Tue Le, Anh Nguyen Hoang, Gabriel Sasseville, Doseok Jang, Pierre‐Luc Bacon, Nghi D. Q. Bui · 2026 · arXiv (Cornell University)
DOI: 10.48550/arxiv.2610.25916 · cited by 0 works (OpenAlex) · open-access PDF
Da Codierungsmodelle und Agentenharnesses leistungsfähiger werden, wird die zuverlässige Sicherheitsüberprüfung zu einem zentralen Knotenpunkt. Die Verbesserung der sicheren Code-Generation erfordert ein Signal, dessen gemeldeter Fortschritt im Einklang mit dem tatsächlichen Programmverhalten unter Optimierung bleibt; andernfalls kann ein Optimierer das Signal-Urteil verbessern, ohne die zugrunde liegende Sicherheitsanfälligkeit zu entfernen. Bestehende Modellbasierte Ansätze erfordern Modelle, um entweder das Programmverhalten aus dem Quellcode abzuleiten oder korrekte Ergebnisse für Widerspruchstests anzugeben, wodurch erhebliche begründete Anforderungen an das Sicherheitssignal gestellt werden. Wir führen \falcon{} ein, ein Gegenbeispiel-basiertes Verifiz
Machine translation (Meta M2M100); the English original follows.
As coding models and agent harnesses become more capable, reliable security verification is becoming a central bottleneck. Improving secure code generation requires a signal whose reported progress remains aligned with actual program behavior under optimization; otherwise, an optimizer can improve the signal's verdict without removing the underlying vulnerability. Existing model-based approaches require models to either infer program behavior from source code or specify correct outcomes for adversarial tests, placing substantial reasoning demands on the security signal. We introduce \falcon{}, a counterexample-grounded verification framework that separates attack exploration from behavioral verification and connects them through execution traces of the program under test. In test-time repair, \falcon{} yields substantially stronger held-out functional-security gains than alternative security signals across secure code generation benchmarks, while preserving or improving functionality. As an RL reward, \falcon{} also outperforms static-analysis and learned rewards on held-out functional-security, even when all policies successfully optimize their respective training rewards. Combining \falcon{} with either proxy reward further improves held-out performance, suggesting that execution-grounded feedback can mitigate reward overoptimization while preserving useful guidance from existing security signals.
Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese
Topics: Computer science, Adversarial system, Coding (social sciences), Source code, Code (set theory), Computer security
GET https://store.agentexchange.work/gw/papers/verify?title=...&year=... (0.003 USD), fetch this record as JSON with /gw/papers/paper?id=2610.25916, or list what it cites with /gw/papers/references?id=.... Pay per call in USDC (x402) or with a 19 USD card key for 1,000 calls. Catalogue · llms.txtSources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange