Understanding and Improving Model Editing for Secure Code Generation

Abstract

Large language models (LLMs) are widely used for code generation but may reproduce vulnerabilities learned from insecure training data. Prior work mainly relies on inference-time hardening, which introduces auxiliary components and runtime overhead. We present the first systematic study of model editing as a model-level hardening mechanism for secure code generation, directly injecting security knowledge through localized parameter updates. We evaluate three state-of-the-art editing methods across diverse LLM families against CoSec, a representative inference-time approach, examining security effectiveness and robustness, generalization to unseen vulnerabilities, and functional correctness. Model editing substantially outperforms CoSec on seen vulnerabilities, improving security ratios by 15