标题： 一种线性校正的混合生成安全代码 显示英文标题

标题： A Mixture of Linear Corrections Generates Secure Code

摘要： 大型语言模型（LLMs）在复杂的代码生成任务上已经变得熟练，但在可靠地检测或避免代码漏洞方面仍然无效。 这种不足是由于对代码漏洞的学习不足，还是仅仅是由于提示效果不佳的结果？ 使用表示工程技术，我们研究LLMs内部是否编码了识别代码漏洞所需的概念。 我们发现当前的LLMs编码了精确的内部表示，能够区分有漏洞和安全的代码——其准确性高于标准提示方法。 利用这些对漏洞敏感的表示，我们开发了一种推理时引导技术，通过校正混合（MoC）微妙地调节模型的token生成概率。 我们的方法有效地引导LLMs生成较少有漏洞的代码，而不会影响功能，展示了在生成代码中进行受控漏洞管理的实用方法。 值得注意的是，MoC将Qwen2.5-Coder-7B的安全比率提高了8.9%，同时在HumanEval pass@1上提高了功能2.1%。 显示英文摘要

摘要： Large language models (LLMs) have become proficient at sophisticated code-generation tasks, yet remain ineffective at reliably detecting or avoiding code vulnerabilities. Does this deficiency stem from insufficient learning about code vulnerabilities, or is it merely a result of ineffective prompting? Using representation engineering techniques, we investigate whether LLMs internally encode the concepts necessary to identify code vulnerabilities. We find that current LLMs encode precise internal representations that distinguish vulnerable from secure code--achieving greater accuracy than standard prompting approaches. Leveraging these vulnerability-sensitive representations, we develop an inference-time steering technique that subtly modulates the model's token-generation probabilities through a mixture of corrections (MoC). Our method effectively guides LLMs to produce less vulnerable code without compromising functionality, demonstrating a practical approach to controlled vulnerability management in generated code. Notably, MoC enhances the security ratio of Qwen2.5-Coder-7B by 8.9\%, while simultaneously improving functionality on HumanEval pass@1 by 2.1\%.