PurpCode: Reasoning for Safer Code Generation

We introduce PurpCode, the first post-training recipe for training safe code reasoning models towards generating secure code and defending against malicious cyberactivities. PurpCode trains a reasoning model in two stages: (i) Rule Learning, which explicitly teaches the model to reference cybersafety rules to generate vulnerability-free code and to avoid facilitating malicious cyberactivities; and (ii) Reinforcement Learning, which optimizes model safety and preserves model utility through diverse, multi-objective reward mechanisms. To empower the training pipelines with comprehensive cybersafety data, we conduct internal red-teaming to synthesize comprehensive and high-coverage prompts based on real-world tasks for inducing unsafe cyberactivities in the model. Based on PurpCode, we develop a reasoning-based coding model, namely PurpCode-32B, which demonstrates state-of-the-art cybersafety, outperforming various frontier models. Moreover, our alignment method decreases the model overrefusal rates in both general and cybersafety-specific scenarios, while preserving model utility in both code generation and common security knowledge.

Authors

• Jiawei Liu
• Nirav Diwan
• Zhe Wang Hong Kong University of Science and Technology
• Haoyu Zhai
• Xiaona Zhou
• Kiet Nguyen
• Tianjiao Yu
• Muntasir Wahed
• Yinlin Deng
• Hadjer Benkraouda
• Yuxiang Wei Harbin Institute of Technology
• LINGMING ZHANG
• Ismini Lourentzou University of Illinois at Urbana-Champaign
• Gang Wang

Keywords

No keywords are indexed for this paper.