CoGate: Confidence-Gated Co-Decoding for Secure Code Generation

2026-07-30

AI Summary

Large language models for code generation are prone to reproducing insecure patterns from their training data, leading to vulnerable code. Existing collaborative decoding approaches overlook the confidence of security-expert models, potentially introducing misleading guidance—especially in out-of-distribution scenarios. This work proposes a confidence-gated collaborative decoding mechanism that dynamically integrates the expert model’s confidence into the decoding process, adaptively modulating its influence on the primary model to suppress the adverse effects of low-confidence suggestions. Evaluated on multiple benchmarks—including HumanEval, Security Suite, and CWEval—the framework built upon CodeGen, DeepSeek-Coder, Qwen-Coder, and StarCoder consistently outperforms CoSec+, achieving up to a 12.6% improvement in the Func-Sec@10 metric on CWEval.

Abstract

Large language models are widely used for code generation, but they can also produce insecure programs due to patterns learned from their pretraining data. Decoding-time steering has become an important solution to this problem: a small expert model is combined with the target model at each step to generate more secure code, which is referred to as co-decoding. However, the acceptance rule for existing co-decoding approaches does not consider the expert model's confidence. When the security expert is unconfident due to unseen patterns or out-of-distribution (OOD) contexts, its guidance can therefore be misleading. To address the challenge, we propose CoGate, a confidence-gated co-decoding approach that controls the expert's influence on the co-decoding process based on its confidence. We implement our approach and evaluate it across multiple LLM backends (CodeGen, DeepSeek-Coder, Qwen-Coder, StarCoder) on several code generation benchmarks (HumanEval, security suite, and CWEval). Our approach outperforms existing co-decoding methods (CoSec+) across multiple benchmarks, achieving up to a 12.6% gain of Func-Sec@10 on CWEval.

Problem

• code generation
• security
• co-decoding
• confidence
• out-of-distribution

Innovation

• confidence-gated
• co-decoding
• secure code generation
• LLM steering
• out-of-distribution