Functional and Secure Code Generation with Task Vectors

Abstract: LLMs are increasingly used for code generation, but they struggle to generate functional code free of security vulnerabilities. Prior work to improve the secure code generation abilities of such coding LLMs has largely focused on evaluating code functionality and security separately using different datasets, or focused on finding vulnerabilities post-generation. At the same time, the text-generation domain has seen significant work on alignment techniques, where models are tuned such that their outputs exhibit certain qualities (e.g., helpfulness, harmlessness). Of particular interest is task-vector arithmetic, where linear operations on LLM weights can be used to arbitrarily enhance alignment while incurring only minimal computational overhead. We develop a novel method, SecVecCoder, leveraging task vectors to produce trustworthy code that is simultaneously functional and secure without the need for post-generation adjustment. Across six coding LLMs from three families on the CodeGuard+ benchmark, SecVecCoder improves the rate of trustworthy code completions by 2.1-36.0 percentage points over the base model, with improvements on unseen CWE types reaching up to 39.1 percentage points. Since the effectiveness of the coding LLM relies only on changing the model weights, SecVecCoder requires no method-specific decoding and hence achieves a decoding latency within 0.6% of the base model's, on average.

• The paper introduces SecVecCoder, which combines secure and insecure task vectors derived through Localized Preference Optimization to steer coding models toward functional, secure completions.
• The method achieves a mean main-CWE sec-pass@1 of 78.9% and outperforms prior defenses on five of six models, with relative gains of up to 61.5% over base models.
• The approach requires only 0.68–1.80 A6000 GPU-hours per model and changes inference latency by an average of 0.6%, while joint security-functionality evaluation exposes weaknesses hidden by separate benchmarks.

Motivation and Problem Statement

LLM-based code generators inherit vulnerable implementation patterns from their training corpora, and prior work has shown that coding assistants frequently produce exploitable code while increasing developer confidence in its security. Existing defenses fall into training-time methods (SVEN, SafeCoder, LPO), post-generation detection and repair, and inference-time decoding interventions (CoSec, SCoDE, DeepGuard, constrained decoding). Each category carries a distinct cost: training-time methods require substantial optimization, while inference-time methods pay overhead on every generation. A further methodological deficiency motivates this work: most prior defenses evaluate functionality and security on disjoint datasets (e.g., HumanEval for functionality, CodeQL-based security suites for security), which fails to establish that the same completion is both functional and secure. This paper argues that trustworthy code generation must be measured jointly, and proposes a method that improves both properties while keeping training and inference costs low.

SecVecCoder Method

The central technique is task-vector arithmetic applied to coding LLMs. From a base model $W_{\text{base}}$, the authors fine-tune two variants on paired data—one on secure completions ($W_{\text{sec}}$) and one on vulnerable completions ($W_{\text{vul}}$)—yielding task vectors $$\tau_{\text{sec}} = W_{\text{sec}} - W_{\text{base}}$$ and $$\tau_{\text{insec}} = W_{\text{vul}} - W_{\text{base}}$$. The steered model takes the form:

$$W_{\text{steered}} = W_{\text{base}} + \alpha\,\tau_{\text{sec}} - \theta\,\tau_{\text{insec}}$$

with three operator choices: Negation ($\alpha=0$, suppressing the insecure direction), Contrast ($\alpha=\theta$, moving along the secure-minus-insecure difference), and Secure-Anchored ($\alpha=1$, adding the full secure vector and subtracting $\theta\,\tau_{\text{insec}}$). Because the intervention modifies weights once, inference proceeds with standard autoregressive decoding.

A key design decision is the fine-tuning strategy used to derive the task vectors. The authors compare SFT, SafeCoder-style tuning, and Localized Preference Optimization (LPO) using cosine similarity and sign agreement between $W_{\text{sec}}$0 and $W_{\text{sec}}$1. SFT vectors are strongly positively correlated across all six models (cosine up to $W_{\text{sec}}$2, sign agreement above 96%), indicating a shared code-adaptation component that obscures security polarity. LPO vectors, by contrast, become negatively correlated (cosine as low as $W_{\text{sec}}$3, sign agreement as low as 12.58%) because LPO concentrates its preference loss on tokens where secure and vulnerable implementations diverge. LPO is therefore selected as the steering substrate. The training data consists of 803 paired secure/vulnerable examples from SVEN's corpus, covering Python and C/C++ across 9 CWE classes; adapters are trained with LoRA (rank 16) over Qwen2.5-Coder, DeepSeek-Coder, and StarCoder2 at roughly 1.3B–7B parameters.

Steering Operator and Strength Analysis (RQ1)

Across the 17 main-CWE CodeGuard+ test scenarios, LPO steering produces positive sec-pass@1 gains over the base model for all six models, with best-setting relative improvements of $W_{\text{sec}}$4–$W_{\text{sec}}$5 (average $W_{\text{sec}}$6), versus $W_{\text{sec}}$7 for SFT and $W_{\text{sec}}$8 for SafeCoder-style vectors. Notably, every LPO operator/model combination improves over the corresponding $W_{\text{sec}}$9 at its best strength (per-model gains of $W_{\text{vul}}$0–$W_{\text{vul}}$1 over $W_{\text{vul}}$2, averaging $W_{\text{vul}}$3), whereas SFT and SafeCoder steering frequently fall below $W_{\text{vul}}$4—establishing that LPO-derived vectors are the only reliable substrate for arithmetic among the three.

The Secure-Anchored operator with $W_{\text{vul}}$5 is the strongest configuration, achieving the highest mean main-CWE sec-pass@1 of $W_{\text{vul}}$6 and an average relative improvement over the base of $W_{\text{vul}}$7 with positive gains on all six models. Excessive steering strength degrades functionality, particularly under Contrast on Qwen-3B, DeepSeek-1.3B, and both StarCoder2 models; the optimal strength varies by model, which the authors acknowledge as a required per-model tuning step. Steered models also outperform base models consistently across sampling temperatures from $W_{\text{vul}}$8 to $W_{\text{vul}}$9.

Comparison with Prior Defenses

Using LPO-derived Secure-Anchored steering at $$\tau_{\text{sec}} = W_{\text{sec}} - W_{\text{base}}$$0, SecVecCoder attains the highest main-CWE sec-pass@1 on five of six models, exceeding the strongest prior defense by $$\tau_{\text{sec}} = W_{\text{sec}} - W_{\text{base}}$$1–$$\tau_{\text{sec}} = W_{\text{sec}} - W_{\text{base}}$$2. For example, on Qwen-7B it reaches $$\tau_{\text{sec}} = W_{\text{sec}} - W_{\text{base}}$$3 sec-pass@1 versus $$\tau_{\text{sec}} = W_{\text{sec}} - W_{\text{base}}$$4 for the best baseline (SafeCoder), and on Qwen-3B $$\tau_{\text{sec}} = W_{\text{sec}} - W_{\text{base}}$$5 versus $$\tau_{\text{sec}} = W_{\text{sec}} - W_{\text{base}}$$6 (DeepGuard). The exception is DeepSeek-Coder-6.7B, where SecVecCoder ($$\tau_{\text{sec}} = W_{\text{sec}} - W_{\text{base}}$$7) trails SVEN ($$\tau_{\text{sec}} = W_{\text{sec}} - W_{\text{base}}$$8), SafeCoder ($$\tau_{\text{sec}} = W_{\text{sec}} - W_{\text{base}}$$9), and DeepGuard ($$\tau_{\text{insec}} = W_{\text{vul}} - W_{\text{base}}$$0); the authors conjecture a higher steering strength may help but leave this unverified.

The joint evaluation also exposes a weakness in prior work: methods reporting high raw security rates (e.g., DeepGuard's $$\tau_{\text{insec}} = W_{\text{vul}} - W_{\text{base}}$$1 SVEN-SR on StarCoder2-3B) do so while collapsing functionality (pass@1 of $$\tau_{\text{insec}} = W_{\text{vul}} - W_{\text{base}}$$2), yielding mediocre sec-pass@1. This directly supports the paper's claim that security measured in isolation overstates trustworthiness.

On 12 unseen-CWE scenarios (CWE-020, 119, 502, 732), SecVecCoder improves unseen-CWE sec-pass@1 over the base on all six models, with absolute gains of $$\tau_{\text{insec}} = W_{\text{vul}} - W_{\text{base}}$$3–$$\tau_{\text{insec}} = W_{\text{vul}} - W_{\text{base}}$$4 percentage points (relative $$\tau_{\text{insec}} = W_{\text{vul}} - W_{\text{base}}$$5–$$\tau_{\text{insec}} = W_{\text{vul}} - W_{\text{base}}$$6). One caveat is stated plainly: SafeCoder's and SCoDE's training data include three of the four "unseen" CWE classes, and SafeCoder retains a substantial advantage on the two StarCoder2 models ($$\tau_{\text{insec}} = W_{\text{vul}} - W_{\text{base}}$$7–$$\tau_{\text{insec}} = W_{\text{vul}} - W_{\text{base}}$$8 points) and on DeepSeek-1.3B ($$\tau_{\text{insec}} = W_{\text{vul}} - W_{\text{base}}$$9 points), likely for that reason. Even so, SecVecCoder exceeds DeepGuard on all six models and the remaining baselines on five.

Efficiency (RQ2)

The efficiency profile is a principal selling point. Total training cost—including both SFT initializations and LPO training—ranges from $$W_{\text{steered}} = W_{\text{base}} + \alpha\,\tau_{\text{sec}} - \theta\,\tau_{\text{insec}}$$0 to $$W_{\text{steered}} = W_{\text{base}} + \alpha\,\tau_{\text{sec}} - \theta\,\tau_{\text{insec}}$$1 A6000 GPU-hours per model, which is only $$W_{\text{steered}} = W_{\text{base}} + \alpha\,\tau_{\text{sec}} - \theta\,\tau_{\text{insec}}$$2–$$W_{\text{steered}} = W_{\text{base}} + \alpha\,\tau_{\text{sec}} - \theta\,\tau_{\text{insec}}$$3 of SafeCoder's cost and $$W_{\text{steered}} = W_{\text{base}} + \alpha\,\tau_{\text{sec}} - \theta\,\tau_{\text{insec}}$$4–$$W_{\text{steered}} = W_{\text{base}} + \alpha\,\tau_{\text{sec}} - \theta\,\tau_{\text{insec}}$$5 of SCoDE's, while surpassing both on main-CWE sec-pass@1 on five of six models. At inference, because decoding is unchanged from the base model, mean 20-token latency differs from the base by $$W_{\text{steered}} = W_{\text{base}} + \alpha\,\tau_{\text{sec}} - \theta\,\tau_{\text{insec}}$$6 to $$W_{\text{steered}} = W_{\text{base}} + \alpha\,\tau_{\text{sec}} - \theta\,\tau_{\text{insec}}$$7, averaging $$W_{\text{steered}} = W_{\text{base}} + \alpha\,\tau_{\text{sec}} - \theta\,\tau_{\text{insec}}$$8, with all 95% confidence intervals within $$W_{\text{steered}} = W_{\text{base}} + \alpha\,\tau_{\text{sec}} - \theta\,\tau_{\text{insec}}$$9 except Qwen-3B (within $\alpha=0$0). Decoding-based defenses pay measurably more per query: CoSec roughly doubles latency (e.g., $\alpha=0$1s vs. $\alpha=0$2s on Qwen-3B), and SCoDE and DeepGuard also add overhead despite lower training cost.

Component Ablation (RQ3)

Removing either term of the Secure-Anchored combination degrades sec-pass@1. Dropping $\alpha=0$3 (reducing to Negation) reduces sec-pass@1 by $\alpha=0$4–$\alpha=0$5 points (average $\alpha=0$6), while dropping $\alpha=0$7 (reducing to $\alpha=0$8) reduces it by $\alpha=0$9–$\alpha=\theta$0 points (average $\alpha=\theta$1). The insecure-direction subtraction is thus the larger contributor, but the full combination is necessary for peak performance—for instance, on Qwen-3B the full model reaches $\alpha=\theta$2 sec-pass@1 versus $\alpha=\theta$3 and $\alpha=\theta$4 for the single-term ablations.

Limitations and Open Questions

The paper is candid about several constraints. The optimal steering strength is model-dependent and must be tuned on validation scenarios; excessive strength degrades functionality, and the failure to beat baselines on DeepSeek-Coder-6.7B is attributed to possibly insufficient strength but is not resolved. Generalization claims are partially confounded by overlap between the "unseen" CWEs and prior methods' training corpora. The evaluation is limited to six open models up to 7B parameters and a single benchmark (CodeGuard+), so scaling behavior on larger models and broader vulnerability taxonomies remains unmeasured. The method is also demonstrated only on a binary secure/vulnerable contrast; extending the arithmetic to multiple simultaneous security properties is left open.

Conclusion

This paper demonstrates that task-vector arithmetic over LPO-derived secure and insecure weight directions can steer coding LLMs toward jointly functional and secure code generation. SecVecCoder achieves state-of-the-art sec-pass@1 on five of six evaluated models, generalizes to CWE classes outside its training set, and does so at a small fraction of prior methods' training cost with essentially no inference-time overhead. The results also carry a methodological message: evaluating security and functionality on separate datasets materially misrepresents the trustworthiness of code-generation defenses, and joint metrics such as sec-pass@1 should become standard in this area.