这篇论文提出了CoGate，让安全专家模型在没把握时少掺和，代码生成更安全，比CoSec+最高提升了12.6个百分点。
CoGate是一种针对大模型代码生成安全问题的置信度门控协同解码方法。它通过结合小型安全专家模型与目标模型，根据专家模型的置信度控制其影响，避免在未见模式或分布外场景下产生误导。研究在CodeGen、DeepSeek-Coder、Qwen-Coder和StarCoder等多个后端上进行了评估，覆盖HumanEval、安全套件和CWEval基准。相比现有协同解码方法CoSec+，CoGate在CWEval上实现了高达12.6%的Func-Sec@10提升。
CoGate: Confidence-Gated Co-Decoding for Secure Code Generation
Large language models are widely used for code generation, but they can also produce insecure programs due to patterns learned from their pretraining data. Decoding-time steering has become an important solution to this problem: a small expert model is combined with the target model at each step to generate more secure code, which is referred to as co-decoding. However, the acceptance rule for existing co-decoding approaches does not consider the expert model's confidence. When the security expert is unconfident due to unseen patterns or out-of-distribution (OOD) contexts, its guidance can therefore be misleading. To address the challenge, we propose CoGate, a confidence-gated co-decoding approach that controls the expert's influence on the co-decoding process based on its confidence. We implement our approach and evaluate it across multiple LLM backends (CodeGen, DeepSeek-Coder, Qwen-Coder, StarCoder) on several code generation benchmarks (HumanEval, security suite, and CWEval). Our approach outperforms existing co-decoding methods (CoSec+) across multiple benchmarks, achieving up to a 12.6% gain of Func-Sec@10 on CWEval.