Pith. sign in

REVIEW 2 major objections 5 minor 37 references

Task-vector arithmetic can steer coding LLMs so the same completion is both functional and secure, without special decoding.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-10 16:06 UTC pith:XC7CG4HB

load-bearing objection Clean empirical win: LPO task vectors plus a Secure-Anchored operator raise joint functional+secure rates on six coding models with almost no inference cost. the 2 major comments →

arxiv 2607.07881 v1 pith:XC7CG4HB submitted 2026-07-08 cs.SE cs.CRcs.LG

Functional and Secure Code Generation with Task Vectors

Felix Wang , Anudeep Das , Mei Nagappan , N. Asokan This is my paper
classification cs.SE cs.CRcs.LG
keywords task vectorssecure code generationcoding LLMslocalized preference optimizationCodeGuard+trustworthy codeweight arithmetic
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Coding assistants often produce working code that still contains security flaws, and most prior fixes either retrain heavily or slow generation with extra checks. This paper argues that linear combinations of model weights—task vectors learned from paired secure and vulnerable examples—can bake both properties into the model itself. The resulting method, SecVecCoder, uses localized preference optimization to extract a secure direction and an insecure direction, then applies a secure-anchored combination that keeps the base model’s coding ability while suppressing the insecure direction. On six open coding models evaluated with CodeGuard+, which scores functionality and security on the same completions, the steered models raise the joint success rate by several to tens of percentage points, generalize to CWE types never seen in training, and keep ordinary decoding latency essentially unchanged. A reader who builds or deploys coding assistants should care because the approach offers a cheap, once-and-done weight edit that does not require a second model or constrained decoder at inference time.

Core claim

LPO-derived secure and insecure task vectors, combined by the secure-anchored rule W_base + τ_sec − θ τ_insec with θ = 1.5, raise the rate of completions that are simultaneously functional and secure by 2.1–36.0 percentage points over the corresponding base models on CodeGuard+, reach the highest joint score on five of six models, and retain most of that gain on CWE classes absent from the training pairs, all while leaving standard autoregressive decoding latency within roughly half a percent of the base model.

What carries the argument

SecVecCoder: the secure-anchored task-vector operator W_steered = W_base + τ_sec − θ τ_insec, where τ_sec and τ_insec are weight differences obtained by localized preference optimization on paired secure and vulnerable completions of the same instruction.

Load-bearing premise

The six validation scenarios used to pick the steering operator and the single scalar strength θ = 1.5 are assumed representative enough that the same fixed choice stays near-optimal on the held-out test scenarios.

What would settle it

Re-run the same six models on the full CodeGuard+ main-CWE and unseen-CWE splits after re-selecting θ independently per model (or after expanding the validation set); if the joint sec-pass@1 gains over the base models disappear or reverse for most models, the fixed-θ claim fails.

Watch this falsifier — get emailed when new claim-graph text bears on it.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. The paper proposes SecVecCoder, which constructs secure and insecure task vectors from LPO-fine-tuned LoRA adapters on paired secure/vulnerable code and applies Secure-Anchored arithmetic (W_base + τ_sec − θ τ_insec with θ = 1.5) to produce a single set of weights that generate code that is simultaneously functional and secure. On CodeGuard+, which jointly measures functionality (unit tests) and security (CodeQL), the method improves sec-pass@1 by 2.1–36.0 percentage points over the base model across six coding LLMs from three families, reaches the highest main-CWE sec-pass@1 on five of the six models, generalizes to unseen CWE types by up to 39.1 points, and keeps decoding latency within 0.6 % of the base model while using far less training compute than SafeCoder or SCoDE. Supporting analyses compare three fine-tuning sources, three steering operators, a range of θ values, temperature sensitivity, and component ablations.

Significance. If the empirical results hold, the work supplies a practical, low-overhead route to trustworthy code generation that unifies the benefits of training-time and inference-time defenses: the security signal is baked into the weights once, standard autoregressive decoding is retained, and the steering strength remains modulable. The joint functionality-and-security evaluation on CodeGuard+, the systematic operator/strength/fine-tuning ablations, the training-cost and latency measurements, and the public artifact strengthen the contribution relative to prior secure-code work that often reports security and functionality on separate benchmarks. The approach is immediately usable by practitioners who already fine-tune coding models with LoRA.

major comments (2)
  1. Section V-A2 and Table V: on DeepSeek-Coder-6.7B the method under-performs SVEN, SafeCoder and DeepGuard on main-CWE sec-pass@1 (68.2 % vs. 75.5 / 79.3 / 68.7). The paper notes that a higher θ might help but does not verify it. Because the abstract and contribution list claim state-of-the-art on five of six models, a short per-model θ sweep (or an explicit statement that the fixed θ = 1.5 choice is deliberately sub-optimal for this model) is needed to keep the SOTA claim precise.
  2. Section IV-D and V-A1: operator and the single scalar θ = 1.5 are selected on only six validation scenarios, then frozen for all held-out main-CWE and unseen-CWE tests. Figure 3 already shows that LPO Secure-Anchored remains positive across a range of θ and that θ = 1.5 maximises the mean, so the central existence claim is not falsified; nevertheless a leave-one-CWE-out or multi-seed sensitivity check would make the fixed-hyperparameter protocol more robust.
minor comments (5)
  1. Table I caption and surrounding text: clarify that “sign agreement” is computed only over non-zero parameters and state whether the cosine is taken after flattening all LoRA matrices.
  2. Figure 3: the seven discrete θ values are hard to distinguish in some panels; adding a small legend or using distinct markers would improve readability.
  3. Equation (12): the regularisation term that keeps non-security tokens is written with ε, but the hyper-parameter table lists (ε, β, γ) without restating the precise schedule used for the three-to-five-epoch LPO runs.
  4. Section II-B: a one-sentence comparison of training-corpus size and CWE coverage between the SVEN pairs used here and the larger SafeCoder/SCoDE corpora would help readers interpret the efficiency numbers in Table VI.
  5. Minor typographical inconsistencies appear in the arXiv header (e.g., “SecVec-Coder” vs. “SecVecCoder”) and in a few table column headers; a final pass would clean them.

Circularity Check

0 steps flagged

No significant circularity: empirical method selection and external-benchmark evaluation; results not forced by construction or self-citation.

full rationale

SecVecCoder is an empirical engineering paper. Task vectors are defined by ordinary weight differences (Eq. 1: au_sec = W_sec − W_base, au_insec = W_vul − W_base) after independent LoRA fine-tunes; the three steering operators (Eqs. 3–5) are linear combinations whose coefficients are free scalars. The paper selects the fine-tuning source (LPO), operator (Secure-Anchored) and scalar heta = 1.5 by inspecting cosine/sign-agreement diagnostics (Table I) and a six-scenario validation sweep (Figure 3, Section V-A1), then reports sec-pass@1 on held-out CodeGuard+ main-CWE and unseen-CWE splits against external baselines (SVEN, SafeCoder, CoSec, SCoDE, DeepGuard). None of these steps reduces a claimed “prediction” to its own inputs by definition: the reported percentage-point gains are measured quantities, not algebraic identities. LPO and task-vector arithmetic are cited from independent prior work (Hasan et al., Ilharco et al.); no uniqueness theorem or ansatz is imported from the present authors. Hyper-parameter choice on a small validation set is ordinary practice and does not make the test-set numbers tautological. Consequently the derivation chain contains no self-definitional loop, fitted-input-as-prediction, load-bearing self-citation, or renaming of a known result.

Axiom & Free-Parameter Ledger

3 free parameters · 3 axioms · 1 invented entities

The central empirical claim rests on a small set of free scalars chosen on validation data, standard LoRA/SFT/LPO assumptions, and the domain premise that CodeGuard+ unit tests plus CodeQL queries adequately proxy ‘trustworthy’ code. No new physical entities are postulated.

free parameters (3)
  • steering strength θ = 1.5
    Selected as 1.5 after sweeping {0.5,1.0,1.5,2.0} on six validation scenarios; the reported gains depend on this fixed value.
  • LoRA rank / alpha / dropout = 16 / 32 / 0.1
    Fixed at rank 16, alpha 32, dropout 0.1 for all adapters; not swept in the main results.
  • LPO (ε, β, γ) = (0.05, 10.0, 5.4)
    Hyper-parameters of the preference loss taken from the original LPO paper and used without re-tuning for every model.
axioms (3)
  • domain assumption Linear task-vector arithmetic in weight space approximately composes the behaviors of the source fine-tunes.
    Inherited from Ilharco et al. and used throughout Section III without re-derivation.
  • domain assumption CodeGuard+ unit tests plus CodeQL CWE queries jointly measure ‘trustworthy’ code.
    Stated as the evaluation criterion in Section IV-E; security ground truth is therefore static-analysis based.
  • domain assumption Paired secure/vulnerable completions that share the same prompt isolate security-relevant token differences.
    Justifies the use of LPO masks (Section III-C and IV-B).
invented entities (1)
  • Secure-Anchored steering operator no independent evidence
    purpose: Keeps the full secure task vector while subtracting a scaled insecure vector, claimed to preserve functionality better than pure negation or contrast.
    Defined in Eq. (5); its superiority is purely empirical on the chosen benchmark.

pith-pipeline@v1.1.0-grok45 · 25738 in / 2433 out tokens · 28713 ms · 2026-07-10T16:06:11.996822+00:00 · methodology

0 comments
read the original abstract

Large language models (LLMs) are increasingly used for code generation, but they struggle to generate functional code free of security vulnerabilities. Prior work to improve the secure code generation abilities of such coding LLMs has largely focused on evaluating code functionality and security separately using different datasets, or focused on finding vulnerabilities post-generation. At the same time, the text-generation domain has seen significant work on alignment techniques, where models are tuned such that their outputs exhibit certain qualities (e.g., helpfulness, harmlessness). Of particular interest is task-vector arithmetic, where linear operations on LLM weights can be used to arbitrarily enhance alignment while incurring only minimal computational overhead. We develop a novel method, SecVecCoder, leveraging task vectors to produce trustworthy code that is simultaneously functional and secure without the need for post-generation adjustment. Across six coding LLMs from three families on the CodeGuard+ benchmark, SecVecCoder improves the rate of trustworthy code completions by 2.1-36.0 percentage points over the base model, with improvements on unseen CWE types reaching up to 39.1 percentage points. Since the effectiveness of the coding LLM relies only on changing the model weights, SecVecCoder requires no method-specific decoding and hence achieves a decoding latency within 0.6% of the base model's, on average.

Figures

Figures reproduced from arXiv: 2607.07881 by Anudeep Das, Felix Wang, Mei Nagappan, N. Asokan.

Figure 1
Figure 1. Figure 1: Overview of our methodology. From a base model [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Geometry of the three task-vector steering operators, shown in a schematic 2-D parameter space. In each panel the base model [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Effect of steering strength θ on sec-pass@1 for SFT, SafeCoder-style, and LPO steering, across steering operators. Dashed gray lines show the base model; green and red horizontal lines show the corresponding Wsec and Wvul. Higher is better for sec-pass@1. Wbase for Secure-Anchored LPO-derived Wsteered is max￾imized at θ = 1.5, achieving 28.3% improvement, while retaining positive gains for all six models (… view at source ↗
Figure 4
Figure 4. Figure 4: Effect of sampling temperature on Secure-Anchored LPO steering. [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Decoding latency (20-tokens) of Wsteered relative to Wbase for SaferCoder and SecVecCoder. (Points show mean latency differences across 5 runs and error bars represent 95% confidence intervals). Green shade indicates ±3% bound and blue indicates ±5% bound. TABLE VII COMPONENT ABLATION ON THE MAIN CWES AT θ = 1.5. ALL VALUES ARE PERCENTAGES. ↑ INDICATES THAT HIGHER VALUES ARE BETTER. Model Configuration pas… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

37 extracted references · 37 canonical work pages · 8 internal anchors

  1. [1]

    Evaluating Large Language Models Trained on Code

    M. Chen, J. Tworek, H. Jun, Q. Yuan, H. P. de Oliveira Pinto, J. Kaplan, H. Edwards, Y . Burda, N. Joseph, G. Brockman, A. Ray, R. Puri, G. Krueger, M. Petrov, H. Khlaaf, G. Sastry, P. Mishkin, B. Chan, S. Gray, N. Ryder, M. Pavlov, A. Power, L. Kaiser, M. Bavarian, C. Winter, P. Tillet, F. P. Such, D. Cummings, M. Plappert, F. Chantzis, E. Barnes, A. Her...

    work page internal anchor Pith review Pith/arXiv arXiv 2021

  2. [2]

    A survey on large language models for software engineering,

    Q. Zhang, C. Fang, Y . Xie, Y . Zhang, S. Yu, W. Sun, Y . Yang, and Z. Chen, “A survey on large language models for software engineering,”Sci. China Inf. Sci., vol. 69, no. 4, 2026. [Online]. Available: https://doi.org/10.1007/s11432-025-4670-0

    work page doi:10.1007/s11432-025-4670-0 2026

  3. [3]

    Asleep at the keyboard? assessing the security of github copilot’s code contributions,

    H. Pearce, B. Ahmad, B. Tan, B. Dolan-Gavitt, and R. Karri, “Asleep at the keyboard? assessing the security of github copilot’s code contributions,”Commun. ACM, vol. 68, no. 2, p. 96–105, Jan. 2025. [Online]. Available: https://doi.org/10.1145/3610721

    work page doi:10.1145/3610721 2025

  4. [4]

    Thiruvathukal, and James C

    N. Perry, M. Srivastava, D. Kumar, and D. Boneh, “Do users write more insecure code with ai assistants?” inProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’23. New York, NY , USA: Association for Computing Machinery, 2023, p. 2785–2799. [Online]. Available: https://doi.org/10.1145/3576915.3623157

    work page doi:10.1145/3576915.3623157 2023

  5. [5]

    Lost at c: a user study on the security implications of large language model code assistants,

    G. Sandoval, H. Pearce, T. Nys, R. Karri, S. Garg, and B. Dolan-Gavitt, “Lost at c: a user study on the security implications of large language model code assistants,” inProceedings of the 32nd USENIX Conference on Security Symposium, ser. SEC ’23. USA: USENIX Association, 2023

    work page 2023

  6. [6]

    A user-centered security evaluation of copilot,

    O. Asare, M. Nagappan, and N. Asokan, “A user-centered security evaluation of copilot,” inProceedings of the IEEE/ACM 46th International Conference on Software Engineering, ser. ICSE ’24. New York, NY , USA: Association for Computing Machinery, 2024. [Online]. Available: https://doi.org/10.1145/3597503.3639154

    work page doi:10.1145/3597503.3639154 2024

  7. [7]

    Large language models for code: Security hardening and adversarial testing,

    J. He and M. Vechev, “Large language models for code: Security hardening and adversarial testing,” inProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’23. New York, NY , USA: Association for Computing Machinery, 2023, p. 1865–1879. [Online]. Available: https://doi.org/10.1145/3576 915.3623175

    work page doi:10.1145/3576 2023

  8. [8]

    Instruction tuning for secure code generation,

    J. He, M. Vero, G. Krasnopolska, and M. Vechev, “Instruction tuning for secure code generation,” inProceedings of the 41st International Conference on Machine Learning, ser. ICML’24. JMLR.org, 2024

    work page 2024

  9. [9]

    DeepGuard: Secure code generation via multi-layer semantic aggregation,

    L. Huang, Z. Liu, Y . Wu, T. Yin, D. li, J. Bi, N. Mu, H. Zhang, and M. Yan, “DeepGuard: Secure code generation via multi-layer semantic aggregation,” inProceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), M. Liakata, V . P. Moreira, J. Zhang, and D. Jurgens, Eds. San Diego, California, United St...

    work page 2026

  10. [10]

    Steer your model: Secure code generation with contrastive decoding,

    L. Huang, M. Yan, T. Yin, W. Sun, Z. Liu, H. Zhang, and D. Lo, “Steer your model: Secure code generation with contrastive decoding,”IEEE Transactions on Software Engineering, vol. 52, no. 3, pp. 809–834, 2026

    work page 2026

  11. [11]

    Vulnerability detection with code language models: How far are we?

    Y . Ding, Y . Fu, O. Ibrahim, C. Sitawarin, X. Chen, B. Alomair, D. Wagner, B. Ray, and Y . Chen, “Vulnerability detection with code language models: How far are we?” inProceedings of the IEEE/ACM 47th International Conference on Software Engineering, ser. ICSE ’25. IEEE Press, 2025, p. 1729–1741. [Online]. Available: https://doi.org/10.1109/ICSE55347.2025.00038

    work page doi:10.1109/icse55347.2025.00038 2025

  12. [12]

    A systematic literature review on automated software vulnerability detection using machine learning,

    N. Shiri Harzevili, A. Boaye Belle, J. Wang, S. Wang, Z. M. J. Jiang, and N. Nagappan, “A systematic literature review on automated software vulnerability detection using machine learning,”ACM Comput. Surv., vol. 57, no. 3, Nov. 2024. [Online]. Available: https://doi.org/10.1145/3699711

    work page doi:10.1145/3699711 2024

  13. [13]

    Vulrepair: a t5-based automated software vulnerability repair,

    M. Fu, C. Tantithamthavorn, T. Le, V . Nguyen, and D. Phung, “Vulrepair: a t5-based automated software vulnerability repair,” in Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, ser. ESEC/FSE 2022. New York, NY , USA: Association for Computing Machinery, 2022, p. 935–947. ...

    work page doi:10.1145/3540250.3549098 2022

  14. [14]

    SeCuRepair: Semantics-aligned, curriculum-driven, and reasoning- enhanced vulnerability repair framework,

    C. Yang, T. Zhang, J. Jiang, X. Zhou, H. Tian, M. Du, J. Shi, J. Chen, Y . Li, E. L. Ouh, L. K. Shar, and D. Lo, “SeCuRepair: Semantics-aligned, curriculum-driven, and reasoning- enhanced vulnerability repair framework,” inProceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), M. Liakata, V . P. Mo...

    work page 2026

  15. [15]

    Examining zero-shot vulnerability repair with large language models,

    H. Pearce, B. Tan, B. Ahmad, R. Karri, and B. Dolan-Gavitt, “Examining zero-shot vulnerability repair with large language models,” in2023 IEEE Symposium on Security and Privacy (SP), 2023, pp. 2339–2356

    work page 2023

  16. [16]

    Cosec: On-the-fly security hardening of code llms via supervised co-decoding,

    D. Li, M. Yan, Y . Zhang, Z. Liu, C. Liu, X. Zhang, T. Chen, and D. Lo, “Cosec: On-the-fly security hardening of code llms via supervised co-decoding,” inProceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis, ser. ISSTA

    work page

  17. [17]

    1428–1439

    New York, NY , USA: Association for Computing Machinery, 2024, p. 1428–1439. [Online]. Available: https://doi.org/10.1145/3650 212.3680371

    work page doi:10.1145/3650 2024

  18. [18]

    Constrained Decoding for Secure Code Generation

    Y . Fu, E. Baker, Y . Ding, and Y . Chen, “Constrained decoding for secure code generation,” 2024. [Online]. Available: https: //arxiv.org/abs/2405.00218

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  19. [19]

    Ai alignment: A contemporary survey,

    J. Ji, T. Qiu, B. Chen, J. Zhou, B. Zhang, D. Hong, H. Lou, K. Wang, Y . Duan, Z. He, L. Vierling, Z. Zhang, F. Zeng, J. Dai, X. Pan, H. Xu, A. O’Gara, K. Ng, B. Tse, J. Fu, S. Mcaleer, Y . Wang, M. Yang, Y . Liu, Y . Wang, S.-C. Zhu, Y . Guo, Y . Yang, and W. Gao, “Ai alignment: A contemporary survey,”ACM Comput. Surv., vol. 58, no. 5, Nov. 2025. [Online...

    work page doi:10.1145/3770749 2025

  20. [20]

    Direct preference optimization: Your language model is secretly a reward model,

    R. Rafailov, A. Sharma, E. Mitchell, C. D. Manning, S. Ermon, and C. Finn, “Direct preference optimization: Your language model is secretly a reward model,” inAdvances in Neural Information Processing Systems, A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine, Eds., vol. 36. Curran Associates, Inc., 2023, pp. 53 728–53 741. [Online]. Ava...

    work page 2023

  21. [21]

    Training language models to follow instructions with human feedback,

    L. Ouyang, J. Wu, X. Jiang, D. Almeida, C. Wainwright, P. Mishkin, C. Zhang, S. Agarwal, K. Slama, A. Ray, J. Schulman, J. Hilton, F. Kelton, L. Miller, M. Simens, A. Askell, P. Welinder, P. F. Christiano, J. Leike, and R. Lowe, “Training language models to follow instructions with human feedback,” inAdvances in Neural Information Processing Systems, S. K...

    work page 2022

  22. [22]

    Editing models with task arithmetic,

    G. Ilharco, M. T. Ribeiro, M. Wortsman, L. Schmidt, H. Hajishirzi, and A. Farhadi, “Editing models with task arithmetic,” inThe Eleventh International Conference on Learning Representations, ICLR 2023, Kigali, Rwanda, May 1-5, 2023. OpenReview.net, 2023. [Online]. Available: https://openreview.net/forum?id=6t0Kwf8-jrj

    work page 2023

  23. [23]

    Model soups: averaging weights of multiple fine-tuned models improves accuracy without increasing inference time,

    M. Wortsman, G. Ilharco, S. Y . Gadre, R. Roelofs, R. Gontijo-Lopes, A. S. Morcos, H. Namkoong, A. Farhadi, Y . Carmon, S. Kornblith, and L. Schmidt, “Model soups: averaging weights of multiple fine-tuned models improves accuracy without increasing inference time,” inProceedings of the 39th International Conference on Machine Learning, ser. Proceedings of...

    work page 2022

  24. [24]

    Ties- merging: Resolving interference when merging models,

    P. Yadav, D. Tam, L. Choshen, C. Raffel, and M. Bansal, “Ties- merging: Resolving interference when merging models,” inAdvances in Neural Information Processing Systems, A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine, Eds., vol. 36. Curran Associates, Inc., 2023, pp. 7093–7115. [Online]. Available: https://proceedings.neurips.cc/paper...

    work page 2023

  25. [25]

    Steering language models with weight arithmetic,

    C. Fierro and F. Roger, “Steering language models with weight arithmetic,” inThe Fourteenth International Conference on Learning Representations, 2026. [Online]. Available: https://openreview.net/for um?id=S0D3EFWohd

    work page 2026

  26. [26]

    Code Llama: Open Foundation Models for Code

    B. Rozi `ere, J. Gehring, F. Gloeckle, S. Sootla, I. Gat, X. E. Tan, Y . Adi, J. Liu, R. Sauvestre, T. Remez, J. Rapin, A. Kozhevnikov, I. Evtimov, J. Bitton, M. Bhatt, C. C. Ferrer, A. Grattafiori, W. Xiong, A. D ´efossez, J. Copet, F. Azhar, H. Touvron, L. Martin, N. Usunier, T. Scialom, and G. Synnaeve, “Code llama: Open foundation models for code,” 20...

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  27. [27]

    StarCoder 2 and The Stack v2: The Next Generation

    A. Lozhkov, R. Li, L. B. Allal, F. Cassano, J. Lamy-Poirier, N. Tazi, A. Tang, D. Pykhtar, J. Liu, Y . Wei, T. Liu, M. Tian, D. Kocetkov, A. Zucker, Y . Belkada, Z. Wang, Q. Liu, D. Abulkhanov, I. Paul, Z. Li, W.-D. Li, M. Risdal, J. Li, J. Zhu, T. Y . Zhuo, E. Zheltonozhskii, N. O. O. Dade, W. Yu, L. Krauß, N. Jain, Y . Su, X. He, M. Dey, E. Abati, Y . C...

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  28. [28]

    Qwen2.5-Coder Technical Report

    B. Hui, J. Yang, Z. Cui, J. Yang, D. Liu, L. Zhang, T. Liu, J. Zhang, B. Yu, K. Lu, K. Dang, Y . Fan, Y . Zhang, A. Yang, R. Men, F. Huang, B. Zheng, Y . Miao, S. Quan, Y . Feng, X. Ren, X. Ren, J. Zhou, and J. Lin, “Qwen2.5-coder technical report,” 2024. [Online]. Available: https://arxiv.org/abs/2409.12186

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  29. [29]

    CodeGemma: Open Code Models Based on Gemma

    C. Team, H. Zhao, J. Hui, J. Howland, N. Nguyen, S. Zuo, A. Hu, C. A. Choquette-Choo, J. Shen, J. Kelley, K. Bansal, L. Vilnis, M. Wirth, P. Michel, P. Choy, P. Joshi, R. Kumar, S. Hashmi, S. Agrawal, Z. Gong, J. Fine, T. Warkentin, A. J. Hartman, B. Ni, K. Korevec, K. Schaefer, and S. Huffman, “Codegemma: Open code models based on gemma,” 2024. [Online]....

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  30. [30]

    CWE: Common weakness enumerations,

    MITRE Corporation, “CWE: Common weakness enumerations,” 2026. [Online]. Available: https://cwe.mitre.org/

    work page 2026

  31. [31]

    Teaching an old LLM secure coding: Localized preference optimization on distilled preferences,

    M. S. Hasan, S. Chakraborty, S. Karmaker, and N. Balasubramanian, “Teaching an old LLM secure coding: Localized preference optimization on distilled preferences,” inProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), W. Che, J. Nabende, E. Shutova, and M. T. Pilehvar, Eds. Vienna, Austria: Assoc...

    work page 2025

  32. [32]

    Wizardcoder: Empowering code large language models with evol-instruct,

    Z. Luo, C. Xu, P. Zhao, Q. Sun, X. Geng, W. Hu, C. Tao, J. Ma, Q. Lin, and D. Jiang, “Wizardcoder: Empowering code large language models with evol-instruct,” inInternational Conference on Learning Representations, B. Kim, Y . Yue, S. Chaudhuri, K. Fragkiadaki, M. Khan, and Y . Sun, Eds., vol. 2024, 2024, pp. 27 168–27 188. [Online]. Available: https://pro...

    work page 2024

  33. [33]

    Code alpaca: An instruction-following llama model for code generation,

    S. Chaudhary, “Code alpaca: An instruction-following llama model for code generation,” https://github.com/sahil280114/codealpaca, 2023

    work page 2023

  34. [34]

    [Online]

    GitHub, “CodeQL,” 2026. [Online]. Available: https://github.com/githu b/codeql

    work page 2026

  35. [36]

    Program Synthesis with Large Language Models

    [Online]. Available: https://arxiv.org/abs/2108.07732

    work page internal anchor Pith review Pith/arXiv arXiv

  36. [37]

    Lora: Low-rank adaptation of large language models,

    E. J. Hu, Y . Shen, P. Wallis, Z. Allen-Zhu, Y . Li, S. Wang, L. Wang, and W. Chen, “Lora: Low-rank adaptation of large language models,” inThe Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29, 2022. OpenReview.net, 2022. [Online]. Available: https://openreview.net/forum?id=nZeVKeeFYf9

    work page 2022

  37. [38]

    DeepSeek-Coder: When the Large Language Model Meets Programming -- The Rise of Code Intelligence

    D. Guo, Q. Zhu, D. Yang, Z. Xie, K. Dong, W. Zhang, G. Chen, X. Bi, Y . Wu, Y . K. Li, F. Luo, Y . Xiong, and W. Liang, “Deepseek-coder: When the large language model meets programming – the rise of code intelligence,” 2024. [Online]. Available: https://arxiv.org/abs/2401.14196

    work page internal anchor Pith review Pith/arXiv arXiv 2024