Pith. sign in

REVIEW 3 major objections 6 minor 47 references

Co-decoding for secure code accepts unconfident expert tokens more readily; gating on absolute confidence stops that noise and raises joint functional-security scores.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-31 04:30 UTC pith:S4ZFEVKE

load-bearing objection Clean diagnosis of inverted confidence in CoSec+-style acceptance, plus a simple gate that actually helps on joint Func-Sec OOD eval. the 3 major comments →

arxiv 2607.28529 v1 pith:S4ZFEVKE submitted 2026-07-30 cs.SE

CoGate: Confidence-Gated Co-Decoding for Secure Code Generation

Minghao Hu , Lannan Luo , Allen Roush , Phillip Howard This is my paper
classification cs.SE
keywords secure code generationco-decodingconfidence gatingdecoding-time steeringlarge language modelsout-of-distributionFunc-Sec
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Large code models often emit insecure programs because their training data contains unsafe patterns. A popular fix is co-decoding: a small security expert proposes the next token alongside the base model, and a ratio test decides whether to accept it. This paper shows that the usual ratio test is inverted in the expert’s own confidence—the less sure the expert is of its proposal, the more likely that proposal is accepted—so on out-of-distribution or ambiguous steps the method injects tokens with no security content. CoGate adds a simple gate that first checks the expert’s absolute confidence (maximum token probability or normalized entropy) and only then runs the ratio test; when confidence is low the expert abstains and the base model decodes alone. Across six code models and three benchmarks the gated method beats prior co-decoding, with the largest gains on CWEval, where functionality and security must hold together and the weaknesses are unseen. A sympathetic reader cares because the failure mode is structural, the fix is training-free and cheap at inference, and the gains concentrate exactly where secure generation matters most.

Core claim

The acceptance statistic min(1, B(x̃)/S(x̃)) used by prior co-decoding is nonincreasing in the expert’s probability on its own proposal, so an unconfident expert is accepted more readily and, when its distribution flattens, the emitted token carries no security-relevant information. Conditioning expert intervention on an absolute confidence signal (max probability or normalized entropy) separates relative preference from absolute reliability, suppresses those harmful steps, and improves joint Func-Sec@k—up to a 12.6-point gain of Func-Sec@10 on CWEval—especially on out-of-distribution CWEs.

What carries the argument

The confidence gate gt = 1[c(St) > τ], with c either max-probability or normalized entropy of the expert’s next-token distribution. It sits in front of the usual base/expert ratio test so the expert may steer only when certified confident; otherwise decoding defers to the base model alone.

Load-bearing premise

A single family-specific confidence threshold, tuned once on a held-out development split to maximize joint functional-security score, cleanly separates helpful from harmful expert steps at test time across benchmarks and temperatures.

What would settle it

Retune or freeze the gate threshold on one benchmark family, then measure whether token-level intervention utility stays positive and Func-Sec@10 still beats ungated co-decoding on held-out OOD CWEs and at temperatures the threshold was not chosen for; a flat or negative utility curve would falsify the claim.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Ungated co-decoding should be treated as unsafe by default on long-tail or unseen vulnerability patterns.
  • Any decoding-time steering method whose control signal is only a relative ratio or difference can inherit the same confidence-inflation failure.
  • Joint functional-security metrics (not separate security ratios) become the right evaluation target once the gate removes noisy expert steps.
  • Practitioners can keep a frozen base model and a small security expert, adding only a cheap confidence check at each step.
  • Normalized entropy is the preferred gate when the evaluation is OOD; max-probability is enough for in-distribution security suites.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same absolute-confidence gate could be dropped in front of other relative steering methods (expert/anti-expert reweighting, speculative accept/reject) wherever the auxiliary model can be unconfident.
  • If the expert’s confidence is systematically miscalibrated, a learned or temperature-aware threshold may be needed; the paper’s fixed τ assumes calibration is good enough after distillation and security fine-tuning.
  • The inverted-U utility curve versus τ suggests an operating regime that could be monitored online to detect when the expert has gone OOD mid-generation.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper diagnoses a failure mode in co-decoding for secure code generation (CoSec/CoSec+): the acceptance statistic min(1, B_t(x̃)/S_t(x̃)) is nonincreasing in the expert’s own probability on its proposal (Prop. 1), so an unconfident expert is accepted more readily and, in the near-uniform limit, injects tokens carrying no security content (Prop. 2). It proposes CoGate, which inserts an absolute confidence gate g_t = 1[c(S_t) > τ] (max-probability or normalized entropy) before the relative acceptance test, so the expert abstains when unconfident. The method is evaluated on six backends across four families (CodeGen, StarCoder, DeepSeek-Coder, Qwen2.5-Coder) on HumanEval, an in-distribution security suite, and the joint Func-Sec CWEval benchmark, with a token-level counterfactual intervention-utility study (Fig. 2) and a temperature sweep (Table 2). Reported gains reach up to +12.6 absolute Func-Sec@10 over CoSec+ on CWEval (Qwen2.5-Coder-14B, entropy gate).

Significance. If the result holds, the paper makes a clean and useful contribution to decoding-time security steering: it separates absolute expert reliability from relative preference, a distinction that prior co-decoding work conflates by construction. Propositions 1–2 are elementary but correctly identify an inverted acceptance incentive and a security-signal collapse under flat expert distributions—precisely the OOD regime that joint Func-Sec metrics expose. Algorithm 1 is simple, training-free, and strictly generalizes CoSec+ at low τ. The multi-backend evaluation, temperature study, and token-level utility curves with confidence intervals are stronger empirical practice than is typical in this line of work. The practical implication is that confidence-aware abstention is a low-cost way to keep co-decoding from injecting noise on unseen CWEs without retraining the base model.

major comments (3)
  1. [§5.1 Implementation; §5.2] §5.1 (Implementation) selects the family-specific gate threshold τ by maximizing CWEval Func-Sec@10 on a held-out development split, then freezes it for all reported results, including the headline CWEval numbers. This is ordinary hyperparameter selection, but it is also selection on the same joint metric and distribution family used for the main claim. The paper should state the size and construction of that split, whether any CWEval CWE/language leakage into the split is possible, and report the selected τ values per family. §5.2’s inverted-U and plateau (≈0.5–0.7) mitigate knife-edge concerns, but without those details the OOD gains remain harder to audit than the rest of the evaluation.
  2. [Table 1; Abstract; §5.1 Overview of Results] Table 1 does not uniformly support the abstract/§5.1 claim that CoGate “outperforms existing co-decoding methods (CoSec+) across multiple benchmarks.” Counterexamples include StarCoder-1B Max-Prob Func-Sec@10 (29.6 vs CoSec+ 31.0), StarCoder-7B Max-Prob Func-Sec@10 (tied at 32.8), and several HumanEval Pass@1 drops (e.g., StarCoder-7B Entropy 15.2 vs CoSec+ 16.5; CodeGen-6.1B Max-Prob 13.9 vs Original 17.0). The largest gain (+12.6 Func-Sec@10) is concentrated on Qwen2.5-Coder-14B with the entropy gate. The results narrative should characterize when gating helps (OOD joint Func-Sec, higher T) versus when it is neutral or harmful, rather than summarizing as broad outperformance.
  3. [§5.2; Figure 2] The token-level intervention-utility analysis that validates Prop. 2 and the τ sweet spot (§5.2, Fig. 2, Eqs. 5–9) is reported only for StarCoder-7B with a StarCoder-1B expert. Because the central mechanistic claim is that unconfident interventions are harmful and that a mid-range τ removes them, repeating the counterfactual fork (CoGate / unconfident CoSec+ / Base) on at least one other family (e.g., CodeGen or DeepSeek-Coder) would substantially strengthen the load-bearing empirical link between the propositions and the table-level gains.
minor comments (6)
  1. [§2.1] §2.1: “critival” → “critical”; several other extraction/spacing artifacts appear in the related-work and method text (e.g., “co-decodingapproachesdoesnotconsider”). A full proofread pass is needed.
  2. [§4.4] §4.4 introduces false-accept / false-reject at the token level via an idealized oracle R_t but never reports empirical FA/FR rates or a proxy. Even a coarse breakdown (fraction of steps gated closed; fraction of closed-gate steps that would have failed Func-Sec under forced expert accept) would make the trade-off concrete.
  3. [§5.3] §5.3’s recommendation (max-prob for in-distribution, entropy for OOD) is reasonable given Table 1 but is post hoc. State it as an empirical guideline and note that practitioners still need a selection rule when the OOD status of the deployment mix is unknown.
  4. [§5.1 LLM Backends] StarCoder-1B is both expert and target with knowledge distillation skipped (§5.1). Flag this configuration more visibly in Table 1 or the caption so readers do not treat it as a standard teacher–student co-decoding setup.
  5. [§5.1; Algorithm 1] Default acceptance threshold a = 0.3 is inherited from CoSec+ and never ablated jointly with τ. A brief note on interaction (or a small grid) would clarify that the reported gains are not an artifact of a fixed a.
  6. [Figure 1] Figure 1 and Algorithm 1 are clear; consider adding the entropy definition next to the max-prob gate in the figure so both signals are visible in the overview.

Circularity Check

0 steps flagged

No significant circularity: Props. 1–2 are direct consequences of the CoSec+ rule; CoGate and the empirical gains are not forced by definition or self-citation.

full rationale

The paper’s load-bearing analytic claims are Proposition 1 (acceptance statistic ρ = min(1, Bt(x̃)/St(x̃)) is nonincreasing in St(x̃)) and Proposition 2 (flat expert St ~ U collapses accept/emit to base-driven noise). Both follow by elementary calculus/probability from the stated CoSec+ rule and do not encode the desired Func-Sec outcome. CoGate then adds an independent absolute gate gt = 1[c(St) > τ] (max-prob or normalized entropy) before that rule; setting τ ≤ 1/|V| recovers CoSec+ exactly, so the method strictly generalizes rather than redefining the baseline. Empirical claims rest on external benchmarks (HumanEval, SVEN security suite, CWEval) and a token-level counterfactual utility experiment; τ is ordinary held-out hyperparameter selection on Func-Sec@10, not a fitted constant renamed as a first-principles prediction. Prior work cited for the expert recipe (CoSec/CoSec+) is by different authors and is used as a reproducible baseline, not as a self-authored uniqueness theorem that forces the result. No step reduces a claimed prediction to its inputs by construction.

Axiom & Free-Parameter Ledger

3 free parameters · 5 axioms · 1 invented entities

Empirical systems paper: load-bearing content is the CoSec+ acceptance inheritance, the definition of confidence functionals, and a tuned gate threshold. No new physical entities. Background assumptions are standard next-token LM decoding and the claim that max-prob/entropy track intervention harm on OOD security steps.

free parameters (3)
  • gate threshold τ (per model family) = family-specific; sensitivity peak ~0.5–0.7 (StarCoder-7B study)
    Chosen on a held-out development split by maximizing CWEval Func-Sec@10; freezes for all reported results. Primary knob controlling FA/FR trade-off and headline gains.
  • CoSec+ acceptance threshold a = 0.3
    Fixed at default 0.3 from prior work; still governs relative accept when the gate is open.
  • sampling temperature T and top-p = T=0.6, top-p=0.95 (main)
    Main results use T=0.6, top-p=0.95; temperature study shows gate benefit grows as T rises.
axioms (5)
  • domain assumption Next-token distributions B_t, S_t from autoregressive LMs with shared vocabulary are the right objects for token-level security steering.
    Preliminaries §3.1; standard co-decoding setup inherited from CoSec+.
  • domain assumption When the gate is open, the CoSec+ ratio test a < min(1, B(x̃)/S(x̃)) is an adequate relative-preference rule.
    Eq. (4) and Algorithm 1 keep the prior accept rule unchanged inside the open gate.
  • ad hoc to paper c_max = max S_t(x) and c_ent = 1 - H(S_t)/log|V| are sufficient statistics of expert reliability for security interventions.
    §4.3 design space; justified empirically in RQ2–RQ3, not derived from a calibration theorem.
  • domain assumption Expert trained by base distillation then security post-training (CoSec+ recipe) supplies a meaningful secure-token bias when confident.
    Phase 1 §4.1; paper does not re-derive expert training, only gates its use.
  • standard math Maps s ↦ min(1, B/s) is nonincreasing for B>0 (Prop. 1) and uniform-expert acceptance reduces to a base-only threshold (Prop. 2).
    Elementary calculus/probability; §3.2 proofs.
invented entities (1)
  • CoGate confidence gate g_t = 1[c(S_t) > τ] independent evidence
    purpose: Binary abstention switch that blocks unconfident expert proposals before the relative ratio test.
    Core mechanism of the paper; operational definition over existing logits, not a latent physical object.

pith-pipeline@v1.2.0-daily-grok45 · 19155 in / 3596 out tokens · 75743 ms · 2026-07-31T04:30:41.175087+00:00 · methodology

0 comments
read the original abstract

Large language models are widely used for code generation, but they can also produce insecure programs due to patterns learned from their pretraining data. Decoding-time steering has become an important solution to this problem: a small expert model is combined with the target model at each step to generate more secure code, which is referred to as co-decoding. However, the acceptance rule for existing co-decoding approaches does not consider the expert model's confidence. When the security expert is unconfident due to unseen patterns or out-of-distribution (OOD) contexts, its guidance can therefore be misleading. To address the challenge, we propose CoGate, a confidence-gated co-decoding approach that controls the expert's influence on the co-decoding process based on its confidence. We implement our approach and evaluate it across multiple LLM backends (CodeGen, DeepSeek-Coder, Qwen-Coder, StarCoder) on several code generation benchmarks (HumanEval, security suite, and CWEval). Our approach outperforms existing co-decoding methods (CoSec+) across multiple benchmarks, achieving up to a 12.6% gain of Func-Sec@10 on CWEval.

Figures

Figures reproduced from arXiv: 2607.28529 by Allen Roush, Lannan Luo, Minghao Hu, Phillip Howard.

Figure 1
Figure 1. Figure 1: Overview of the CoGate. model’s concentration. When Bt is sharply peaked, few to￾kens clear the small threshold a/V , so pacc is small and generation harmlessly defers to Bt. When Bt is itself dif￾fuse, pacc grows and the emitted token is effectively random. The damaging regime is thus joint uncertainty: both St and Bt are flat. This is exactly the profile of ambiguous, long￾tail, and out-of-distribution d… view at source ↗
Figure 2
Figure 2. Figure 2: Token-level intervention utility E[U] for two types of confidence signals (max-probability, normalized entropy). The shaded area represents the 95% confidence interval. smaller ones (0.8, 0.1, 0.05, 0.05...), cmax = 0.8 while cent is lower. As a result, max probability tends to trust this expert while the normalized entropy gate tends to be cautious. Recommendation. Max-probability is parameter-light, tran… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

47 extracted references · 1 canonical work pages

  1. [1]

    and Brunelle, Jacob and Camara, Baba Mamadou , booktitle=

    Khoury, Raphaël and Avila, Anderson R. and Brunelle, Jacob and Camara, Baba Mamadou , booktitle=. How Secure is Code Generated by ChatGPT? , year=

  2. [2]

    2025 IEEE/ACM 47th International Conference on Software Engineering (ICSE) , pages=

    Between lines of code: Unraveling the distinct patterns of machine and human programmers , author=. 2025 IEEE/ACM 47th International Conference on Software Engineering (ICSE) , pages=. 2025 , organization=

    2025

  3. [3]

    Proceedings of the 31st Annual International Conference on Mobile Computing and Networking , series =

    Ma, Xiaoyue and Chen, Junming and Luo, Lannan and Zeng, Qiang , title =. Proceedings of the 31st Annual International Conference on Mobile Computing and Networking , series =. 2025 , publisher =

    2025

  4. [4]

    2026 , eprint=

    Zero-Shot Vulnerability Detection in Low-Resource Smart Contracts Through Solidity-Only Training , author=. 2026 , eprint=

    2026

  5. [5]

    2026 56th Annual IEEE International Conference on Dependable Systems and Networks (DSN) , pages=

    Meta-Architecture Binary Code Analysis , author=. 2026 56th Annual IEEE International Conference on Dependable Systems and Networks (DSN) , pages=. 2026 , organization=

    2026

  6. [6]

    IEEE Transactions on Dependable and Secure Computing , year=

    Model reuse through retargeted-architecture binary code analysis , author=. IEEE Transactions on Dependable and Secure Computing , year=

  7. [7]

    2025 , eprint=

    FlowMalTrans: Unsupervised Binary Code Translation for Malware Detection Using Flow-Adapter Architecture , author=. 2025 , eprint=

    2025

  8. [8]

    arXiv preprint arXiv:2410.01215 , year=

    From code to correctness: Closing the last mile of code generation with hierarchical debugging , author=. arXiv preprint arXiv:2410.01215 , year=

    arXiv

  9. [9]

    2025 40th IEEE/ACM International Conference on Automated Software Engineering (ASE) , pages=

    LongCodeZip: Compress Long Context for Code Language Models , author=. 2025 40th IEEE/ACM International Conference on Automated Software Engineering (ASE) , pages=. 2025 , organization=

    2025

  10. [10]

    2025 IEEE/ACM International Workshop on Large Language Models for Code (LLM4Code) , pages=

    Cweval: Outcome-driven evaluation on functionality and security of llm code generation , author=. 2025 IEEE/ACM International Workshop on Large Language Models for Code (LLM4Code) , pages=. 2025 , organization=

    2025

  11. [11]

    5-coder technical report , author=

    Qwen2. 5-coder technical report , author=. arXiv preprint arXiv:2409.12186 , year=

    Pith/arXiv arXiv

  12. [12]

    arXiv preprint arXiv:2203.13474 , year=

    Codegen: An open large language model for code with multi-turn program synthesis , author=. arXiv preprint arXiv:2203.13474 , year=

    Pith/arXiv arXiv

  13. [13]

    arXiv preprint arXiv:2305.06161 , year=

    Starcoder: may the source be with you! , author=. arXiv preprint arXiv:2305.06161 , year=

    Pith/arXiv arXiv

  14. [14]

    arXiv preprint arXiv:2401.14196 , year=

    DeepSeek-Coder: when the large language model meets programming--the rise of code intelligence , author=. arXiv preprint arXiv:2401.14196 , year=

    Pith/arXiv arXiv

  15. [15]

    Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security , pages=

    Large language models for code: Security hardening and adversarial testing , author=. Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security , pages=

    2023

  16. [16]

    Findings of the Association for Computational Linguistics: ACL 2023 , pages=

    Critic-guided decoding for controlled text generation , author=. Findings of the Association for Computational Linguistics: ACL 2023 , pages=

    2023

  17. [17]

    International Conference on Machine Learning , pages=

    Fast inference from transformers via speculative decoding , author=. International Conference on Machine Learning , pages=. 2023 , organization=

    2023

  18. [18]

    arXiv preprint arXiv:2107.03374 , year=

    Evaluating large language models trained on code , author=. arXiv preprint arXiv:2107.03374 , year=

    Pith/arXiv arXiv

  19. [19]

    Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies , pages=

    FUDGE: Controlled text generation with future discriminators , author=. Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies , pages=

    2021

  20. [20]

    arXiv preprint arXiv:2506.20639 , year=

    Diffucoder: Understanding and improving masked diffusion models for code generation , author=. arXiv preprint arXiv:2506.20639 , year=

    Pith/arXiv arXiv

  21. [21]

    The Fourteenth International Conference on Learning Representations , year=

    CodeGenGuard: A Watermark for Code Generation Models , author=. The Fourteenth International Conference on Learning Representations , year=

  22. [22]

    When to Speak, When to Abstain: Contrastive Decoding with Abstention

    Kim, Hyuhng Joon and Kim, Youna and Lee, Sang-goo and Kim, Taeuk. When to Speak, When to Abstain: Contrastive Decoding with Abstention. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2025. doi:10.18653/v1/2025.acl-long.479

    work page doi:10.18653/v1/2025.acl-long.479 2025

  23. [23]

    arXiv preprint arXiv:2302.13971 , year=

    Llama: Open and efficient foundation language models , author=. arXiv preprint arXiv:2302.13971 , year=

    Pith/arXiv arXiv

  24. [24]

    arXiv preprint arXiv:2303.08774 , year=

    Gpt-4 technical report , author=. arXiv preprint arXiv:2303.08774 , year=

    Pith/arXiv arXiv

  25. [25]

    2024 , isbn =

    Li, Dong and Yan, Meng and Zhang, Yaosheng and Liu, Zhongxin and Liu, Chao and Zhang, Xiaohong and Chen, Ting and Lo, David , title =. 2024 , isbn =. doi:10.1145/3650212.3680371 , booktitle =

    arXiv 2024

  26. [26]

    Improving Co-Decoding Based Security Hardening of Code LLMs Leveraging Knowledge Distillation , year=

    Li, Dong and Shu, Shanfu and Yan, Meng and Liu, Zhongxin and Liu, Chao and Zhang, Xiaohong and Lo, David , journal=. Improving Co-Decoding Based Security Hardening of Code LLMs Leveraging Knowledge Distillation , year=

  27. [27]

    34th USENIX Security Symposium (USENIX Security 25) , pages=

    \ PATCHAGENT \ : A Practical Program Repair Agent Mimicking Human Expertise , author=. 34th USENIX Security Symposium (USENIX Security 25) , pages=

  28. [28]

    ACM Transactions on Software Engineering and Methodology , volume=

    Contrastrepair: Enhancing conversation-based automated program repair via contrastive test case pairs , author=. ACM Transactions on Software Engineering and Methodology , volume=. 2025 , publisher=

    2025

  29. [29]

    arXiv preprint arXiv:2405.00218 , year=

    Constrained decoding for secure code generation , author=. arXiv preprint arXiv:2405.00218 , year=

    Pith/arXiv arXiv

  30. [30]

    International Conference on Machine Learning , pages=

    Instruction Tuning for Secure Code Generation , author=. International Conference on Machine Learning , pages=. 2024 , organization=

    2024

  31. [31]

    IEEE Transactions on Dependable and Secure Computing , year=

    Security and quality in llm-generated code: A multi-language, multi-model analysis , author=. IEEE Transactions on Dependable and Secure Computing , year=

  32. [32]

    Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , pages=

    Promsec: Prompt optimization for secure generation of functional source code with large language models (llms) , author=. Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , pages=

    2024

  33. [33]

    2026 , booktitle=

    FHE-Coder: Benchmarking Secure Agentic Code Generation for Fully Homomorphic Encryption , author=. 2026 , booktitle=

    2026

  34. [34]

    Findings of the Association for Computational Linguistics: EMNLP 2025 , pages=

    SecDecoding: Steerable Decoding for Safer LLM Generation , author=. Findings of the Association for Computational Linguistics: EMNLP 2025 , pages=

    2025

  35. [35]

    Proceedings of the IEEE/ACM 47th International Conference on Software Engineering , pages=

    Decoding Secret Memorization in Code LLMs Through Token-Level Characterization , author=. Proceedings of the IEEE/ACM 47th International Conference on Software Engineering , pages=

  36. [36]

    The Thirteenth International Conference on Learning Representations , year=

    SFS: Smarter code space search improves LLM inference scaling , author=. The Thirteenth International Conference on Learning Representations , year=

  37. [37]

    IEEE Transactions on Software Engineering , year=

    Steer Your Model: Secure Code Generation with Contrastive Decoding , author=. IEEE Transactions on Software Engineering , year=

  38. [38]

    Advances in Neural Information Processing Systems , volume=

    Purpcode: Reasoning for safer code generation , author=. Advances in Neural Information Processing Systems , volume=

  39. [39]

    arXiv preprint arXiv:2510.18204 , year=

    RESCUE: Retrieval Augmented Secure Code Generation , author=. arXiv preprint arXiv:2510.18204 , year=

    arXiv

  40. [40]

    Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

    Safedecoding: Defending against jailbreak attacks via safety-aware decoding , author=. Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

  41. [41]

    Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security , pages=

    Give llms a security course: Securing retrieval-augmented code generation via knowledge injection , author=. Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security , pages=

    2025

  42. [42]

    Proceedings of the ACM on Programming Languages , volume=

    Treecoder: Systematic exploration and optimisation of decoding and constraints for LLM code generation , author=. Proceedings of the ACM on Programming Languages , volume=. 2026 , publisher=

    2026

  43. [43]

    Advances in Neural Information Processing Systems , volume=

    Grammar-aligned decoding , author=. Advances in Neural Information Processing Systems , volume=

  44. [44]

    Proceedings of the ACM on Programming Languages , volume=

    Type-constrained code generation with language models , author=. Proceedings of the ACM on Programming Languages , volume=. 2025 , publisher=

    2025

  45. [45]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Hot or cold? adaptive temperature sampling for code generation with large language models , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  46. [46]

    Proceedings of the ACM on Software Engineering , volume=

    AdaDec: A Uncertainty-Guided Lookahead Decoding Framework for LLM-Based Code Generation , author=. Proceedings of the ACM on Software Engineering , volume=. 2026 , publisher=

    2026

  47. [47]

    DExperts: Decoding-time controlled text generation with experts and anti-experts , author=. Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers) , pages=