Newest papers

CAT-RAG: Improving Secure Code Generation with Category-Aware Agentic Retrieval

Mahdieh Abazar, Lorenzo De Carli, Benjamin Tan · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.24907 · cited by 0 works (OpenAlex) · open-access PDF

Chinese

尽管CAT基于代码生成的快速进展,安全漏洞仍然普遍存在,而获取增强代码生成(RACG)可以进一步增强风险,当获取的知识是单一获取代码或易受毒害时。现有的安全RACG方法将安全知识注入到细粒的漏洞级别,导致查询涉及多个相关漏洞时的快速覆盖和稀释模型关注。我们建议CAT-RAG,一个代理安全类别意识的单一获取代码增加的代码生成框架。CAT-RAG通过LLM作为分类代理进行适应性分类选择,并作为独立的安全层或RACG管道的插入添加剂,不需要对底层模型进行修改。我们用紧凑的、语言特定的安全类别来替代CWE级别的回

Machine translation (Meta M2M100); the English original follows.

Abstract

Despite rapid progress in LLM-based code generation, security vulnerabilities remain widespread, and retrieval-augmented code generation (RACG) can further amplify risk when retrieved knowledge is verbose or vulnerable to poisoning. Existing secure RACG approaches inject security knowledge at a fine-grained vulnerability level, causing prompt overhead and diluted model attention when a query implicates multiple related weaknesses. We propose CAT-RAG, an agentic security category-aware retrieval-augmented code generation framework. CAT-RAG performs adaptive category selection via an LLM as a categorizer agent and operates either as a standalone security layer or as a drop-in add-on to RACG pipelines, requiring no modification to the underlying model. We replace CWE-level retrieval with compact, language-specific security categories. These categories provide a higher-level abstraction over individual CWE weaknesses, organizing them by the security concern they share, such as Input Validation and Injection Attacks, rather than merely grouping related entries. Each category consolidates best practices and secure code examples into a single, prompt-efficient representation. We perform a comprehensive evaluation across CyberSecEval, CodeGuard+, and HumanEval. On CyberSecEval, CAT-RAG nearly doubles the secure code generation improvement over the state of the art (23.57% vs. 12.11%) while reducing token overhead by 41.71%.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Code (set theory), Vulnerability (computing), Abstraction, Overhead (engineering), Computer security

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange