Newest papers

Many Repairs, One Direction: Steering Code Models Toward Safer Cryptographic API Use

Tianhe Lu, Sakuna Harinda Jayasundara, Spero Eric, Ewan D. Tempero, Robert Biddle, Giovanni Russello · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.25133 · cited by 0 works (OpenAlex) · open-access PDF

Chinese

虽然许多现有的方法通过修改模型参数或输入来提高代码安全性,但与不同的加密 API 修复相关的代表性变化如何支持用于更安全代码生成的共享干预仍然未被探索。为了调查这一点,我们在四种编程语言和十个加密 API 滥用类别中构建了48000对匹配的程序对比,每对改变了指定的 API 决定,同时保持了编程任务。从其安全对手中提取滥用程序的内部代表性,提供了修复矢量。在五种模型中,对比平均修复矢量揭示了根据类别的加密 API 滥用较强的组织。这些类别特定的模式也支持共享干预。我们引入了 CrypSteer,通过规范修复差异来提取一个共享的方向,并

Machine translation (Meta M2M100); the English original follows.

Abstract

Cryptographic API misuse in large language model-generated code can compromise software security. While many existing approaches improve code security by modifying model parameters or inputs, how representation changes associated with different cryptographic API repairs can support a shared intervention for safer code generation remains underexplored. To investigate this, we construct 48,000 matched program pairs across four programming languages and ten cryptographic API misuse categories. Each pair changes a specified API decision while preserving the programming task. Subtracting the misuse program's internal representation from its secure counterpart's gives a repair vector. Across five models, comparisons of mean repair vectors reveal stronger organization by misuse category than by language. These category-specific patterns also support a shared intervention. We introduce CrypSteer, which extracts a shared direction by normalizing repair differences and selecting a principal component aligned with repairs across misuse categories. With model weights fixed, adding one shared direction per model to its internal activations during generation improves aggregate target security rates by 5.28--15.00 percentage points over unsteered generation across languages and misuse categories. These findings connect the shared structure of cryptographic repair representations to a reusable intervention for safer code generation.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: SAFER, Computer science, Cryptographic primitive, Cryptography, Code (set theory), Component (thermodynamics)

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange