{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/prosec-fortifying-code-llms-with-proactive","title":"ProSec: Fortifying Code LLMs with Proactive Security Alignment","arxiv_id":"2411.12882","date":"2024-11-19","proceeding":null,"authors":["Xiangzhe Xu","Zian Su","Jinyao Guo","Kaiyuan Zhang","Zhenting Wang","Xiangyu Zhang"],"abstract":"While recent code-specific large language models (LLMs) have greatly enhanced their code generation capabilities, the safety of these models remains under-explored, posing potential risks as insecure code generated by these models may introduce vulnerabilities into real-world systems. Existing methods collect security-focused datasets from real-world vulnerabilities for instruction tuning in order to mitigate such issues. However, they are largely constrained by the data sparsity of vulnerable code, and have limited applicability in the multi-stage post-training workflows of modern LLMs. In this paper, we propose ProSec, a novel proactive security alignment approach designed to align code LLMs with secure coding practices. ProSec systematically exposes the vulnerabilities in a code LLM by synthesizing vulnerability-inducing coding scenarios from Common Weakness Enumerations (CWEs) and generates fixes to vulnerable code snippets, allowing the model to learn secure practices through preference learning objectives. The scenarios synthesized by ProSec trigger 25x more vulnerable code than a normal instruction-tuning dataset, resulting in a security-focused alignment dataset 7x larger than the previous work. Experiments show that models trained with ProSec are 25.2% to 35.4% more secure compared to previous work without degrading models' utility.","url_abs":"https://arxiv.org/abs/2411.12882v3","url_pdf":"https://arxiv.org/pdf/2411.12882v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"prosec-fortifying-code-llms-with-proactive","repo_url":"https://github.com/PurCL/ProSec","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"none","reach":{"status":"ok"}}],"tasks":[{"task_slug":"code-generation","task_name":"Code Generation"}],"methods":[{"method_slug":"align","method_name":"ALIGN"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2411.12882","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2411.12882"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/PurCL/ProSec","reach":{"status":"ok"}}],"summary":{"unverified":10},"by_repo_kind":{"official":{"samples":10,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":10,"samples":[{"code_sha256_prefix":"03f8cf10066a6cc9","entry":"encode_oneturn_llama2","repo":"PurCL/ProSec","repo_kind":"official","path":"influence_score/data_utils.py","file_url":"https://github.com/PurCL/ProSec/blob/HEAD/influence_score/data_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"03f8cf10066a6cc9"}},{"code_sha256_prefix":"b9d5da7cab2c11d2","entry":"encode_oneturn_phi3","repo":"PurCL/ProSec","repo_kind":"official","path":"influence_score/data_utils.py","file_url":"https://github.com/PurCL/ProSec/blob/HEAD/influence_score/data_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"b9d5da7cab2c11d2"}},{"code_sha256_prefix":"ed43dd7816626e87","entry":"get_max_saved_index","repo":"PurCL/ProSec","repo_kind":"official","path":"influence_score/collect_grad_reps.py","file_url":"https://github.com/PurCL/ProSec/blob/HEAD/influence_score/collect_grad_reps.py","link_basis":"plan_row","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ed43dd7816626e87"}},{"code_sha256_prefix":"808c09bce5840bb9","entry":"get_output","repo":"PurCL/ProSec","repo_kind":"official","path":"influence_score/collect_grad_reps.py","file_url":"https://github.com/PurCL/ProSec/blob/HEAD/influence_score/collect_grad_reps.py","link_basis":"plan_row","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"808c09bce5840bb9"}},{"code_sha256_prefix":"169eaac296278af6","entry":"get_sequence_logps","repo":"PurCL/ProSec","repo_kind":"official","path":"influence_score/scores.py","file_url":"https://github.com/PurCL/ProSec/blob/HEAD/influence_score/scores.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"169eaac296278af6"}},{"code_sha256_prefix":"0f70820a9ff7a1a5","entry":"load_model_and_optimizer","repo":"PurCL/ProSec","repo_kind":"official","path":"influence_score/training_dynamics_refactored.py","file_url":"https://github.com/PurCL/ProSec/blob/HEAD/influence_score/training_dynamics_refactored.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"0f70820a9ff7a1a5"}},{"code_sha256_prefix":"f07dfce1992d2a42","entry":"preprocess_function","repo":"PurCL/ProSec","repo_kind":"official","path":"influence_score/data_utils.py","file_url":"https://github.com/PurCL/ProSec/blob/HEAD/influence_score/data_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f07dfce1992d2a42"}},{"code_sha256_prefix":"ea83b2394c29c3a7","entry":"query_claude","repo":"PurCL/ProSec","repo_kind":"official","path":"src/claude_utils.py","file_url":"https://github.com/PurCL/ProSec/blob/HEAD/src/claude_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ea83b2394c29c3a7"}},{"code_sha256_prefix":"33cff3ac8bb3e11a","entry":"query_claude_wrap","repo":"PurCL/ProSec","repo_kind":"official","path":"src/claude_utils.py","file_url":"https://github.com/PurCL/ProSec/blob/HEAD/src/claude_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"33cff3ac8bb3e11a"}},{"code_sha256_prefix":"bc9b71a2e0cc661f","entry":"td_sample_plus","repo":"PurCL/ProSec","repo_kind":"official","path":"influence_score/sample_refactored.py","file_url":"https://github.com/PurCL/ProSec/blob/HEAD/influence_score/sample_refactored.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"bc9b71a2e0cc661f"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}