面向安全代码生成的指令微调
Instruction Tuning for Secure Code Generation
AI总结：
针对现有指令微调语言模型生成代码安全性不足的问题，提出结合安全微调与标准指令微调的SafeCoder方法，可在保持实用性的同时将代码安全性提升约30%。
摘要：
现代语言模型（LM）已在日常与专业场景中得到广泛应用，尤其是在编程领域。支撑这一普及的关键流程是指令微调，该技术通过训练语言模型遵循用户指令与人类偏好，大幅提升了其实用价值。然而，现有指令微调方案忽略了一个关键维度：生成代码的安全性。因此，即便是最先进的指令微调语言模型，也频繁生成存在安全隐患的代码，带来了重大安全风险。在本研究中，我们提出SafeCoder以填补这一空白。SafeCoder采用我们通过自动化流水线收集的多样化高质量数据集，开展以安全为核心的微调。我们将安全微调与标准指令微调相结合，实现安全性与实用性的联合优化。尽管方法简洁，实验表明SafeCoder在多种主流语言模型与数据集上均表现有效，能够在保持实用性的同时，将安全性大幅提升约30%。
英文摘要：
Modern language models (LMs) have gained widespread acceptance in everyday and professional contexts, particularly in programming. An essential procedure enabling this adoption is instruction tuning, which substantially enhances LMs' practical utility by training them to follow user instructions and human preferences. However, existing instruction tuning schemes overlook a crucial aspect: the security of generated code. As a result, even the state-of-the-art instruction-tuned LMs frequently produce unsafe code, posing significant security risks. In this work, we introduce SafeCoder to address this gap. SafeCoder performs security-centric fine-tuning using a diverse and high-quality dataset that we collected using an automated pipeline. We integrate the security fine-tuning with standard instruction tuning, to facilitate a joint optimization of both security and utility. Despite its simplicity, we show that SafeCoder is effective across a variety of popular LMs and datasets. It is able to drastically improve security (by about 30%), while preserving utility.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
