Newest papers

Secure Agentic Coding through Counterexample-Grounded Feedback

Tue Le, Anh Nguyen Hoang, Gabriel Sasseville, Doseok Jang, Pierre‐Luc Bacon, Nghi D. Q. Bui · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.25916 · cited by 0 works (OpenAlex) · open-access PDF

Japanese

暗号化モデルとエージェントハネスがより有能になるにつれて、信頼性の高いセキュリティ検証が中心的なボトルネックとなっています。セキュアコード生成を改善するには、報告された進歩が最適化中の実際のプログラム行動と一致しているシグナルが必要です。そうでなければ、最適化者は、潜在的な脆弱性を除去することなく、信号の判断を改善することができます。既存のモデルベースのアプローチは、テスト中のソースコードからのプログラム行動を推測するか、反対テストのための正しい結果を指定するためにモデルを必要とします。我々は、攻撃探査を行動検証から分離し、それらを接続する反対例ベースの検証フレームワークであるfalconを導入します

Machine translation (Meta M2M100); the English original follows.

Abstract

As coding models and agent harnesses become more capable, reliable security verification is becoming a central bottleneck. Improving secure code generation requires a signal whose reported progress remains aligned with actual program behavior under optimization; otherwise, an optimizer can improve the signal's verdict without removing the underlying vulnerability. Existing model-based approaches require models to either infer program behavior from source code or specify correct outcomes for adversarial tests, placing substantial reasoning demands on the security signal. We introduce \falcon{}, a counterexample-grounded verification framework that separates attack exploration from behavioral verification and connects them through execution traces of the program under test. In test-time repair, \falcon{} yields substantially stronger held-out functional-security gains than alternative security signals across secure code generation benchmarks, while preserving or improving functionality. As an RL reward, \falcon{} also outperforms static-analysis and learned rewards on held-out functional-security, even when all policies successfully optimize their respective training rewards. Combining \falcon{} with either proxy reward further improves held-out performance, suggesting that execution-grounded feedback can mitigate reward overoptimization while preserving useful guidance from existing security signals.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Adversarial system, Coding (social sciences), Source code, Code (set theory), Computer security

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange