Newest papers

Secure Agentic Coding through Counterexample-Grounded Feedback

Tue Le, Anh Nguyen Hoang, Gabriel Sasseville, Doseok Jang, Pierre‐Luc Bacon, Nghi D. Q. Bui · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.25916 · cited by 0 works (OpenAlex) · open-access PDF

Korean

암호화 모델과 에이전트 장비가 더 능숙해지면서 신뢰할 수 있는 보안 검증이 중앙 단점이되고 있습니다. 보안 코드 생성을 개선하는 것은 보고된 진보가 최적화된 실제 프로그램 행동과 일치하는 신호를 필요로합니다; 그렇지 않으면, 최적화는 기본적인 취약성을 제거하지 않고 신호의 판단을 개선할 수 있습니다. 기존 모델 기반 접근 방식은 모델을 필요로합니다. 소스 코드에서 프로그램 행동을 추측하거나 적절한 결과를 테스트 시험에 지정하여 보안 신호에 상당한 이유를 부여합니다. 우리는 공격 탐구를 행동 검증으로부터 분리시키고 보안 흔적을 통해 그들을 연결합니다. 테스트 시간 수리에서, \falcon{{}는 보안 코드

Machine translation (Meta M2M100); the English original follows.

Abstract

As coding models and agent harnesses become more capable, reliable security verification is becoming a central bottleneck. Improving secure code generation requires a signal whose reported progress remains aligned with actual program behavior under optimization; otherwise, an optimizer can improve the signal's verdict without removing the underlying vulnerability. Existing model-based approaches require models to either infer program behavior from source code or specify correct outcomes for adversarial tests, placing substantial reasoning demands on the security signal. We introduce \falcon{}, a counterexample-grounded verification framework that separates attack exploration from behavioral verification and connects them through execution traces of the program under test. In test-time repair, \falcon{} yields substantially stronger held-out functional-security gains than alternative security signals across secure code generation benchmarks, while preserving or improving functionality. As an RL reward, \falcon{} also outperforms static-analysis and learned rewards on held-out functional-security, even when all policies successfully optimize their respective training rewards. Combining \falcon{} with either proxy reward further improves held-out performance, suggesting that execution-grounded feedback can mitigate reward overoptimization while preserving useful guidance from existing security signals.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Adversarial system, Coding (social sciences), Source code, Code (set theory), Computer security

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange