ATGen: Adversarial Reinforcement Learning for Test Case Generation
Authors: Qingyao Li
Xinyi Dai
Weiwen Liu
Xiangyang Li
Yasheng Wang
Ruiming Tang
Yong Yu
Weinan Zhang
Venue: ICLR 2026 Poster (2026)
Keywords: Test Case Generation
Reinforcement Learning
Large Language Models
Code Generation
Primary area: generative models

Abstract: Large Language Models (LLMs) excel at code generation, yet their outputs often contain subtle bugs, for which effective test cases are a critical bottleneck. Existing test generation methods, whether based on prompting or supervised fine-tuning, rely on static datasets. This imposes a “fixed-difficulty ceiling”, fundamentally limiting their ability to uncover novel or more complex bugs beyond their training scope. To overcome this, we introduce ATGEN, a framework that trains a test case generator via adversarial reinforcement learning. ATGEN pits a test generator against an adversarial code generator that continuously crafts harder bugs to evade the current policy. This dynamic loop creates a curriculum of increasing difficulty that continuously challenges the current policy. The test generator is optimized via Reinforcement Learning (RL) to jointly maximize “Output Accuracy” and “Attack Success”, enabling it to learn a progressively stronger policy that breaks the fixed-difficulty ceiling of static training. Extensive experiments demonstrate that ATGEN significantly outperforms state-of-the-art baselines. We further validate its practical utility, showing it serves as both a more effective filter for Best-of-N inference and a higher-quality reward source for training code generation models. Our work establishes a new, dynamic paradigm for improving the reliability of LLM-generated code.

Published as a conference paper at ICLR 2026
ATGEN: ADVERSARIAL REINFORCEMENT LEARNING FOR TEST CASE GENERATION
Qingyao Li
Xinyi Dai
Weiwen Liu"
Xiangyang Li
Yasheng Wang Ruiming Tang² Yong Yu'
Weinan Zhang'*
'Shanghai Jiao Tong University Huawei Noah's Ark Lab {1y890306, wwl iu, wnzhang) es jtu..du.cc...
ABSTRACT
Large Language Models (LLMs) excel at code generation, yet their outputs often contain subtle bugs, for which effective test cases are critical bottleneck. Existing test generation methods, whether based on prompting or supervised fine-tuning, rely on static datasets. This imposes a "fixed-difficllty ceiling", fundamentally limiting their ability to uncover novel or more complex bugs beyond their training scope. To overcome this, we introduce ATGEN, framework that trains test case generator via adversarial reinforcement learning. ATGEN pits a test generator against adversarial code generator that continuously crafts harder bugs evade the current policy. This dynamic loop creates a curriculum of increasing difficulty that continuously challenges the current policy. The test generator is optimized via Reinforcement Learning (RL) to jointly maximize "Output Accuracy" and "Attack Success", enabling to learn a progressively stronger policy that breaks the fixed exed-difficulty ceiling of static training. Extensive experiments demonstrate that ATGEN significantly outperforms offte-of-hhe-ar baselines. We further validate its practical utility, showing it serves as both a more effective filter for Best-oft oos--of-N inference and a higher-quality reward source for training code generation models. Our work establishes a new, dynamic paradigm for improving the reliability of LLM -LM--geerated codd"
INTRODUCTION
Large Language Models (LLMs) have demonstrated remarkable capabilities in code generation (Wang
Chen 2023 Jiang al., 2024, Wang et al.
2025 Huang et al., 2024). tackling a wide range
of programming tasks (Etsenake & Nagappan 2024 Nijkamp et al. 2023 Li et al. 2024 2025).
However, the code they produce is often imperfect, containing subtle bugs and logical flaws (Tambon
et al. 2025; Dou et al. 2024). A critical bottleneck in improving code quality through automated debugging is the scarcity of high-quality test cases that can effectively identify these errors (Dikici &
Bilgin 2025). While human-writte tests are the gold standard, their manual creation is laborious
and does not scale, creating a pressing need for automated test case generation (Alagarsamy et al.
2024 Chen et al. 2024a).
Initial efforts to automate test case generation based on LLMs have explored two main avenues: prompting of I.LMs (Chen et al.) 2022 Schäter al. (023) and supervised fine-tuning (Prasad et al.) 2025). One line of work involves ves prompting general-purpose LLMs to generate test cases based on the problem description and given code snippet. Concurrently, more specialized approaches, exemplified by recent work like UTGen (Prasad et al.) 2025), have utilized Supervised Munn-Tuning (SFT) (Shen 2024) on pre-collected static datasets of code-test pairs. These methods aim to prompt or train model to generate test cases with their inherient learning capability, and have shown promising initial results in this domain.
However, the unique nature of test case generation for LLM-writter code presents complex challenge that these existing approaches are ill-equipped to handle. An effective test case should satisfy two
"Corresponding authors.
'The resources of this work are made available http:///tthi..oo///M/oo.o//o/

---

Published as a conference paper at ICLR 2026
objectives (Prasad al. 2025 1) Output Accuracy (Ueda & Tsukada 2021 Yang et al.) 2024b). ensuring the test's (input, output) pair is correct with respect to the problem's s specification. This involves a process of deriving outputs from inputs, which is inherently complex reasoning task. Previous methods directly prompt or train on pre-collected static input-output pairs, which not only imposes performance ceiling but also limits the model's generalization across diverse coding tasks. 2) Error-triggering (Zhong et al. 2024; Ceccato et al. 2015), or we call Attack Success, meaning buggy code. This objective inherently dynamic; its difficulty is dictated by the subtlety of the flaws in the buggy code it confronts. However, prior methods relying on static training data train the test generator on a fixed collection of buggy codes, where the types and difficulties of bugs are predetermined. Consequently, this approach imposes ixed-difficulty ceiling on the test generator's capabilities, making the model unprepared to discover novel, more complex bugs, ultimately limiting its effectiveness as code generators become more sophisticated.
ensuring the test can successfully trigger& a flaw
This paper provides unique perspective this problem. The idea is to put the test generator in an adversarial loop to train with the code generator. The code generator could provide adversarial code that challenges the current test generator's 's capability constantly. As the test generator improves, it forces the code generator to produce more subtle and complex bugs to evade detection. These new, harder-to-find bugs, in turn, serve dynamic curriculum that pushes the test generator beyond its current capabilities, effectively breaking the fixed-difficllty ceiling inherent in static methods.
In light of this, we introduce ATGEN (Adversarial Test Generator), novel framework that trains a test generator via Reinforcement Learning (RL) within an adversarial loop. We leverage RL to move beyond static mimicry, allowing the generator to learn reason from trial-and-error and learn a dynamic policy that explicitly optimizes the trade-off between output accuracy and attack success. To break the fixed-diffiullty ceiling. we introduce an adversarial code generator into that RL process that creates a dynamic curriculum. Instead of training on a fixed set of bugs. our test generator is continuously challenged by new, "hard" buggy code that is specifically generated evade detection by the current policy. This adversarial setup forces the test generator to constantly improve and uncover progressively more subtle flaws. Our main contributions can be summarized as follows:
We propose novel RL-based framework for test generation that trains test case generator reason and dynamically navigate the optimization of output accuracy and attack success, outperforming static prompting and SFT approaches.
We introduce an adversarial training paradigm where the test generator is trained against code generator, enabling it to discover more complex and subtle code flaws than with static dataset.
We demonstrate the practical utility of ATGEN in both the inference and training of code generation, showing that its generated tests serve as both a more effective filter for Best-of-N inference and a higher-quality reward source for RL-based code generator training.
Extensive experiments show that ATGEN significantly outperforms strong baselines. Our method demonstrates a superior ability to balance its core objectives, especially on difficult problems, establishing new and more effective paradigm for automated test generation.
2 RELATED WORK
Automated Test Case Generation with LLMs The advent of Large Language Models (LLMs) has shifted the focus of automated test case generation from traditional structural coverage (Huang
et al. Wu et al. 2025 Zhang et al. 2023) to addressing the unique logical flaws in Al-generated
code (Huang et al. Wu et al. 2025 Zhang al. (023). These modern approaches primarily fall into based
two categories: prompting-o based methods (Chen et al. 2022 2024b: Yang et al. 2024a) and fine- methods (Chen et al.
tuning- based methods (Prasad et al. 2025). Prompting-basee
2024b) leverage
prompt engineering to guide general models like GPT-4 (Achiam et al. 2003)). but are often limited by their unspecialized reasoning capabilities. In contrast, fine-tuning- based methods train specialized models on curated datasets. The most direct precursor, UTGen (Prasad et al. 2025), uses Supervised Fine- Tine-Tunng (SFT) to balance generating bug-revealing inputs ("attack rate") with predicting correct outputs ("output accuracy"). However, these approaches are fundamentally constrained by their reliance on static data. UTGen, for instance, is limited by its static training dataset, which prevents from adapting to find novel or more complex bugs beyond what it has already seen.
2

---

Published as a conference paper at ICLR 2026
Reinforcement Learning for Code-related Tasks Reinforcement Learning (RL) has emerged as a powerful paradigm for code-related tasks, using feedback from the execution environment (e.g.. unit tests) to optimize models beyond standard supervised learning. A significant line of work has applied RL to improve code generation. Approaches like CodeRI. (Le et al., 2022) and others (Pan
et al., 2023 Gou al. [0033 Pan al.
(024) established the viability of using unit test feedback as a reward signal, while Deepseek-RI (Guo et al.] 2025) demonstrated that RL can enhance an LLM's general reasoning and coding abilities. More recently, RL has been applied automated program repair. Frameworks such Repair-R1 (Hu et al., 2025) co-optimize test generation and bug repair, while others like Repairity (Tang et al. 2025) use feedback from LLM judge. These works highlight the power of RL in training agents that modify code. In contrast, ATGEN aims to create powerful, standalone test generator. Instead of learning policy to write correct code against fixed verifier, ATGEN learns policy to explore the input space to falsify given program, thereby providing high-quality reward signal for any downstream agent.
PRELIMINARIES
In this work, we focus on the task of automated test case generation. Formally, given a code problem description Q and potentially faulty code implementation Chaggy. the goal is to train a test generator, represented by a policy Te. to generate a unit test include input a and output y. T gen- = (x, y) (Q, Oouggy). ). An effectively generated test case must satisfy two key objectives:
Output Accuracy: The generated output y must be correct with respect to the problem description Q. This is formally verified by checking if y Cgola(z), where Cgold is ground-true truth code solution.
Attack Success: The generated test case must reveal the flaw in the faulty code, meaning the execution of Couggy on input x does not yield the correct output y, i... Couggy (2) #
It is evident that successfully accomplishing this task demands level of reasoning capability compa- rable to that required code generation. The model must directly predict the output corresponding to given input, which necessitates a thorough understanding of the input-output mapping preciscly the objective code or program synthesis. Moreover, unlike standard code generation, test generation requires analyzing a potentially buggy code snippet and producing targeted test cases expose its flaws. This places an additional requirement on the model: the ability to identify subtle code errors. In summary, the key challenges lie in enhancing the model's 's reasoning capacity for this task and equipping it with the capability to "attack" buggy code with subtle defects.
ATGEN
We propose ATGEN, an adversarial reinforcement learning framework that trains a robust test generator through dynamic, self-im seff-improving curriculum. As illustrated in Figure our framework is composed of two interconnected parts: an RL-based Test Generator Training part that optimizes the generator, and an Adversarial Code Generation part that dynamically creates challenging training data.
4.1 RL-BASED TEST GENERATOR TRAINING
The core training of our framework is test generator trained via reinforcement learning so that the model can learn to optimize output accuracy and attack success rate directly. We formalize this process as follows:
RL Formulation.
State (s:): The state tuple consisting of the problem description and the current buggy code, (Q, Oroggy).
Action (a.): The action the generated test case, an I/O pair a, -gen (x, y).
Policy (Ty): The test generator is modeled as stochastic policy (a(aass) st), parameterized by which aim to optimize.
3

---

Published as a conference paper at ICLR 2026
RL--based Test Generator Training
Format Reward
Test Generator
T
Cyrld
IO Acc Reward
Reward
C imogg
Codver
Cadver
Attack Reward
Aversorid
Adversarial Code Generation
C₁ C22 ...
T yes
Pass
Code Generator
Cudver
T Fooid
Fail
Cc
Figure The overall architecture of the ATGEN framework. The top panel shows the core RL training loop: the test generator (policy) receives a state (Q. Cadver) and generates test case Tgen (action). then receives a multi- component reward. The bottom panel shows the adversarial data generation loop: code generator is tasked to sample new, harder adversarial code Caiver that passes the current gen but fails against a ground-truth test suite T good. This new Cadver then fed back into the training loop, creating dynamic curriculum.
At each step. the policy model (test generator) attempts to produce action the form test case (i.e., an input-output pair), based on the given question and the buggy code. The goal is for this test case to be both valid and capable of triggering faulty behavior in the buggy code, such as causing to crash or produce incorrect output. Upon receiving the reward signal, the test generator updates its policy by computing the loss according the chosen reinforcement learning algorithm. In this work, we employ GRPO (Shao al. (024), an actor-only method that eliminates the need for separate critic model, thereby reducing computational and memory overhead.
Test Generation Reward Function. To effectively guide the policy, design a multi-componeet reward function Rg that explicitly captures the desired properties of a good test case. As shown the top panel of Figure the total reward is weighted
of three components:
10 Acc Reward Race: represents the correctness of the IO pair, which is calculated by executing gold code Cgold the generated input and comparing it to the generated output y.
Attack Reward Rauack: It is positive if the buggy code Couggy fails on the generated test case, either raising an execution error or output differently from the generated output. It can only be required when the 10 pair is correct.
Format Reward Rioomat' To activate the model's thinking ability, referencing Deepseek-R1's (Guo al. 2025) training format setting, the reasoning process and answer enclosed within <think> and < </think> and <answer> and < answer> tags, respectively.
The final reward is weighted sum of multiple rewards:
R2 Whoc Race + Wattakk Ratuck + Wformat Reormat
(1)
where the weights w are hyperparameters that balance the different objectives during training. Each reward is within the range of (-5,5, 1.0] and it's set to -0.5 when the form is not right.
4.2 ADVERSARIAL CODE GENERATION
While the reinforcement learning framework allows the test generator to directly optimize for output accuracy and attack success, its true potential is constrained by the static nature of the buggy codes trains on. Training on a fixed collection of bugs, where difficulties are predetermined, imposes the fixed-difficulty ceiling inherent in prior methods. An agent trained in such a static environment cannot learn to overcome novel, more complex challenges. To break this ceiling and unlock the full potential of RL, the training environment itself must evolve alongside the agent. To this end, ATGEN incorporates an adversarial loop to dynamically generate a curriculum of increasingly challenging buggy code, ensuring the test generator is continuously pushed beyond its current capabilities.
4

---

Published as a conference paper at ICLR 2026
The Adversarial Process. As shown in the bottom panel of Figure I this part functions data augmentation engine that creates "hard" training instances dynamically for our test generator. For given problem Q and a test case Tge gen produced by our current policy, prompt separate code generator model. This generator is tasked with producing a new adversarial code, Cadver. that satisfies two critical conditions:
It must remain incorrect, that it is buggy code for the test generator attack, meaning it fails against the full ground-truth test suite, 3(x', y') E goold s.t. Cavver * y'-
It must pass the generated test case Tee.. meaning (T)v = detectable by the current test generator's generation.
This ensures the new bug is not
This process generates buggy code that is specifically designed be challenging for the current iteration of the test generator.
Unconditional and Adaptive Modes. There are two primary strategies for obtaining Caáver from the code generator. A straightforward approach directly instruct the generator to produce code that satisfies the adversarial criteria (i.e., passing a specific generated test while remaining globally incorrect). While this method is computationally inexpensive, risks introducing distributional shift; the bugs in the resulting code are deliberately engineered rather than being natural bugs. Training on such synthetic artifacts could mislead the test generator into learning to detect artificial, rather than realistic flaws.
Therefore, we adopt a more robust, sampling-based approach. this paradigm, we provide the code generator with only the problem description Q and sample multiple code potential solutions. From this pool of naturally generated outputs, we filter for instances that coincidentally meet the adversarial criteria. This ensures that the resulting Cadver contains authentic bugs, providing a more realistic and challenging training curriculum for the test generator.
However, the significant computational cost of sampling for every training instance motivates more nuanced strategy. We therefore propose and evaluate two distinct modes for adversarial data generation:
Unconditional Mode: We unconditionally generate adversarial code Cadver via sampling to replace the original buggy code Chuggy for every instance in the training batch, making every Chuggy replaced by Cadver-
Adaptive Mode:
To improve efficiency, we conditionally trigger the sampling process. A new Culver is generated only if the current test generator can already successfully attack the original Oouggy- If the original bug already challenging enough to evade detection, we reuse conserving computational resources for cases where they are most needed.
Dynamic Curriculum. These newly generated, harder pairs of (Q, Cuiver) then replace the original (Q, Chuegy to the training data pool for the test generator. This creates a self-improving ecosystem where, as the test generator becomes more adept at finding certain types of bugs, the adversarial code generator is forced to select code with more subtle and complex flaws. This dynamic curriculum ensures that the test generator is continuously challenged and learns to identify a wider and more difficult range of programming errors than would be possible with a static dataset.
EXPERIMENTS
5.1 EXPERIMENTAL SETUP
Datasets. We train and evaluate our test generator on subset of 3000 problems from APPS (Hendrycks et al. 202I) and Codeforces [MatrixStudio] (2024). We used GPT-4o-mini (OpenAI 2024) to sample buggy codes for each problem, creating training set of 16,822 and test set of 911 (Question, buggy code) pairs. To analyze performance on bugs of varying subtlety, we partitioned this benchmark into Easy, Medium, and Hard tiers based
initial evaluation of bug-finding difficulty. We use Qwen2.5-78 7B--ttrtttttt (Qwen et al.] (024) to initially attack them by generating test cases. Then rank them by attack success rate, and then divide the ranked into three equal parts. For
5

---

Published as a conference paper at ICLR 2026
each problem, we keep ground-trum truth solution (Cgola) to verify the correctness of generated test outputs and a suite of Human--rittee tests (Tgola) to validate the incorrectness of adversarial code.
Baselines.
We compare ATGEN against two categories of methods:
Prompting- Methods: We evaluate large language models that have demonstrated strong general reasoning and coding abilities. This includes GPT-4o (Hurst et al.] 2024), GPT--o- mini OpenAA 2024), GPT-4-turbo (Achiam al. 2023), instruction-tuned versions of the Qwen2.5 series [Qwen et al. 2024) and Qwen3 series (Yang et al. 2025). These models are prompted to generate test cases without any specific fine-tuning for the task.
Supervised Fine- Fine-Tuning (SFT) Method: We include UTGen (Prasad et al., 2025), the state-of- the-art SFT-basce approach for unit test generation. We evaluate both the 3B and 7B parameter versions of UTGen to provide a comprehensive comparison against prior specialized methods.
Evaluation Metrics. We assess performance using two primary metries:
I0 Accuracy (%): The percentage of generated test cases (z, y) that are correct, i.e., = (z).
Attack Rate (%); The percentage of test cases that are first confirmed correct (passes the IO Accuracy check) and then causes buggy code to fail, either by crashing or producing an incorrect output (i.e., Cruggy (z) # y).
Implementation Details. Our ATGEN framework is built on Qwen2.5-33 --B----ssn-tttcttt Instruct and Qwen2.5-
7B-Instruct (Qwen al.) 2024) backbones, using the veRL. (Sheng al. 2025) framework with GRPO as the RI. algorithm. The adversarial code generation loop uses GPT-4o-mini (OpenA] 2024) separate code generator produce challenging buggy code samples. All reward components Wace; Wattack Wformat are weighted equally. And if not specified, we use adaptive mode for ATGEN for our analysis experiments. The data used for SFT baselines and RL methods are exactly the same split.
5.2
MAIN RESULTS: ADVERSARIAL TRAINING FOR TEST CASE GENERATION
We present the main results in Table 1 Our findings consistently demonstrate the superiority of our proposed methods:
ATGEN Framework Establishes New State-of-the-Art. Our ATGEN establishes a new state- of-the-art, significantly outperforming existing methods in both 10 Acc and Attack Rate. Our best-performing model, using the Qwen2.5-7B-Instiee improvement in Attack Rate over the strongest proprietary baseline, GPT-4-turbo, and is more than twice as effective finding bugs as the prior method, UTGen (7B) (36.99% vs. 16.24%). These results demonstrate the high effectiveness of combining RL with a dynamic adversarial curriculum.
backbone, achieves nearly 60% relative
Reinforcement Learning Provides a Major Performance Leap. To isolate the benefits, we also evaluated a aon-adversarial version of our framework. Even this simplified model on its own constitutes a major advance over prior work, which may be due to the stimulation of the model's reasoning ability by RL training (Yue et al. [2025] Xie et al. (2025). This substantial performance leap validates that using RL to directly optimize for bug detection and output correctness is a far more effeettve paradigm than static fine-tuning.
Different Modes Achieve Superiority Depending On Backbone Models. Our Unconditional and Adaptive modes show that the optimal strategy is determined the scale of the backbone model. For the larger 7B model, the targeted curriculum of the Adaptive mode more effective at maximizing the Attack Rate. Conversely, for the smaller 3B model, the Unconditional mode's constant stream of diverse challenges yields higher Attack Rate. This suggests that while more capable models benefit from focused challenges, less capable ones may learn varied attack patterns effectively from continuous curriculum.
5.3 ANALYSIS OF THE ACCURACY-ATTACE TRADE-OFF
To understand the accuracy-attack trade-off, we introduce Input Attack Rate metric. cal- culated by taking the generated input, pairing it with the ground-truth output from gold

---

Published as a conference paper at ICLR 2026
Total Atlack Rate (%)
Easy
Medium
Hard
Method
Ace
10 Ace
Atlack Rate
10 Acc
Attack Rate (%)
IO Acc
Altack Rate
(%)
(%6
Baselines
GPT-44
34.02
20.63
24.42
19.47
35.85
23.02
41.77
19.40
GPT-4-turbo
41.16
23.38
34.32
26.73
42.10
23.35
47.03
20.06
GPT-4o-mini
34,57
17.23
27.72
21.12
35.19
17.76
40.78
12.82
Qwen2.5-3B-Ime
14.05
6.58
15.51
12:21
16.12
5.26
10.52
2.30
Qwen2.5-7B- Instuuttt
26.56
14.37
23.43
19.80
28.28
15.78
27.96
7.56
Swen2.5-32B-Instuu
35.01
21.62
29.70
24.09
36.51
24.01
38.81
16.77
Qwen3-4B
28.64
16.79
27.39
22.44
32.23
17.76
26,31
10,91
Qwen3-8B
38.19
22.72
38.28
33.66
39.80
23.35
36.51
11.18
Qwen3-32B
37.87
17.89
32.01
25.08
41.18
18.09
40.46
10.52
UTGen (3B)
22.83
12.29
23.10
18.81
25,00
12.92
20.39
5.26
UTTGien (78)
31.83
16.24
28.71
22.77
32.56
17.43
34.21
8.55
Ours (Backbone: Qwen2.5.3B-
ATGEN (w/o Adver)
66.95
29.96
67.98
40,92
68.00
29.93
64.80
19.07
ATGEN (Unconditional)
68.93
32,38
68.64
42,90
73.35
32,89
64,80
21.38
ATGEN (Adaptive)
70,36
30.95
68.31
40.92
73.68
32.56
69.07
19.40
(Backbone: 10wen2.5-7.-Intrrccct
ATGEN (W/ Adver)
71.56
34,02
71.62
47.85
73.63
35.85
69.40
18.42
ATGEN (Unconditional)
74.97
34.57
70.95
47.19
79.27
36.84
74.67
19.73
ATGEN (Adaptive)
79.60
38.81
Table I: Intrinsic evaluation test case generation methods on a subset of APPS and Codeforces benchmarks. Our RL-trained models, ATGEN, significantly outperform SFT-based (UTGen) and prompting baselines. Best results in each column for our methods are in bold.
code, and then checking this corrected 10 pair successfully fails the buggy code. It mea- sures generated input's raw bug-finding capability, which reveals fundamental trade-off: test inputs effective at finding bugs (high Inpul Allack Rate) are often corner cases, making difficult for the model predict their correct output, thus leading lower 10 Accuracy.
Reward Configuration
10 (%)
Attack Rate (%)
Input Attack Rate (%)
Trade-off by Different Reward Set- tings. We first investigate whether this trade-off can be navigated by sim- ply engineering the reward function. We trained variants of ATGEN (w/o Adver) with different reward composi- tions: one that rewards only the final, correct and valid attack (Attack Rate Only); that jointly rewards output correctness and raw input attack capability (I0 Acc + Input Attack); and a balanced version with all reward components (Three Combined).
10 Input Attuck
44.67
30.07
62.56
Attack Rate Only
67.72
29.74
47.53
Three Combined
65.64
30.29
47.09
Table Analysis of different reward configurations for our non-adversarial RL model, ATGEN (w/o Adver). Results highlight the trade-off between IO Accuracy and the raw attacking potential of generated inputs (Input Attack Rate).
The results, presented in Table reveal a clear and informative trade-off. When explicitly rewarding for Inpul Attack Rate, the model achieves the highest to its 10 Accuracy. Conversely, the configuration rewarding only the final Attack Rate yields the highest I0 Accuracy. This suggests the model learns that prerequisite for achieving the final attack reward is to first generate correct I/O pair, thus adopting more conservative but accurate strategy. Most importantly. across all configurations, the final usable Attack Rate remains largely stagnant at around 30%. This indicates that while reward engineering can shift the model's 's focus, it does not fundamentally enhance ability to generate tests that are attacking and correct. This limitation motivates the need for more advanced, adversarial training paradigm, which we explore next.
that metric but at a significant cost
Better Trade-off by ATGEN. To rigorously evaluate the impact of adversarial training, analyze the performance of ATGEN and its non-adversarial counterpart across various training configurations. We pick key configurations of GRPO, such as the number of samples per optimization step (e.g., 128 vs. 64) and the GRPO group generation number (e.g.. 6 vs. 8). A smaller sample count per optimization step corresponds to more "online" learning setting. The results, presented in Table
For the non-adversarial model ATGEN (w/o Adver), it is forced into a suboptimal trade-off under different training dynamics, often sacrificing I0 Accuracy for higher Input Attack Rate, illustrating
7

---

Published as a conference paper at ICLR 2026
that without dynamic curriculum, pushing the model to find more challenging inputs can severely degrade its ability to predict correct outputs.
Table 3: Comparison IO Accuracy and Input Attack Rate across different hyperparameter configurations. The pro- posed ATGEN framework demonstrates a clear performance
In contrast, the full ATGEN frame- work consistently establishes a supe- rior performance frontier. In the (128, 6) and (64, 6) configurations, ATGEN
improvement over its non-adversarial counterpart.
simultaneously improves both met- rics, delivering a clear win-win. Most
Hyperparameter Set
Metric
ATGEN (w/o Adver)
ATGEN
A
(128,6)
10 (96)
Input Altack (%)
71.56
74,09
47.99
+2.53
the baseline falters, ATGEN demon-
tellingly, in the (64, setting where
(64,6)
Input Attack Rate (1%
10 Accuracy (8)
47.63
73.76
74.66
49.17
+1.20
+1.54
strates its robust balancing capability.
It achieves massive +5.71 % absolute gain in IO Accuracy while keeping the Input Attack Rate highly competitive. This shows that the dynamic adversarial loop prevents the model from overfitting to single metric, enabling it to learn a more generalizable policy.
(64,8)
10 Accuracy (9%
Input Attack Rate (%)
69.59
49,06
75.30
47.85
+5.71
-1.21
5.4 DOWNSTREAM APPLICATION: ENHANCING CODE GENERATION
To assess the practical utility of our trained test generators, we evaluate their effectiveness in both the inference and training of code generation.
ATGEN as Best-of-N Filter. We evaluate our test generator's utility for inference in Best- of-N setting on the APPS dataset. For each problem, we sample candidate solutions and use the test generator to create a suite of hest unit tests. The candidate code with the highest pass rate against this suite is selected, and its final performance measured on a private ground-truth test set.
Effectivaness Test Generators Best-of-N Filter
Figure 2 shows the average pass of the se- lected code. The results clearly demonstrate that our adversarially trained model, ATGEN (Adap- tive), is the most effective automated filter, con- sistently outperforming all baselines. At a cost- efficient setting of krest 10, using ATGEN (Adaptive) achieves a final pass @ of 35.00% surpassing the UTGen baseline (30.67%) by over 4.3 absolute points and significantly closes the gap to the theoretical Human Expert upper bound (38.33%)
Average paciea (80 of Selected
40
30
36
20.00
24
30.11
32
3017
2822
28
2017
20
Number of Tests Generated Candidate De..l
Furson Sehocion
Oeerz S- Binardt - Arter owts Aovert
- Human Expert Jppper Bounds - UTtenn (73)
- ATGer (Assptive
Crucially, the plot also reveals that ATGEN'S peak performance is achieved with a small num- ber of generated tests. The performance curves for our models remain largely stable as kiess in- creases beyond 10. We attribute this to the RL objective, which optimizes the generator to find single, high-impact, bug-revealing test case. Con- sequently, generating more tests for the same candidate yields no improvements. This demonstrates that AT'GEN not only a powerful verifier but also remarkably compute-efficient, requiring only a few generated tests to reliably select the best candidate from a large pool.
Figure 2: Performance comparison of different test generation models in Best-of-N code gen- eration setting. ATGEN (Adaptive) achieves the best performance and significantly closes the gap to the theoretical Human Expert upper bound.
ATGEN as an RL Reward Source for Code Generation. Beyond inference, a powerful test generator can provide reward signal for training code models with RL. Pioneer work like Deepseek- RI (Guo et al. 2025) has shown that RL, using pass rates on ground -tuth test cases as a reward, can dramatically enhance model's coding ability. However, this approach is limited to problems where a factual test suite already exists. This raises a critical question: can a high-quality generated test suite serve effective proxy for RL-based code generation training?
To investigate this, we train a Qwen2.5-3B. 3-B---B-tttttt code generator via RL, using reward signals from three different test generators: ATGEN (Adaptive), the baseline UTGen (7B), and prompted
8

---

Published as a conference paper at ICLR 2026
Performance Code with Generator APPS
Codeforces
Find Paoza of Code Cenerto
17.5
13.0
12.5
Feai Parlo of
550
$30
100
2.-
5:22
3.0
2,00
2.00
2.5
5.0
1756
Test Generater used for RJ Rawand:
UTien (780
ATGGen-78
code generator after being trained via RL with rewards provided by different test generators. Using our ATGEN-7B as the reward source yields substantially stronger final code generator compared to using baseline test generators.
Figure 3: Final pass@1 performance of a Qwen2.5-3B-Inse
Bree2..-7B-Instruee The resulting code generators are then evaluated on the APPS and Codeforces benchmarks. The results presented in Figure show that the code generator trained with rewards from our ATGEN-7B significantly outperforms the models trained using UTGen or Qwen2.5-77 1eem2..57--Insttreee B-Instruct across both benchmarks. This confirms that a high-quality, adversarially trained test generator can effectively proxy human-written test suites in an RI loop, opening new avenue for improving code models where ground-trui truth tests are unavailable.
5.5 ANALYSIS OF ADVERSARIAL SAMPLING ATTEMPTS
To understand the impact of adversarial pressure, conduct an ablation study the maximum number sampling attempts used to find an adversarial code. Intuitively, the more retires, the more likely adversarial code could be sampled. We evaluate the performance of our ATGEN-7B model with sampling retries set to 10, 20, and 30.
Table Impact of varying the maximum sampling retries for adversarial code. Increasing retries hances the adversarial ratio and input attack rate but reduces 10 accuracy.
The results, presented in Table reveal two key insights. First, increasing sampling at- tempts boosts the proportion of adversarial code found, but with diminishing returns. As shown in the "Adversarial Code Ratio" col- umn, an increase from 20 to 30 results in only a marginal improvement on adversarial code ratio. This suggests that as the test generator becomes more adept, the pool of easily discov- erable adversarial examples shrinks, making harder to find new ones even with more attempts. Second, in ATGEN, the adversarial code ratio controls the trade-off between the model's attack capability and its correctness. While the raw bug- finding potential (Input Attack Rate) consistently improves, the model's ability to produce correct outputs (IO Accuracy) steadily declines. These findings highlight that increasing retries is not monolithic improvement. A moderate number of retries appears to provide a sweet spot, effectively boosting the model's attack capabilities without catastrophically impacting its output accuracy.
Mux Sampling Retries
Adversorial Code
10 Accuracy (%)
Input Attack Rate (%)
(%)
10
17.1
74.09
47.96
20
23.0 (T)
72.99 (L)
49.50 (1)
23.7
70.69
49.94
6 CONCLUSION
This paper introduces ATGEN, a novel framework that trains the test case generator using adversarial reinforcement learning. By creating dynamic curriculum of challenging bugs, ATGGN learns to produce highly effective test cases that significantly outperform prior methods reliant on static datasets. Our experiments validate ATGEN's superiority and demonstrate its practical utility powerful filter for selecting correct code and as a high-quality reward source for training more capable code generation models. This work not only establishes debugging but also presents a core adversarial RL framework that is, in principle, generalizable to a broader range of code and reasoning-related challenges.
effective paradigm for automated

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGMENTS
We thank all anonymous reviewers and area chairs for their constructive feedback. This work was supported in part by the National Natural Science Foundation of China (62322603, 62502310).
REFERENCES
Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint 3333:::3000087744, 2023.
Saranya Alagarsamy, Chakkrit Tantithamthavorn, and Aldeida Aleti. A3test: Assertion-augmentte automated test case generation. Information and Software Technology, 176:107565, 2024.
James Andrews, Lionel C Briand, and Yvan Labiche. Is mutation an appropriate tool for testing experiments? In Proceedings of the 27th international conference Software engineering, pp- 402-411,2000
Andres Campero, Roberta Raileanu, Heinrich Küttler, Joshua B Tenenbaum, Tim Rocktäschel, and Edward Grefenstette. Learning with amigo: Adversarially motivated intrinsic goals. arXiv preprint arXiv:2006.12122 12122, 2020.
Mariano Ceccato, Alessandro Marchetto, Leonardo Mariani, Cu D Nguyen, and Paolo Tonella. Do automatically generated test cases make debugging easier? an experimental assessment of debugging effectiveness and efficiency. ACM Transactions on Software Engineering and Methodology (TOSEM), 25(1):1-38, 2015.
Bei Chen, Fengji Zhang, Anh Nguyen, Daoguang Zan, Zeqi Lin, Jian-Guang Lou, and Weizhu Chen. Codet: Code generation with generated tests. arXiv preprint arXiv:2207.10397 2022.
Jingyi Chen, Lei Yan, Shikai Wang. and Wenxuan Zheng. Deep reinforcement learning-base -basid automatic test case generation for hardware verification. Journal of Artificial Intelligence General science (JAIGS) ISSN: 3006-4023, 6(1):409-429, 2024a.
Yinghao Chen, Zehao Hu, Chen Zhi, Junxiao Han, Shuiguang Deng, and Jianwei Yin. Chatunitest: framework for llm-based test generation. In Companion Proceedings the 32nd ACM International Conference on the Foundations of Software Engineering, pp. 572-576, 2024b.
Sena Dikici and Turgay Tugay Bilgin. Advancements in automated program repair: a comprehensive review. Knowledge and Information Systems, pp. 1-47, 2025.
Shihan Dou, Haoxiang Jia, Shenxi Wu, Huiyuan Zheng, Weikang Zhou, Muling Wu, Mingxu Chai, Jessica Fan, Caishuang Huang, Yunbo Tao, et al. What's wrong with your code generated by large language models? an extensive study. arXiv preprint arXiv:2407.06/55 2024.
Deborah Etsenake and Meiyappan Nagappan. Understanding the human Ilm dynamic: A literature survey of 1lm use in programming tasks. arXiv preprint arXiv:2410.01026, 2024.
Zhibin Gou, Zhihong Shao, Yeyun Gong, Yelong Shen, Yujiu Yang, Nan Duan, and Weizhu Chen. Critie: Large language models self-correct with tool-interactive critiquing. arXiv preprint arXiv:2305. 17388 2023.
Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et Deepseek-rl: Incentivizing reasoning capability in llms via reinforcement learning. arXiv preprint arXiv:2501.12948, 2025.
Dan Hendrycks, Steven Basart, Saurav Kadavath, Mantas Mazeika, Akul Arora, Ethan Guo, Collin Burns, Samir Puranik, Horace He, Dawn Song, et al. Mcasuring coding challenge competence with apps. arXiv preprint arXiv:2105. 09938, 2021.
Haichuan Hu. Xiaochen Xie, and Quanjun Zhang. Repair-rl: Better test before repair. arXiv preprint arXiv:2507.22883. 2025.
10

---

Published as a conference paper at ICLR 2026
Dong Huang, Jie M Zhang, Qingwen Bu, Xiaofei Xie, Junjie Chen, and Hemingg Cui. Bias testing and mitigation in llm-based code generation. ACM Transactions on Software Engineering and Methodology, 2024.
Linghan Huang, Peizhou Zhao, Huaming Chen, and Lei Ma. Large language models based fuzzing techniques: A survey (2024). URL htlps://urziv. wt//abb/22422.00335
Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Os- trow, Akila Welihinda, Alan Hayes, Alec Radford, et al. Gpt-4o system card. arXiv preprint arXiv:2410.21276 2024.
Yue Jia and Mark Harman. An analysis and survey of the development of mutation testing. IEEE transactions on software engineering, 37(5):649-678, 2010.
Juyong Jiang, Fan Wang, Jiasi Shen, Sungju Kim, and Sunghun Kim. A survey on large language models for code generation. arXiv preprint 3xXiv:2406.00515. 2024.
René Just, Darioush Jalali, Laura Inozemtseva, Michael D Ernst, Reid Holmes, and Gordon Fraser. Are mutants a valid substitute for real faults in software testing? In Proceedings of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering, pp. 654 144-665,22 2014.
Hung Le, Yue Wang. Akhilesh Deepak Gotmare, Silvio Savarese, and Steven Chu Hong Hoi. Coderl: Mastering code generation through pretrained models and deep reinforcement learning. Advances in Neural Information Processing Systems, 35:21314-21331 2022.
Qingyao Li, Wei Xia, Kounianhua Du, Xinyi Dai, Ruiming Tang, Yasheng Wang, Yong Yu, and Weinan Zhang. Rethinkmets: Refining erroneous thoughts monte carlo tree search for code generation. arXiv preprint urXiv:2409.09588 2024.
Qingyao Li, Xinyi Dai, Xiangyang Li, Weinan Zhang, Yasheng Wang, Ruiming Tang, and Yong Yu. process reward model for code generation. In Findings of the Association for Computational Linguistics: ACL 2025, pp. #169-8182, 2025.
Codeprm: Execution
Rongao Li, Jie Fu, Bo-Wen Zhang, Tao Huang, Zhihong Sun, Chen Lyu, Guang Liu, Zhi Jin, and Ge Li. Taco: Topics in algorithmic code generation dataset. arXiv preprint arXiv:23122 14852, 2023.
Kaibo Liu, Zhempeng Chen, Yiyang Liu, Jie M Zhang, Mark Harman, Yudong Han, Yun Ma, Yihong Dong, Ge Li, and Gang Huang. LIm-powered test generation for detecting bugs in plausible programs. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume I: Long Papers), pp. 430-440, 2025.
MatrixStudio. Codefaree--ythoo-subbmiiiooo 2024. URL URL Uttpttt:://uuugigffac co/ dat
aset asets/Mat htt.:Maiiittddooooeeeeeoooooooea
Erik Nijkamp, Hiroaki Hayashi, Caiming Xiong, Silvio Savarese, and Yingbo Zhou. Codegen2:
Lessons for training Ilms on programming and natural languages. arXiv preprint arXi::2305.023309 2023.
http::///ppeaa..mmmmmeeeeeeeeeee www..//wo...c..ce.eeooooootoeete wwwpinneep/pp.ppee 40- hagpa////ge-----mm-----a-annnnnn OpenAl. Gpt-4o-mini. htt.::ttptttttttt Gpt-4o-minn.ntttts://// (-effficiemt-ineelllee gencee//llleeeeeeeeeee 2024. Accessed: 2024-07-18.
Liangming Pan, Michael Saxon, Wenda Xu, Deepak Nathani, Xinyi Wang, and William Yang Wang. Automatically correcting large language models: Surveying the landscape of diverse self-correction strategies. arXiv preprint arXiv:2308.00 031188 2023.
Liangming Pan, Michael Saxon, Wenda Xu, Deepak Nathani, Xinyi Wang, and William Yang Wang. Automatically correcting large language models: Surveying the landscape of diverse automated correction strategies. Transactions of the Association for Computational Linguistics, 12:484-506. 2024.
Archiki Prasad, Elias Stengel-Esking Justin Chih- Yao Chen, Zaid Khan, and Mohit Bansal. Learning to generate unit tests for automated debugging. arXiv preprint arXiv:2502.00 0/619, 2025.
11

---

Published as a conference paper at ICLR 2026
A Yang Qwen, Baosong Yang, B Zhang, B Hui, B Zheng, B Yu, Chengpeng Li, D Liu, F Huang, H Wei, et al. Qwen2. technical report. arXiv preprint, 2024.
Max Schäfer, Sarah Nadi, Aryaz Eghbali, and Frank Tip. An empirical evaluation of using large language models for automated unit test generation. IEEE Transactions on Software Engineering. 50(1):85-105, 2023.
Zhihong Shao, Peiyi Wang, Qihao Zhu, Runxin Xu, Junxiao Song, Xiao Bi, Haowei Zhang, Mingchuan Zhang, YK Li, Yang Wu, et al. Deepseekmath: Pushing the limits of mathemat- ical reasoning in open language models. arXiv preprint 2xXiv:2422.03300, 2024.
Ming Shen. Rethinking data selection for supervised fine-tuning, arXiv preprint arXiv:2402.66094 2024.
Guangming Sheng, Chi Zhang, Zilingfeng Ye, Xibin Wu, Wang Zhang, Ru Zhang, Yanghua Peng, Haibin Lin, and Chuan Wu. Hybridflow: A flexible and efficient rlhf framework. In Proceedings of the Twentieth European Conference on Computer Systems, pp- 1279-12977 2025.
David Silver, Julian Schrittwieser, Karen Simonyan, Ioannis Antonoglou, Aja Huang, Arthur Guez, Thomas Hubert, Lucas Baker, Matthew Lai, Adrian Bolton, et al. Mastering the game of go without human knowledge. nature, 550(7676)3354-33) 359, 2017.
Sainbayar Sukhbaatar, Zeming Lin, Ilya Kostrikov, Gabriel Synnaeve, Arthur Szlam, and Rob Fergus. Intrinsic motivation and automatic curricula via asymmetric self-play. arXiv preprint arXiv:1033.05407, 2017.
Florian Tambon, Arghavan Moradi-Dakhel. Amin Nikanjam, Foutse Khomh, Michel Desmarais, and Giuliano Antoniol. Bugs in large language models generated code: An empirical study, Empirical Software Engineering, 30(3):65, 2025.
Xunzhu Tang, Jacques Klein, and Tegawendé Bissyandé. Boosting open-source Ilms for pro- gram repair via reasoning transfer and Ilm-guided reinforcement learning. arXiv preprint arXiv:2506.03921, 2025.
Gerald Tesauro et al. Temporal difference learning and td-gammon. Communications of the ACM, 38 (3):58-68, 1995.
Kiyoshi Ueda and Hikaru Tsukada. Accuracy improvement by training data selection automatic test cases generation method. In 202/ 9th International Conference Information and Education Technology (ICIET), pp. 438-442. IEEE, 2021.
Chong Wang, Jian Zhang, Yebo Feng, Tianlin Li, Weisong Sun, Yang Liu, and Xin Peng. Teaching code 1lms to use autocompletion tools repository-Ievel code generation. ACM Transactions on Software Engineering and Methodology, 34(7):1-25 2025.
Jianxun Wang and Yixiang Chen. A review on code generation with Ilms: Application and evaluation. In 2023 IEEE International Conference on Medical Artificial Intelligence (MedAI), pp. 284-289, IEEE, 2023.
Yaoxuan Wu, Xiaojie Zhou, Ahmad Humayun, Muhammad Ali Gulzar, and Miryung Kim. Gen- erating and understanding tests via path-aware symbolic execution with llss. arXiv preprint arXiv:2506. 19287, 2025.
Tian Xie, Zitian Gao, Qingnan Ren, Haoming Luo, Yuqian Hong. Bryan Dai, Joey Zhou, Kai Qiu, Zhirong Wu, and Chong Luo. Logic-rl: Unleashing Ilm reasoning with rule-based reinforcement learning, arXiv preprint arXiv:2502.14778, 2025.
An Yang, Anfeng Li, Baosong Yang. Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, et al. Qwen3 technical report. arXiv preprint 2tt.::2555003888 2025.
Chen Yang, Junjic Chen, Bin Lin, Jianyi Zhou, and Ziqi Wang. Enhancing lIm-based test generation for hard-to-cover branches via program analysis. arXiv preprint arXiv:2404 04966, 2024a.
12

---

Published as a conference paper at ICLR 2026
Lin Yang. Chen Yang, Shutao Gao, Weijing Wang, Bo Wang. Qihao Zhu, Xiao Chu, Jianyi Zhou, Guangtai Liang, Qianxiang Wang, et al. On the evaluation of large language models in unit test generation. In Proceedings of the 39th IEEE/ACM International Conference Automated Software Engineering, pp. 1607-1619, 2024b.
Yang Yue, Zhiqi Chen, Rui Lu, Andrew Zhao, Zhaokai Wang, Shiji Song, and Gao Huang. Does reinforcement learning really incentivize reasoning capacity in Ilms beyond the base model? arXiv preprint MXiv:2504.13877 2025.
Ao Zhang. Yiying Zhang, Yao Xu, Cong Wang. and Siwei Li. Machine learning-based fuzz testing techniques: survey. IEEE Access, 12:14437-14454, 2023.
Zhiyuan Zhong, Sinan Wang, Hailong Wang, Shaojin Wen, Hao Guan, Yida Tao, and Yepang Liu. Advancing bug detection in fastjson2 with large language models driven unit test generation. arXiv preprint arXiv:2410.09414 2024.
ROLE OF LANGUAGE MODELS FOR THE PAPER
In the process of writing this paper, the language model was used and only used to help us polish the text.
APPENDIX
A ADDITIONAL RESULTS
A.1 ANALYSIS OF RL TRAINING CURVES FOR CODE GENERATION
To further illustrate the superiority of ATGEN as a reward source for training code generators via reinforcement learning, we present the training curves in Figure 4 These plots provide direct visual evidence supporting the quantitative results presented in the main paper.
citbckkoor//m
entic/cade_ past, rate, reward//mann code unsecva Ladeeerwaaejj
6.
0.3
Stey
(a) Comparison of reward against base-(b) Comparison of code pass reward against UT- line test generator.
Gen.
Figure 4: Training curves for the code generator when using different test generators the reward source. (a) The total reward score during the initial steps of training. Using ATGEN leads to higher and more sustained reward signal. ATGEN provides a significantly more effective learning signal than UTGen.
(b) The isolated code pass rate reward after 50 steps.
Figure 4a compares the mean reward score of a code generator trained using rewards from our ATGEN-7B versus rewards from the baseline Q an average of three components: a format reward, a count reward, and the crucial code pass rate reward. The baseline's 's training curve quickly plateaus around a score of 0.7. This is because the code generator rapidly masters the simple format and tag-related tasks (achieving perfect score of 1.0 on both), but the test cases provided by the baseline generator are not effective enough to create a meaningful and optimizable signal for the code pass rate. The learning for this critical component stagnates, capping the average reward. In contrast, the curve for the model trained with ATGEN not only reaches higher overall score but also shows continuous upward trend, indicating that our test
test generator. The total reward
13

---

Published as a conference paper at ICLR 2026
generator provides challenging and consistent learning signal that allows the code generator keep improving its functional correctness.
Figure 4b provides more direct comparison by isolating the code pass rate reward in the later stages of training (after 50 steps), comparing ATGEN with the stronger UTGen baseline. The curve for
UTGen is consistently low and shows no clear upward trajectory. suggesting that its test cases lack the necessary quality and diversity to drive further improvement in the code generator. Conversely, the reward signal from ATGEN is substantially higher and more dynamic, providing a much more effective curriculum for the code generator to enhance its problem-solving capabilities. These curves unequivocally demonstrate that ATGEN serves as far more effective reward provider for training advanced code generation models.
A.2 ABLATION STUDY ON ADVERSARIAL CODE GENERATION STRATEGY
To validate our choice of using a sampling- based approach for generating adversarial code, we conduct an ablation study com- paring it against more direct instruction- based method. In the instruction-bias setting (ATGEN (Instruct)), we directly prompt the code generator to produce adversarial code that passes the current test case T while failing the ground-truth test suite T gold We hypothesize that while this method is computationally cheaper, it risks creating code with "unnatural" or "syn- thetic" bugs, causing distributional shift that could negatively impact the test gener-
Method
10 Acc (%)
Attuck Rute
Sompling-bused (Proposed)
ATSEK (Unconditioraa.
74.97 74.09
34,57
ATGRK [Adapt (ve)
36.22
Instictionnbused (Ablation)
ATGER (unatruct)
70.47
30.73
ATGEK runtt Adapt liee
76.28
$2,71
Table 5: Comparison of adversarial code generation strategies. All models use the Qwen2.5-7B-Insse backbone. The sampling- based approach (our proposed method) yields a significantly higher Attack Rate, vali- dating its effectiveness.
ator's training.
The results are presented in 5 The findings confirm our hypothesis. Both instruction-basee models show clear degradation in Attack Rate compared to their sampling-based counterparts. For instance, our proposed ATGEN (Adaptive) achieves a 36.22% Attack Rate, whereas its instruction- based variant, ATGEN (Instruct, Adaptive), only reaches 32. 71.... This suggests that training on synthetically generated bugs harms the test generator's ' ability to identify realistic programming flaws.
Interestingly, the ATGEN (Instruct, Adaptive) model achieves the highest IO Accuracy (76.28%). We attribute this to the nature of reinforcement learning. When faced with noisy and synthetic bugs, optimizing the Attack Rate becomes a more difficult task. Consequently, the model pivots to maximize the reward from the more stable and accessible source: I0 Accuracy. Since achieving high IO Accuracy primarily depends on understanding the problem description rather than the buggy code, this objective is unaffected by the noisy training data. The model. therefore, over-optimizes for correct I/O pairing at the expense of its core bug- sug-finding capability. These results strongly justify of the more robust sampling-based adversarial generation, it creates realistic and effective training curriculum for the test generator.
A.3 ANALYSIS OF PRACTICAL UTILITY: PRECISION AND RECALL
While our main evaluation focuses on IO Accuracy and Attack Rate (which corresponds to Recall in bug detection), practical test generation also requires high Precision (Liu et al. 2025). A test generator that produces many invalid test cases (False Positives) creates a "crying wolf" scenario, wasting developer time.
Following the definitions in prior work (Liu et al. 2025 we define the metrics as follows:
True Positive (TP): The test case is valid (correct 10) AND successfully triggers bug the faulty code.
False Positive (FP): The test case raises an alert (claims to find a bug) BUT is itself invalid (incorrect IO). This represents false alarm.
Precision: TP/ + FP). This measures the reliability of the alerts.
14

---

Table 7: Zero-shot generalization results on the un- seen TACO benchmark. AT GEN achieves 45.9 Published as a conference paper at ICLR 2026
Recall: TP/(PP FN). This is equivalent to main "Attack Rate" metric.
Table 6 presents the Precision, Recall, and FI Score the total test set.
Analysis. The results demonstrate a critical advantage of our RL-based approach. The SFT baseline, UTGen (7B), exhibits a low precision of 19.66%, indicating that vast jority of its "successful attacks" are actually due to invalid test oracles (e.g., generating in- correct expected outputs that disagree with the buggy code). In contrast, ATGEN (Adaptive) achieves a high precision of 70.66%. %.
Method
Precision (%)
Recall (%)
F1 Score
(%)
Qwen2.5-7B Instructt
19.52
12.73
15.41
UTGen (7B)
19.66
14.37
16.61
ATGEN (w/o Adver)
65.48
34.35
45.06
ATGEN (Adaptive)
70.66
36.99
47.89
Table 6: Precision, Recall, and Fl Score analy- sis. Precision measures the valid bug-finding sig- nal against false alarms caused by invalid test cases. ATGEN achieves 3.5x improvement in Precision compared to the SFT baseline (UTGen).
This 3.5x improvement in Precision signi- fies that ATGEN creates a much higher signal- to-noise ratio. The adversarial reinforcement learning process does not merely encourage the model to be aggressive; it forces the model to be correctly aggressive. To maximize the reward, the agent learns that must generate strictly valid tests to successfully penalize the adversary, rather than exploiting invalid inputs. This confirms that ATGEN is not only powerful bug-finder finder (High Recall) but also a trustworthy tool for practical software engineering (High Precision).
A.4 GENERALIZATION
To show the ability of our method's domain generalization and potential overfitting the training datasets (APPS and Codeforces), we evaluated our trained models on the TACO benchmark (Li et al. 2023). TACO represents a completely unseen distribution of coding problems for our model, serving as rigorous test for zero-shot generalization capability. We used subset of 1,000 samples from TACO's 's test set for this evaluation. Table presents the results.
Analysis. The results unequivocally demon- strate the superior generalization of ATGEN. On this unseen benchmark, the SFT baseline (UTGen) struggles, likely due to its reliance the static distribution of its training data. In sharp contrast, ATGEN (Adaptive) achieves Attack Rate of 45.9%. which is nearly triple that the baseline.
Method
IO Accuracy (%)
Attack Rate (%)
Qwen2.5-7B-IInsrruc
20.8
9.2
UTGen (7B)
36.1
16.5
ATGEN (Adaptive)
81.1
45.9
Furthermore, ATGEN maintains exception- ally high I0 Accuracy of 81.1% %. This indi- cates that the adversarial training loop suc- cessfully teaches the model a fundamental understanding of code logic and bug detec- tion, rather than merely fitting to the specific patterns of APPS or Codeforces. The model effectively transfers its "attacking" policy to
Attack Rate, nearly tripling the performance of the SFT baseline (UTGen). This confirms that our ad- versarial RL policy learns a robust, generalizable bug-finding strategy rather than memorizing training data.
new domains without any fine-tuning.
A.5 COST AND EFFICIENCY ADVANTAGE ADAPTIVE MODE
Adversarial training involves sampling buggy codes, which introduces computational overhead. To quantify this cost and justify our design choices, we analyzed the token consumption of our two adversarial modes: Unconditional and Adaptive.
Table details the total input and output tokens consumed by the adversarial code generator (GPT-40- mini) over 145 training steps using the Dween.55-7B-Instriue backbone.
15

---

Published as a conference paper at ICLR 2026
Mode
Input Tokens
Output Tokens
10 Ace (%)
Atfack Rate (%)
ATGEN (Unconditional)
5,865,730
29,201,333
74.97
34.57
ATGEN (Adaptive)
2,830,685
13,461,937
74.42
36.99
Table 8: Cost and performance comparison between Unconditional and Adaptive adversarial modes. ATGEN (Adaptive) consumes less than half the tokens of the Unconditional mode while achieving higher Attack Rate. This confirms that conditionally triggering the adversarial sampling is highly efficient strategy.
Analysis.
The comparison reveals significant efficiency advantage for the Adaptive mode.
Token Efficiency: The Adaptive mode reduces token usage by half and output token usage by 54 % compared to the Unconditional mode.
Superior Performance: Despite the drastically reduced computational cost, the Adaptive mode achieves higher Attack Rate.
This result supports our hypothesis that focusing computational resources on instances where the cur- rent policy successful creates a more effective and efficient curriculum than blindly regenerating all training data.
A.6 BEST-OF-N FILTER FOR GPT-5O-MINI
To demonstrate the generalizability of our test generator and its effectiveness on stronger, next- generation code models, we conducted additional Best-of-N experiment using GPT-5o-miní as the code generator. This model is significantly more capable than the GPT-4o-mini used in our main experiments.
We generated 10 test cases per problem using different test generators to filter candidate solutions sampled from GPT-5o-mini. The results, reported as Pass@ on the APPS benchmark across three difficulty levels (Introductory, Interview, Competition), are shown in Table
Analysis. The results confirm that AT- GEN remains highly effective even when filtering code from a frontier model like GPT-5o-mini. While baseline methods like UTGen show marginal improvements over random selection the base model diffi- cult problems, ATGEN (Adaptive) achieves distinct advantage.
Method (Test Generator)
Intro.
Inter: (Pass@1
Comp. (Pass
(Pass %)
%)
%)
Random Selection Qwen2.5-7B-IIneee Instrrcctt UTGen
62
73
73
19
ATGEN (Adaptive)
76
23
Table 9: Best-of-N filtering performance on candidate solutions generated by GPT-5o-mini. ATGEN consis- tently selects better candidates than baselines. Notably, on the hardest Competition level problems, improves the Pass @ from 19% (UTGen) to 23%, demonstrating its ability to detect subtle bugs even in highly capable models.
Most notably, on the Competition level which involve complex logic and corner cases-ATGEN improves the Pass @ 23% surpassing the SFT base- line (19%) by 4 absolute percentage points. This indicates that the adversarial training equips the model to verify and filter sophis- ticated code that simpler test generators
might incorrectly accept.
B QUALITATIVE CASE STUDY: REASONING VS. MIMICRY
To better understand the qualitative difference between adversarial approach and standard SFT, we present a representative case study from the Codeforces dataset.
Problem (Pipe System Connectivity): Given grid, count the number of ways to fill empty cells with pipe segments such that the system "non-leaking" (all pipe ends connect to another pipe or the border).
16

---

Published as a conference paper at ICLR 2026
Buggy Code: The code contains flawed logic in the sew.leakingg () function, specifically failing to correctly handle specific boundary connections for single-cell configurations.
Table 10 compares the test cases generated by the SFT baseline (UTGen) and ATGEN.
Feature
UTGen (SFT Baseline)
ATGEN (Adversarial RL)
Generated In-
2
1
put
1.
Style
Mimicry. The model generates "typi- cal" test case resembling the training dis- tribution (usually larger N x M grids).
Targeted Attack. The model explicitly reasons about code's logic and iden- tifies a minimal counter-example.
Reasoning Process
"Let's break down the problem step by step to understand why the code solution returns 2 for the given Toput...TThus.. the output is 2."
"We can create a simple case where the correct answer is 1, but the buggy code solution returns 2... specific boundary connections.."
Result
Failed. The buggy code passes this test
Success. The buggy code fails on this edge case (True Positive).
(False Negative).
Table 10: Qualitative comparison on the "Pipe System Connectivity" problem. While UTGen relies on mimicking the distribution of human--ritter tests (typically larger grids), ATGEN identifies that the bug lies in a much simpler atomic unit (a x 1 grid) and successfully targets it.
This example highlights the core limitation of static SFT: the model mimics the distri- bution of the training data analyzing the code under test.
Analysis.
written tests often use standard 2 x 2 or larger grids) rather than
In contrast, ATGEN, driven by the adversarial reward, learns to "think" like an attacker. It identifies that the complex logic in is ls.kinnin () fails for the simplest boundary condition. By generating 1 x grid input, it successfully exposes the bug that the "typical" test case missed. This demonstrates that our method shifts the paradigm from pattern matching to logical falsification.
C ADDITIONAL RELATED WORK
Mutation Testing. Our adversarial code generation shares conceptual roots with Mutation Testing, technique that assesses test suite quality by injecting artificial faults (mutants) into programs TJa & Harman 2010). However, a key distinction lies the nature of the bugs. Traditional mutation testing relies on predefined, syntactic operators (e.g.. changing + to negating conditions) to create "synthetic" mutants. While useful, prior studies have debated whether these synthetic mutants validly represent the complexity of real-world software faults (Just al.] 2014 Andrews al.) 2005). In contrast, ATGEN leverages the generative capabilities of LLMs to sample "natural" bugs. Rather than applying rigid syntactic rules, our adversarial agent generates code with semantic and logical flaws- suwwsssschhe as incorrect boundary handling or misinterpreted constraints- that mimic actual mistakes made by developers or Al models Tambon et (2025). This ensures that our test generator is trained on a curriculum of realistic challenges rather than artificial artifacts.
Self-Play RL. The adversarial loop in ATGEN can be viewed through the lens of Reinforcement Learning (RL) self- Classical self-play frameworks, such as AlphaZero (Silver et al. 2017)
or TD-Gammon (Tesauro et al. 1995), typically operate in a symmetric zero-sum setting where an agent plays against a copy of itself within an identical state-action space. In contrast, ATGEN establishes an asymmetric adversarial game, more akin to the "Setter-Solver" or "Teacher-Student" paradigms explored in identifying intrinsic motivation (Sukhbaatar et al. 2017 Campero et al. 2020). In our framework, the two agents hold distinct roles and objectives: the Code Generator (Setter) aims to construct difficult problem instances (buggy codes), while the Test Generator (Solver) aims to identify their flaws. This asymmetry is essential for our domain, as it allows the "difficulty" of the environment to evolve dynamically based on the semantic complexity of the code, breaking the fixed-difficulty ceiling inherent in static datasets.
17

---

Published as a conference paper at ICLR 2026
D PROMPTS
In this section, we present the prompts used in training and inference for an LLM to perform various operations.
We present the prompts for generating test case 10 pair for test generator in Table I1 And we present the prompts for sampling adversarial code in Table T2 The other prompt we present in Table 13 is the prompt for instructing the code generator to generate adversarial code.
Prompt for Generating Test Case 10 Pair
system message:
You are a helpful AI Assistant that provides well-reascned and + detailed respenses. You first think about the reasoning process an internal monologue and then provide the user with the answer. Respond in the following format: <think>\n, Ln.nk>>n..... www///ink/////./...e./// \n<answer>\nn \ns.an/w//sswrr>>
prompt:
Generate test case (both input and output) for the given 4 programming problem. and buggy code.
The generated input/output pair MUST satisty the probler.
4 description (i.e., the gold code should pass it).
The generated input/output pair MUST cause the provided buggy code fail (e.g., wrong answer, runtime error)
Format the generated test case within the <answer> tags as
+ JSON object containing "input" and "output" keys,
+ enclosed in triple backticks "Yjson "*, For exampie;
<answer> ''json
{{
" "input": "[your generated test case input]", (Notice: Brackets
4 needed in your output)
"output": "Iyour generated test case output
</answer>
Problem:
(example (' q'qustionn ]
Buggy Code:
(example buggy_code']
Table 11: Prompt for Generating Test Case 10 Pair.
Prompt for Sampling Adversarial Code
Complete the Python program sclve the problem. Remember to
+ contain the complete program including all the imports + and function header in your response. Generate the code ONLY. No other explanation or words attached! (question)
Table 12: Prompt for Sampling Adversarial Code.
18

---

Published as a conference paper at ICLR 2026
Prompt for Instruction-based Generation of Adversarial Code
Create Python code that appears to solve the problem but
< contains subtle flaws. The code MUST:
DIRECTLY READ FROM STANDARD INPUT (using input ()) and PRINT
+ the result
2. CONTAIN NO EXTRA TEST CODE
Fass the specific test while failing other valid
+ scenarios
Include hidden logical errers that aren't obvious at first.
4 glance
Example (BAD for illustration):
Problem:
"Sum two integers"
Input Format: Two space-separated integers
Bad Solution:
b map (int, input () ()) print b if
else
Think in <think> \n</think> and answer in 4 <answer> An.. .tw.:/nnn.....//.eee......a \ns/answer>,
The content between <answer> and </answer> should the code 4 ONLY, without any other words attached.
Problem: (question)
Test Case (MUST PASS): (test_case_pair)
Table 13: Prompt for Instruction-based Generation of Adversarial Code.
19


Reviews:
[{"review_id": "7V1L2NKlFv", "reviewer": "Reviewer_PaRD", "summary": "This paper introduces ATGen, a reinforcement learning (RL) framework for automated test case generation that integrates an adversarial training loop. The test generator is trained to produce input-output pairs that are both correct (Output Accuracy) and bug-revealing (Attack Success). Meanwhile, a code generator adversarially creates progressively harder buggy programs, forming a dynamic curriculum. This design aims to overcome the “fixed-difficulty ceiling” of prior static datasets (e.g., UTGen). Empirically, ATGen outperforms strong baselines (UTGen, GPT-4 series, Qwen models) on APPS and Codeforces subsets. The authors also show downstream applications: using ATGen as (1) a Best-of-N filter to select higher-quality generated code, and (2) a reward signal for RL-based code generation training.", "questions": "Please address my comments in the \"Weaknesses\" section", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. Novel and interesting method: The combination of adversarial reinforcement learning and test generation is creative and technically relevant, representing a step beyond static SFT-based approaches like UTGen.\n\n\n2. Good results on benchmark datasets: The model achieves improvements in both IO Accuracy and Attack Rate, especially on APPS and Codeforces tasks, showing clear empirical gains.\n\n\n3. Clear structure and thorough experiments: The paper is well-organized with detailed experiments, ablation studies, and multiple baselines\n\n\n4. Practical downstream validation: Using ATGen-generated tests as a reward signal for RL-based code generation is an excellent demonstration of the method’s broader utility and potential to generalize beyond testing.", "weaknesses": "1. Limited domain and dataset generalization: The evaluation focuses only on a single type of domain and dataset, algorithmic coding problems from APPS and Codeforces. It would be helpful to show ATGen’s performance on more real-world software domains, such as repository-level test generation and API testing. Moreover, it would be interesting to see if training ATGen on one dataset (e.g., APPS) generalizes to another dataset (e.g., HumanEval).\n2. Unclear technical details, as listed below:\n    - The choice and training of the base model for UTGen comparison are not fully described. It is unclear whether UTGen and ATGen share the same base model and training dataset, making fairness difficult to assess.\n    - The evaluation assumes that the “ground-truth test suite” (T_gold) is complete. Without quantitative measurement such as coverage metrics, it’s uncertain if this actually holds.\n    - I could not find which buggy programs are considered when computing Attack Rate. Did the paper specify it somewhere?\n3. The non-adversarial model (ATGen w/o Adver) is already significantly better than the baselines. The adversarial training only brings very marginal improvements.\n4. Lack of qualitative examples: No examples of generated tests or adversarial programs are shown. Such examples would help illustrate what kinds of bugs ATGen detects or fails to detect, and how its generated tests differ qualitatively from UTGen’s.\n\n\n5. Clarity and novelty overlap: While the adversarial RL setup is novel for test generation, parts of the approach resemble existing self-play or adversarial curriculum ideas. The paper could better situate itself relative to frameworks like self-play RL in AlphaZero-style.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "6Wfu2AUFJO", "reviewer": "Reviewer_GVXW", "summary": "This paper presents ATGEN, a novel framework for automatic test case generation that uses adversarial reinforcement learning to improve the reliability of code generated by LLMs. Unlike existing test generation approaches that rely on static datasets, ATGEN introduces a dynamic adversarial loop between two agents: a test generator and an adversarial code generator. The code generator continuously produces harder buggy programs, while the test generator learns to craft tests that can detect these increasingly sophisticated bugs.", "questions": "What is the coverage of the generated tests?\n\nWhat are the potential risks of data leakage in the evaluation process?\n\nHow does the model perform on test generation benchmarks?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The paper is very well written.\n\nThe approach that uses adversarial reinforcement learning to solve the test generation problem is novel and very interesting.\n\nThe evaluation is well designed.", "weaknesses": "# Limitations of evaluation benchmarks\n\nThe benchmarks used for evaluation appear to be simplified and not fully representative of real-world programming challenges. There are two issues with these benchmarks: 1) they are designed for code generation, not test generation; 2) they have the data leakage issue where their test cases might have appeared in the training data of Qwen models. Consequently, the claimed improvements might not translate to realistic software engineering scenarios. It is recommended that the authors evaluate their approach on benchmarks that are designed for test generation purposefully, especially contamination-free benchmarks, such as UnLeakedTestBench (https://arxiv.org/pdf/2508.00408).\n\n# Lack of discussion and comparison with Mutation Testing\n\nThe approach adopted in this paper uses buggy versions to trigger more effective test generation. The idea is similar to mutation testing, a widely studied test assessment method. In mutation testing, faults are injected purposely to check whether the tests are strong enough to detect the bugs. I recommend discussing such a connection in the paper. It is also interesting to explore the effectiveness of using mutants (with more subtle changes) instead of faulty versions generated by LLMs to conduct adversarial RL. \n\n# Coverage is not reported\n\nThe approach does not report code coverage in the evaluation, which is an important metric for measuring the effectiveness of test inputs, and is widely adopted in industry.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "AXRSgkanb7", "reviewer": "Reviewer_B73m", "summary": "The paper presents ATGEN, a RL-based framework for test case generation, which trains a generator to optimize both output accuracy and attack success. By introducing an adversarial training paradigm, ATGEN enables the discovery of more complex and subtle code flaws compared to traditional static datasets. The authors demonstrate the utility of ATGEN in both code generation inference and trainin, showcasing its potential to improve test case generation in dynamic environments.", "questions": "Potential Circular Reasoning in \"Adversarial Loop\": The concept of the \"adversarial loop,\" which is central to the paper’s contribution, raises concerns about potential circular reasoning. Specifically, using a more powerful large language model (LLM)—which may inherently have better code generation capabilities—to train the test generator may limit the generator’s potential. This creates a fixed difficulty ceiling, as the performance of the test generator will be ultimately bounded by the capabilities of the LLM used during training. A more detailed discussion on how this limitation is addressed or mitigated would be beneficial.\n\nClarification Needed on Dataset Usage for SFT Baselines: The manuscript does not clearly explain how the dataset is utilized in the context of supervised fine-tuning (SFT) baselines. Further clarification on this point is necessary to ensure the reproducibility and fairness of the results.", "limitations": "", "rating": 2, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "Clear and Readable Writing: The manuscript is well-structured, with clear and concise writing that facilitates easy comprehension.\n\nStraightforward Motivation: The motivation behind the work is solid, with a direct and convincing argument for applying Reinforcement Learning (RL) to test case generation.", "weaknesses": "Lack of Novelty in Techniques: The application of RL to test case generation is conceptually straightforward and has been explored in previous works. The reward function design, while effective, does not introduce significant challenges or innovations.\n\nLack of Precision in Metrics: The metric \"Attack Rate\" is used in the evaluation but primarily reflects recall (but not real recall) rather than precision. It would be beneficial to include more comprehensive statistics, such as precision, to provide a clearer and more balanced evaluation of the model's performance. The datasets, metrics, and baselines used for more comprehensive evaluations can be referred to in TrickCatcher[1].\n\nLimited Evaluation Against Related Work: Some relevant studies that have already explored RL in test case generation, e.g. ACECODER[2], are not included in the main results of the evaluation section. \n\nMinor Spelling and Grammar Errors: There are a few minor spelling and grammatical mistakes that need to be addressed for improved clarity and professionalism.\n\n[1] Kaibo Liu, Zhenpeng Chen, Yiyang Liu, Jie M. Zhang, Mark Harman, Yudong Han, Yun Ma, Yihong Dong, Ge Li, and Gang Huang. (2025). LLM-Powered Test Case Generation for Detecting Bugs in Plausible Programs. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 430–440, Vienna, Austria. Association for Computational Linguistics.\n[2] Zeng, H., Jiang, D., Wang, H., Nie, P., Chen, X., & Chen, W. (2025). Acecoder: Acing coder rl via automated test-case synthesis. arXiv preprint arXiv:2502.01718.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "8jQ61nRTug", "reviewer": "Reviewer_n7wV", "summary": "This paper presents ATGen, which formulates unit test generation in an adversarial RL setting. The test generator model is optimized for IO acc and attack success, two important quality measurements for unit tests, and another code generator model is used to generate adversarial code that passes the current test case but fails on the gold test. This forms a loop that enables self-improving test case generation, and results show that ATGen improves both IO acc and attack success by a large margin and which can transfer to better code generation.", "questions": "1. In line 196, why does raising an execution error also get a positive attack reward? Doesn't it mean that the generated code is flawed and has nothing to do with the quality of the generated tests?\n2. What are the ranges of all three rewards, and how do the authors decide the weights for each of them?\n3. ATGen shows large improvements on both IO acc and attack success, but I wonder what the intersect performance would be, i.e., the union of IO acc and attack success, compared to the baselines. As UTGen and the authors mentioned, there is inherently a trade-off between these two.\n4. What is the code generator model used in the \"ATGEN as a Best-of-N Filter\" analysis? More code generator models can be helpful to prove the effectiveness and generalizability.\n5. The adversarial setup here only asks the model to generate adversarial code, but does not update for better code generation quality. Is it possible to optimize the test generator and code generator jointly?\n6. Missing a period in line 454.\n7. Can the generated test case improve frontier models like GPT-5 / Claude 4.5 Sonnet?", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The proposed method is sound, and the formulation of both test generation and adversarial setup is sensible.\n2. Although it can be costly, the adversarial setup captures the incremental progress needed for the test generator to improve, and the authors explore different ways of sampling to reduce costs.\n3. ATGen generates test cases that largely improve IO acc and attack success, which are two important factors to measure the test quality.", "weaknesses": "1. The author mentioned the cost during adversarial code sampling and proposed two modes, but there is no analysis showing the cost and performance comparison.\n2. The main evaluations focus on IO acc and attack success, while the results and discussion on improving downstream code generation are less focused. Best-of-N using the generated test case is a good choice, but more code generator models and datasets are expected to see the effectiveness and generalizability.\n3. Lacking analysis on how to combine the three types of reward (i.e., how to decide their weight) and what their ranges are.\n\nPlease see the questions for other minor weaknesses.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)