Search papers, labs, and topics across Lattice.
This paper introduces CoGate, a confidence-gated co-decoding method that enhances the security of code generated by large language models by modulating the influence of an expert model based on its confidence level. By addressing the limitations of existing co-decoding approaches, which can mislead when the expert model is uncertain, CoGate significantly improves the generation of secure code. Evaluations across various LLM backends and benchmarks demonstrate that CoGate outperforms previous methods, achieving up to a 12.6% increase in functional security on the CWEval benchmark.
Confidence gating in co-decoding can lead to a substantial 12.6% increase in secure code generation, revealing the critical role of expert model confidence in safety.
Large language models are widely used for code generation, but they can also produce insecure programs due to patterns learned from their pretraining data. Decoding-time steering has become an important solution to this problem: a small expert model is combined with the target model at each step to generate more secure code, which is referred to as co-decoding. However, the acceptance rule for existing co-decoding approaches does not consider the expert model's confidence. When the security expert is unconfident due to unseen patterns or out-of-distribution (OOD) contexts, its guidance can therefore be misleading. To address the challenge, we propose CoGate, a confidence-gated co-decoding approach that controls the expert's influence on the co-decoding process based on its confidence. We implement our approach and evaluate it across multiple LLM backends (CodeGen, DeepSeek-Coder, Qwen-Coder, StarCoder) on several code generation benchmarks (HumanEval, security suite, and CWEval). Our approach outperforms existing co-decoding methods (CoSec+) across multiple benchmarks, achieving up to a 12.6% gain of Func-Sec@10 on CWEval.
