Many Repairs, One Direction: Steering Code Models Toward Safer Cryptographic API Use

Key points

• While many existing approaches improve code security by modifying model parameters or inputs, how representation changes associated with different cryptographic API repairs can support a shared intervention for safer code generation remains underexplored.1
• To investigate this, we construct 48,000 matched program pairs across four programming languages and ten cryptographic API misuse categories.1
• Subtracting the misuse program's internal representation from its secure counterpart's gives a repair vector.1
• We introduce CrypSteer, which extracts a shared direction by normalizing repair differences and selecting a principal component aligned with repairs across misuse categories.1

Sources (1)

• [1]Many Repairs, One Direction: Steering Code Models Toward Safer Cryptographic API Use
  arXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 18, 09:32 AM

  Cryptographic API misuse in large language model-generated code can compromise software security.

  While many existing approaches improve code security by modifying model parameters or inputs, how representation changes associated with different cryptographic API repairs can support a shared intervention for safer code generation remains underexplored.

Extractive summary: sentences quoted from the sources.