation
On CWEval, open-weight models gain 15.5% FS@1 over RAG, and Claude Sonnet 5.5 reaches 92.1%.
SecGent is an inference-time framework that retrieves textual Common Weakness Enumeration records matched to a coding task and uses them to guide secure generation, without relying on vulnerable or patched code examples. Functional and security tests then check the result, and execution feedback drives repairs aimed at both goals. Across five languages and four open-source models plus Claude Sonnet 5.5, it recorded the highest joint functional-security success against four inference-time baselines.
- Open-weight mean FS@1 rose 19.8% over the strongest per-model prompt optimizer.
- Sonnet FS@1 of 92.1% beat AutoGen by 4.8 percentage points.
- SecGent also beat security-prompted Claude Code by over 6% FS@1.
- Feedback-guided repair added up to 6.7% FS@1, mainly by restoring functionality.
- Products
- SecGent
- AI models
- Claude Sonnet 5.5
From the original article
1 min read at arxiv.orgLarge Language Models (LLMs) can generate functionally correct code that remains insecure. Security-focused fine-tuning can be expensive and is not always available, motivating inference-time approaches. Security-oriented prompting and retrieval can reduce vulnerabilities, but may also remove required behavior or apply defenses incompatible with the task.
By Md Afif Al Mamun · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.