RESCUE: Retrieval Augmented Secure Code Generation
Authors: Jiahao Shi
Tianyi Zhang
Venue: ICLR 2026 Poster (2026)
Keywords: secure code generation
retrieval augmented generation
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Despite recent advances, Large Language Models (LLMs) still generate vulnerable code. 
Retrieval-Augmented Generation (RAG) has the potential to enhance LLMs for secure code generation by incorporating external security knowledge. However, the conventional RAG design struggles with the noise of raw security-related documents, and existing retrieval methods overlook the significant security semantics implicitly embedded in task descriptions.
To address these issues, we propose \textsc{Rescue}, a new RAG framework for secure code generation with two key innovations. 
First, we propose a hybrid knowledge base construction method that combines LLM-assisted cluster-then-summarize distillation with program slicing, producing both high-level security guidelines and concise, security-focused code examples. Second, we design a hierarchical multi-faceted retrieval that traverses the constructed knowledge base from top to bottom and integrates multiple security-critical facts at each hierarchical level, ensuring comprehensive and accurate retrieval. 
We evaluated \textsc{Rescue} on four benchmarks and compared it with five state-of-the-art secure code generation methods on six LLMs. The results demonstrate that \textsc{Rescue} improves the SecurePass@1 metric by an average of 4.8 points, establishing a new state-of-the-art performance for security. Furthermore, we performed in-depth analysis and ablation studies to rigorously validate the effectiveness of individual components in \textsc{Rescue}. Our code is available at \url{https://github.com/steven1518/RESCUE}.

Published as a conference paper at ICLR 2026
RESCUE: RETRIEVAL AUGMENTED SECURE CODE GENERATION
Jiahao Shi
Tianyi Zhang
Department of Computer Science Purdue University West Lafayette, IN, USA shi Sh1763@purdue.edd
Department of Computer Science Purdue University
West Lafayette, IN, USA t tiany @purdue.
ABSTRACT
Despite recent advances. Large Language Models (LLMs) still generate vulnera- ble code. Retrieval-Augmenter Generation (RAG) has the potential to enhance LLMs for secure code generation by incorporating external security knowledge. However, the conventional RAG design struggles with the noise of raw security- related documents, and existing retrieval methods overlook the significant security semantics implicitly embedded in task descriptions. To address these issues, we propose RESCUE, new RAG framework for secure code generation with two key innovations. First, we propose a hybrid knowledge base construction method that combines LLM-assisted cluster-then-summenn ing, producing both high-level security guidelines and concise, security-focused code examples. Second, we design hierarchical multi-faceted retrieval that tra- verses the constructed knowledge base from top to bottom and integrates multiple security- facts at each hierarchical level, ensuring comprehensive and accu- rate retrieval. We evaluated RESCUE on four benchmarks and compared it with five state-of-the-an secure code generation methods on six LLMs. The results demonstrate that RESCUE improves the SecurePass @ metric by average of 4.8 points, establishing a new state-of-the-an performance for security. Further- more, performed in-depth analysis and ablation studies to rigorously validate the effecctivnness of individual components in RESCUE. Our code is available at https:// thub. com steven 518 8/RESCUF
distillation with program slic-
INTRODUCTION
Large language models (LLMs) have shown remarkable capabilities in coding-related tasks (Peng ct al., 2023] Paradis et al. 2025). However, recent studies have revealed that LLMs often generate
code with vulnerabilities Pearce et al. 2022 Fu al. 2023 Majdinasab et al. 2024 He & Vechev (2023): He et al. (2024) propose to finetune LLMS with security- aware objects. Yet these methods require significant effort in data curation and finetuning. Constrained decoding mechanisms can prevent the model from generating insecure code without finetuning (Li et al. [2224a] [Fu et al.) (002)). However, they require the availability of trained security models or cumman-crafted rules to serve as oracles or constraints to detect insecure code tokens during decoding. Another line of research (Nazzal
al. 2024| Kim al. 2024) leverages security analysis tools such Bandit (PyCQA) 2025) and
SpotBugs [SpotBugs] 2025) to provide vulnerability feedback for iterative code refinement. However, these security analysis tools heavily rely on pre-defined static analysis logic and heuristics to find bugs and vulnerabilities, which makes them less flexible to incorporate new vulnerabilities and security knowledge. Furthermore, since these security analysis tools are often used to assess the security of LLMM-ennratedd code in evaluation (Nazzal et al. 2024 Kim et al. 2024). using them verifier to provide feedback in the code generation stage raises a data leakage concern.
Retrieval-Auumeened Generation (RAG) offers more flexible and training-fre free solution to incor- porate security knowledge, such as documentation of secure coding practices and code examples. Despite recent investigation (Zhang et al. 2024 Mukherjee & Hellendoorn) [2025] Tony et al.) 2025), existing methods merely adapt conventional RAG methods to security domains and suffer from two limitations. First, security-related documents often contain information not relevant the

---

Published as a conference paper at ICLR 2026
Rool Noci
Security Knowledge
Cluster
Sunimarize
OWE Level
Clustar-Then-uumaali
API Pattem
Vun Ceuse
Raw Security
Code Levell
Dalaset
API Fatiom
Vidn Creoee
Program Graph
Slicing
Sliced
Code
Security Knowledge Base
Hierarchical
Code
Static Program Slicing
Hiorarchical Multi-
Faceted Retrieval
Figure 1: The overview framework of RESCUE.
target coding task, which would unnecessarily distract the LLM from generating code for the target task. For instance, a code example that demonstrates a secure coding practice may contain code logic of an example task that is very different from the target task. Second, the retrievers used by existing methods simply treat all sccurity-related information as general text and measure similarity between texts security relevance. They do not capture security semantics, such as the security requirements implicitly embedded task description. This oversight leads to inaccurate retrieval of security-related data.
To address these limitations, we propose RESCUE, a REtrieval -uggeeete- Secure Code gEneration framework. RESCUE has two key innovations. First, we propose a hybrid knowledge base construction method that combines semantic summarization with static program analysis. Given raw security data, an LLM-assisted cluster-teen then-summarize pipeline first distills generalizable security knowledge as high-level guidelines "replae yaml. . load () with yaml. safe__ () to prevent code execution vulnerabilities") Then, a static program slicing procedure extracts concise, security-focusel code examples by isolating the statements relevant to vulnerability fixes while filtering out unrelated logic. Second, we develop a hierarchical multi- falti-faccted retrieval method that performs coarse- goarse-grained search to identify relevant vulnerability types and secure code examples. In each search iteration, our method proactively analyzes three security-critical aspects-Ar APII pattern, vulnerability cause analysis, and code and then fuses these separated faceted search results to obtain precise security knowledge to guide code generation.
We evaluate RESCUE using five baseline methods and six LLMs across four benchmarks. The results demonstrate that on average, RESCUE achieves an absolute improvement of 4.8% in Secure @ 1, establishing new state-of-the-art for security. Meanwhile, RESCUE retains 98.7% of the original models' capability of generating functionally correct code. Furthermore, we have conducted ablation studies to confirm the contributions of both the security knowledge base construction and the proposed hierarchical multi- multi-faceted retrieval method to the enhanced performance of RESCUE.
In summary, our contributions are threefold: (1) We propose a novel hybrid distillation method that synergistically combines LLM-based summarization with program slicing to construct a hierarchical security knowledge base. (2) We design security-
hierarchical multi-faceted retrieval strategy that improves relevance by analyzing and fusing multiple security-critict aspects of a task. (3) We perform a comprehensive evaluation that not only establishes the state-of of-the-art performance on four benchmarks but also provides in-depth analyses that validate our design choices.
METHOD
Figure iillustrates the overview of RESCUE, which operates in two core stages. In the offline stage, we construct a hierarchical security knowledge base from raw security data. In the online stage, we design hierarchical multi-faceted retrieval method to query relevant security knowledge for given coding task. The retrieved security knowledge forms a tailored security context that augments the prompt of task to steer the LLM toward generating secure code.
2

---

Published as a conference paper at ICLR 2026
2.1 HIERARCHICAL SECURITY KNOWLEDGE BASE CONSTRUCTION
Inspired by how human experts reason about security problems using taxonomies (Igure & Williams 2008). we propose modeling security knowledge as hierar-
wulnerabi
* rixing.Py def "igpot_onc__bfauutt00
chical structure, with generalizable knowledge at the high level and concise code examples the low level.
In particular, we leverage the Common Weakness Enumeration (CWE) (MITRE 2025) to categorize vulnerabilitiis and construct this hierarchy.
GeL default
curd - cb. cursor
curd, serddexecute (*SELECT value FROM
kv xv_settings WHRRR key 'puppet.enc
.delault**)
In this work, we focus on constructing security knowledge base from historical vulnerabilities and their fixes. Figure 2 shows an example. Such se- curity data are widely available in many security databases (CVE Program, 2025 National Institute of Standards and Technology ( GitHub 2024). Specifically, we use the training dataset from SafeCoder (He al., (024) as our raw security dataset in this work. This dataset includes 704 vul- nerabilities and their fixes from CVE and GitHub projects. Please refer to Appendix A for more details.
result curd. fatcchnne))
clasaes - zesult ['att[[vvaaae ['value']
Validate classes YAML
yaml, (classe)))
data yaml safe_ load (claases)
Figure 2: A known vulnerability and its fix that demonstrates the re- placement of unsafe y () with yaml. safe_load () where red-highlighted code shows vulnerable lines removed and wreen-highlighted code indi- cates security fixes added (See Appendix E
Given the distinct nature of knowledge at different levels, we introduce a hybrid method for constructing the security knowledge base that combines semantic summarization with static program analysis. At the high level, an M-assiiseeed cluster-then then-sunaarize pipeline distills generalizable security knowledge. At the low level. static program slicing procedure extracts concise, security foccusy code examples by isolating the statements relevant to vulnerability fixes while filtering out unrelated logic.
for the complete example).
2.1.1 CLUSTER-THEE THEN- THEN-THHNNENNEEE SUMMARIZE
Raw vulnerability-fix instances are often verbose and instance-specific, making them unsuitable as direct general guidance. Although CWE has provided concise descriptions, they lack actionable fixing strategies and are too abstract to be effective for secure code generation. Prior work (He ct al. 2024) demonstrates that using CWE descriptions in context does not significantly improve censterrthe-suummarre
the security of LLM-ggnnrrted code. To address this gap, we introduce pipeline to distill generalizable security knowledge from raw vulnerability-fin instances.
First, we group the data instances into clusters based on their associated CWE type. Then, for each cluster, we apply a bottom-up summarization process using an LLM. This process begins by summarizing small, fixed-size subsets of instances. Next, recursively summarizes the outputs from the previous results until single, cohesive summary is generated for the entire cluster. This recursive, bottom-up up summarization approach allows us effectively process a large volume of data while maintaining high-quality, comprehensive outputs. Details of the algorithm are provided in Appendix B.T.
Since this preprocessing step is a one-time effort, we adopt GPT-4o in an offline setting. Ultimately. this pipeline generates two summaries for each CWE category. First, produces security guidelines that define actionable instructions and best practices for preventing specific vulnerabilities as high- level knowledge. Second, summarizes vulnerability causes, which capture the root conditions and failure patterns that lead to the occurrence of the vulnerability. These distilled causes subsequently leveraged in the retrieval stage as a key security aspect.
2.1.2 SECURITY-FOCUSED STATIC PROGRAM SLICING
As shown in Figure and Appendix B security code examples may contain code logic (e.g., database connection, web scraping) that is not relevant to a target programming task at inference time. Such code logic may distract the LLM from generating functional code aligned with the target task. Therefore, we design a security- focused slicing method to extract concise code examples with only security-related program statements from raw code examples.
3

---

Published as a conference paper at ICLR 2026
RESCUE begins by building Program Dependence Graph (PDG) that captures how statements in the code depend on each other through both data and control dependence. Based on the statements influenced by patches, it identifies points of interest by treating deleted statements as indicators of vulnerable code and added statements as indicators of secure code. Around these points, we perform bidirectional slicing extract the relevant context: backward slicing traces the statements that influence the vulnerable or secure code, while forward slicing captures those that are affected by it. Finally, the sliced subgraphs from the vulnerable and secure versions are compared and complemented with missing context, resulting in two parallel, contextually complete code variants. Appendix (aaaadixxBBBoooo describes this security- focused slicing algorithm in detail.
2.2 HIERARCHICAL
RETRIEVAL
With the knowledge base constructed, the next step is to retrieve the most relevant security knowledge for a given task. Our design mirrors the hicrarchy of knowledge base: retrieval begins at the CWE level to identify potential relevant vulnerability types, and then narrow down to fine-grained secure code examples. A key novelty of our method is the multi-faceted retrieval strategy, which conducts proactive analysis to generate multiple security- queries. We will first explain this multi-faceted design and then describe the hierarchical retrieval process.
2.2.1 PROACTIVE MULTI-FACETED ANALYSIS
Conventional retrieval typically relies on task functional descriptions, which lack explicit security semantics. In contrast, our method proactively analyzes coding tasks from multiple security-critical perspectives. This proactive stance is essential because security vulnerabilities often emerge from subtle implementation details that are not apparent in task descriptions. Specifically, we consider the following three facets:
(1) Vulnerability Cause Analysis: To explicitly clarify the security requirements and potential attacks, we instruct LLMs analyze the task and explain the underlying vulnerability cause Veuse (see prompt in Appendix D.2.2).
(2) Draft Code Generation: Since vulnerabilities often manifest during the coding process, we generate initial code Cdran using zero-shot prompting (details in Appendix D.2.I).
(3) API Call Extraction: Since security vulnerabilities frequently stem from API misuse Zhang ct al. 2018 Li et al., 2021//Egel et al. 2013). we apply the visitor pattern to traverse the abstract syntax trees of the draft code Cdrah to identify all API calls.
2.2.2 HIERARCHICAL RETRIEVAL PROCESS.
Building on these proactive multi-faceted analyses, RESCUE begins a two-step retrieval process.
Step 1: CWE-level Retrieval. RESCUE first selects the top-k relevant CWE types using two facets: (1) Vulnerability Cause Analysis: RESCUE uses a widely used dense retriever for RAG, bge-base- en-vl.5 (Xiao et al. 2202)), to compute scorevca between input task's vulnerability cause and the indexed vulnerability causes per CWE type. These per-CWE vulnerability causes are distilled from raw instances during the offline stage (Section 1.1.I). 1b. (2) API Pattern: Since API calls are discrete, RESCUE computes SCOTeAPI between the draft code's 's APIs and the API set of each CWE type via sparse retrieval, BM25 (Robertson et al. 1995). Each CWE's API set is constructed by aggregating all APIs extracted from its associated vu vulnerability-fix instances.
Then, it fuses these two facet scores using modified Reciprocal Rank Fusion (RRF) method with thresholding and rank-based filtering. This approach is motivated by the observation that only certain scenarios require security-specific guidance. Our modified RRF defined as:
RRF(d) dd = Σ vi(d)- +a where Vi(d) [(s:(d) > T.) [(rx(d)) S 10).
(I)
Here, (d) and rd( are the score and rank of item for facet i, T. is a confidence threshold, and a is smoothing parameter.
Step 2: Code-level Retrieval. After narrowing down to relevant CWE types, we proceed to conduct a fine-grained search at the low level using the same two facets and additional third facet, Code
4

---

Published as a conference paper at ICLR 2026
Similarity. We also employ dense retrieval to obtain scoree between the draft code and sliced secure code examples, capturing similarity at the code level to identify relevant secure patterns.
The scores from all three facets fused via the same modified RRF to select the most relevant secure code examples. Finally, we use the security guidelines corresponding to the selected example's ' CWE type, along with the sliced secure code example, to construct prompts for LLMs (detailed in Appendix D.3), guiding secure code generation.
3 EXPERIMENTS
3.1 EXPERIMENT SETUP
Models We evaluate RESCUE with six LLMs from different model families and with different
-ann2:5--ooder322-Insss L --nturtttutt (Dubey al., 2024), (Hui ct al. 2024), TaepSeck-Codee V2- Lite-Instruct (Zhu al. 2024), and DeepSeek-Vii -Ve--3cc-V330324 V3-0324 (Liu et al., (024). For inference, GPT-4o-mini
model sizes, including GPT-4o-mini (OpenAl 2024).
Qwen2.5-Coder-77 B--nnBtuttttttt
and DeepSeek-V. V3 are accessed via official APIs, while the other models are locally deployed using
vLLLM (Kwon al., 2023) on an NVIDIA A800 80GB GPU.
Benchmarks We first evaluate RESCUE on state-of-the-art security benchmark called Code- Guard+ (Fu al. 2024). CodeGuard+ incorporates and extends prior security benchmarks (Pearce et al.] 2022] Siddiq & Santos 2022). It includes 94 security-sensitee
coding scenarios, each of which accompanied by unit tests and CodeQL. checks, enabling the testing of both functional correctness and security. CodeQL (GitHub 2025) is widely used security analysis tool and has been used to evaluate the security of LLM-generated code in several studies (He & Vechev
2023 He et al. 2024
Li et al. 2024a).
Furthermore, following prior work (He et al. 2024 Li et al. 2024a Zhang et al. 2024). we also
regular code generation benchmarks to demonstrate that RESCUE does not affect the functional correctness of L..M-generteed code while improving its security. Specifically, we evaluate RESCUE on HumanEyal+ (Liu al. 2023a), BinCodeBench (Zhuo al. 2025), and LiveCodeBench (Jain) iet al. (025). HumanEval+ is popular code generation benchmark with 164 basic programming tasks and extensive test cases. BigCodeBench is much bigger and more challenging benchmark. includes 1 140 programming tasks that span across various scenarios, such as data analysis and web development, and involve complex function calls. LiveCodeBench specifically designed to address the data contamination problem in LLM code generation. It includes a continuously updated set of code generation problems. We use its re melleaeeeve v5 version, collected by January 2025, which has 880 code generation problems.
To reduce the randomness of code generation, we generate 100 samples for each problem on CodeGuard+ and HvmanEval+, Since BigCodeBench and LiveCodeBench have roughly 10x more problems than CodeGuard+ and HumanEval+, we generate 10 samples on these two benchmarks.
Metrics Following prior work (Zhang al. 2024 He et al. 2024 Li et al. 2024a He & Vechev 2023), we used SecureRate to measure the security of the proportion of generated code samples that pass the security checks, e.g., CodeQL checks in CodeGuard+ (Fu et al. 2024). For functional correctness measurement, we followed recent
code. SecureRate is defined
work (Zhuo al. 2025 Jain al. 2025) to use the unbiased Pass@k (Chen al. 2021
In the meantime, we observe that SecureRate overlooks the functional correctness of the generated code. For instance, code snippet that does nothing will always be secure but is meaningless in practice. As shown in Table [ several methods excessively sacrifice functionality to achieve higher SecureRate scores, which fails to reflect genuine security improvements. Therefore, introduce new metric for security evaluation, SecurePass@ue which jointly evaluates functionality and security:
SecurePass@A: ==
Problems
where n is the total number of generated samples, & represents the number of our observed samples, and sp means the number of samples that pass both unit tests and CodeQL. security checks.
5

---

Published as a conference paper at ICLR 2026
Specifically, report SecureRate, Pass @ 1, and SecurePass@@ on the CodeGuard+ benchmark, since it includes both security checks and unit tests. For HumanEval+, BigCodeBench, and LiveCodeBench, only report Pass @1 since they only include unit tests to check functional correctness.
Baseline Methods We compare our approach with five state-of-the-ar baseline methods, each representing a different strategy for secure code generation: (1) SecCoder (Zhang et al. 2024) is
RAG method that retrieves the most similar secure code example to facilitate in-context learning. To ensure a fair comparison, security data introduced in Section as retrieval documents. (2) Codexity (Kim et al. (024) utilizes an external security tool identify vulnerabilities for generated code and then iteratively refines the code based on detection results, up to three iterations. To avoid data leakage, we use another widely adopted security tool, semgrep (Semgrep) 2025), instead of CodeQL.. (3) SafeCoder (He et al.. 2024) adopts a specialized instruction-tuning method for code security. We use the training dataset and hyperparameters from the original paper to finetune the LLMMs used in our experiments, Given Llama3. 1-8B- excluding larger models and closed-source models. (4) CoSec (Li et al. 2024a) manipulates the decoding process by controlling the output token logits based on a small trained security-specialize model. For implementation, we use the same training dataset as in the original paper. Since this method requires training smaller model that uses the same tokenizer to perform its decoding, we select security-specialized model for Dwwe2.5-CCoder-7B-Imm Llama3. 1-----8BBtntttt Other models are either closed-source or lack smaller version from the same model family. (5) INDICT (Le et al., 2024) is multi-agent debate framework with external security tools to generate both security and helpfulness critiques for iterative code refinement. Following the original setup, we set the iteration round three and use all four tools for code generation.
utilize the same retriever age-base-en-v1.5 (Xiao et al. 2023 and the raw
the limited computational resources, only fine-tune Qwen2.5 Co-ee--B--nnntteeee -oo-eee---oode----iieeee
Instruct, and
as the small and 32B and I-In-nrrut for
Other Implementation Details We use tree-sitter (Brunsfeld & Github) to implement static program analysis, slicing, and API extraction. To control the length of sliced code, our method performs 2-hop program slicing. During generation, we set the temperature to 0.2. To balance the precision and recall, we use a top-k value of 4. To only search security knowledge for security-relevan problems, the thresholds for the facets of API, vulnerability cause, and code are set to 4.0, 0.75, and 0.65, respectively. We follow prior work (Cormack et al. 2009) to set the RRF parameter a to 60.
3.2 MAIN RESULTS
As shown in Table RESCUE consistently outperforms all existing methods in terms of Se- curePass@ 1, the metric that balances security and functional correctness of generated code. Specif- ically, RESCUE achieves 4.8% absolute improvement average compared with the second-best baseline. We also observed that several existing approaches sacrifice functional correctness for security. For example, though INDICT (Le al., 2024) achieves a higher SecureRate than RESCUE, it has the lowest Pass among all methods. Furthermore, when evaluated on the three benchmarks on functional correctness, RESCUE achieves comparable performance compared with the original models. This indicates that RESCUE does not severely damage the functional correctness of gen- erated code while improving its security. Appendix C.I provides a more direct comparison of the performance improvements achieved by each method.
In contrast, another RAG-based method, SecCoder (Zhang et al. 2024), does not significantly improve SecurePass@ @1 or SecureRate. This suggests that simply applying conventional RAG for secure code generation cannot fully exert the security knowledge. Section 3.3 shows the ablation study results of the hierarchical knowledge base and retrieval method in RESCUE.
3.3 IN-DEPTH ANALYSIS RESULTS
To thoroughly analyze each component of RESCUE, we conducted extensive experiments on the CodeGuard+ benchmark using three models: Deepseek-Coder Coaeeeekk-Cder-V---iit... V2-Lite, Owen2.5-Coder-7B. and Llama3.1 1-B. We selected these models because they represent three widely adopted model families and have demonstrated strong performance when integrated with our proposed method.

---

Published as a conference paper at ICLR 2026
Table 1: Performance comparison across six L.LMs and four benchmarks: CodeGuard+, HvaanEval+
(HE+), BigCodeBench (BCB), and LiveCodeBench (LCB). For each model, bold indicates the best score, and underline indicates the second-best result. Notably, SafeCoder requires fine-tuning the LLMs and CoSec requires training a smaller model with the same tokenizer, therefore, we evaluate both methods on applicable open-source LLMs.
CodeGuard+
Model
Method
SP@1
Pass
Pass
Pass
Pass@
LLM alone
59.7
65.1
24.4
SecCoder
55.6
63.7
82,9
40.9
23.9
Codexity
58.4
70.3
80.1
70.4
35.2
24.4
DeepSeek-Coerr- Vi-Liee
INDICT
49.5
72.3
62.5
57.9
32.4
23.4
SafeCoder
60.3
68.6
81.7
61.2
14,8
13.4
RESCUE
65.6
72.8
39.1
25.2
LLM alone
51.2
77.1
SecCoder
54.9
65.6
79.8
74.6
42.3
24.2
Codexity
51.4
68.1
77.7
75.1
44.9
24.8
Qwen2.5-Coder-78
INDICT
41.9
84.1
48.5
71.3
33.8
22.4
CoSec
52.8
64.6
82.8
68.0
19.0
23.3
SafeCoder
56.5
74.0
43.0
19.6
RESCUE
64.8
72.1
86.2
77.8
42.9
24.3
LLM alone
59.3
66.0
88.3
80.0
54.1
22.3
SecCoder
58.1
66.6
84.7
82.9
$3,9
25.2
Qwen2.5-Coder:32B
Codexity
57.1
71.6
80.7
79.5
53.4
22.0
INDICT
40.4
84.4
48.1
20.9
CoSec
41.9
$4.9
78.0
52.7
23.4
RESCUE
65.1
81.5
80.6
80.8
49,9
27.1
LLM alone
53.7
63.7
82.8
58.8
36.0
15.0
SecCoder
48.4
60.6
75.4
$1.0
35.6
14.9
Codexity
50.8
68.5
73.7
$7.7
37.3
14.7
Llama3.1-8B
INDICT
16.0
CoSec
53.9
62.2
55.7
SafeCoder
52.4
69.4
72,4
$4.0
31.4
11.0
RESCUE
56.2
69.7
77.6
$4.6
31.8
14.7
LLM alone
58.2
68.9
80.7
83.6
54.6
37.6
SecCoder
57.8
71.2
79.7
82.6
54.0
37.4
GPT-4o-mini
Codexity
55.5
77.0
72.5
$2.6
38.1
INDICT
31.1
85.5
36.8
$1.2
26.0
35.7
RESCUE
63.0
77.6
77.3
81.3
45.2
37.5
LLM alone
64.6
71.4
87.4
72.9
61.5
64.3
SecCoder
64.7
74.8
83.4
79.6
61.7
63.6
DeepSeck-Vas V3--0344
Codexity
63.5
77.4
64.1
INDICT
29.6
85.6
31.9
63.6
RESCUE
69.7
79.1
83.5
89.1
60.2
64.3
Table 2: Results of ablation studies on security knowledge base construction, evaluating five variants
of the security knowledge base with three models on the CodeGuard+ benchmark across four metrics: number of input tokens (#Token). SecurePass @SP@) 1). SecureRate (SR), and Pass@) (P@ I), The bold number indicates the best performance, and " represents dismissal.
MSC-V2-Lite-Instree
Swwnn.5-Coodrr-7...
Llama3. Hlima.11-8B-nnteee --B--Isrruut
Setting
#Token]
SP@
#Token
SR
P@
#Token.
RESCUE
503
72.8
87.9
397
64.8
72.1
56.2
69.7
77.6
w/o construction
55.6
61.9
81.0
53.9
63.6
75.4
45.3
58.8
73.3
w/o guideline
63.3
72.1
86.2
63.9
72.2
86.4
51.4
65.3
76.9
w/o slicing
661
61.0
70.5
80.6
506
62.6
71.3
83.1
610
52.7
68.8
74.3
w/o PSymmeration
753
64.8
71.9
86.5
595
66.1
71.3
87.6
53.5
67.0
75.4
w/o PSpstriena!
435
63.1
73.1
83.4
358
64.8
71.4
86.6
389
54.0
71.3
76.5
3.3.1 ABLATION STUDY SECURITY KNOWLEDGE BASE CONSTRUCTION
To better understand the contributions of the security knowledge base construction components, specifically security guideline extraction and program slicing, we performed ablation studies using five variants: (1) w/o construction: Does not utilize the constructed security knowledge base and
7

---

Published as a conference paper at ICLR 2026
instead directly employs the raw security data. (2) w/o guideline: Removes the security guidelines from the constructed security knowledge base, providing only relevant secure code examples to the model. Since sliced code examples are used in both the retrieval and generation stages, designed three additional detailed variants for further investigation: (3) w/o slicing: Completely removes the slicing component, using original (unsliced) code in both retrieval and generation stages. (4) w/o pSretricvad: Replaces sliced code with original code only during the retrieval stage. (5) w/o
pSgeneration: Replaces sliced code with original code only during the generation stage. Table 2 shows the experimental results, from which we derive the following key observations:
Raw security data alone does not improve performance; constructing a security knowledge base is essential. Comparing RESCUE with the w/o construction variant, we observe a significant performance drop in all metrics when using raw security data directly. This is because irrelevant code logic distracts the models during code generation, and the noise of irreevvnce also leads to inaccurate retrieval results. Thus, constructing refined security knowledge base is crucial.
Security guidelines enhance security performance. The results of the w/o guideline variant show decrease in SP@I compared to RESCUE. For instance, the SP@1 metric in 1-8-a..t--- drops by 4.8 points, highlighting the substantial contribution of security guidelines.
Program slicing improves security performance and reduces token costs. The results of the w/o slicing variant demonstrate the effectiivnees of program slicing in enhancing performance. Additionally, finer-grained ablation results from the w/o pSretrieval and w/o pSgeneration variants reveal that program slicing is beneficial in both the retrieval and generation stages. Specifically, slicing helps retrieve more relevant security knowledge and provides concise yet informative code examples during generation. Finally, we note that applying sliced code during generation substantially reduces the number of input tokens. Additional analysis comparing lines of code before and after program slicing provided in the Appendix C.2
3.3.2 IMPACT ANALYSIS OF HIERARCHICAL RETRIEVAL
Liama
Deepseek
Qwen
56.6
56.4
(50 T886
64
64.0
56.0
SPI01
63.5
Without Hierarcty
55.8
Without Hierrth
60
Wihhout Hierorcyy
63.0
Number of Selected Nodes (K)
Number of Selected Nodes
Number of Selected Nodes
Figure 3: Comparison of SecurePass @ I(SP@ 1) performance across hierarchical and non-hierarchical settings for three LLMs, DeepSeek- BenesSee-CCoer---ee Coder- V2-Lite (Deepseek), Llama3. I-8B-Instruct (Llama), Qwen2.5-Coder-7B (Qwen), at varying numbers of selected CWE types (k).
To analyze the effectiveness of our hierarchical design, we conducted an impact analysis by varying the the parameter k in top-k relevant CWE types from 1 5 and comparing against non-hierarchical baselines, as shown in Figure 3 The peak results of hierarchy consistently outperform the non- hierarchical setting across all LLMs. Interestingly, the performance exhibits an inverted U-shaped trend as k increases: smaller k values may restrict the model to local optima, while larger k values introduce noise, diminishing performance. Based on these insights, we select as the optimal configuration for all experiments.
3.3.3 ABLATION STUDY ON MULTI- RETRIEVAL
To systematically evaluate the contribution of each facet to retrieval performance, we conducted an ablation study covering all seven possible combinations of the three facets under consideration. We make two key observations based on the results in Table 3
Multi-faceted retrieval mostly outperforms single-facet approaches. Overall, single- facet retrieval methods show limited and inconsistent effectiveness. In contrast, our multi-face suutti-f retrieval effectively leverages complementary strengths from individual facets, outperforming each single-facet method.
8

---

Published as a conference paper at ICLR 2026
Table 3: Results of ablation studies multi-faceted retrieval, evaluating seven combinations of API
pattern (API), vulnerability cause analysis (VA), and code similarity (Code) across three different LLMs on the CodeGuard+ benchmark. In the table, "v" indicates the adoption of a facet, while represents its dismissal. The bold number indicates the best performance.
Facel
DeepSeck Cader--
Llama3.1-8B
Owen2.5-Cuder//
API
VA
Code
SP@ I
SecurityRate
Pass
SP@
SecurityRate
@ass
SP@1
SecurityRate
Pass
V
65.6
72.8
87.9
56.2
69.7
77.6
64.8
72.1
86.2
62.7
71.5
84.8
53.4
67.7
77.0
63.8
70.6
86.2
V
64.1
73.5
84.5
54.8
77.0
64.6
71.5
86.
V
61.3
72.4
83.0
51.7
75.4
65.0
72.3
85.3
61.4
71.7
82.9
52.1
67.4
76.6
62.2
69.9
84.9
V
63.2
71.9
86.2
53.6
70.0
73.2
66.2
72.5
86.2
57.1
68.3
82.1
51.1
62.5
81.2
61.7
69.1
84.8
Notably, combining all three facets mostly achieves the best overall performance across nearly all scenarios, highlighting the advantage integrating diverse security-related facets.
Our proposed API pattern and vulnerability cause analysis facets significantly outperform the code similarity facet. The code-only facet consistently lags behind other facet combinations, reinforcing that dense retrieval approaches based solely on code similarity are insufficient. Incorpo- rating API pattern and vulnerability cause analysis facets substantially enhances retrieval accuracy, demonstrating their effectiveness in capturing meaningful semantic context.
3.4
IMPACT ANALYSIS OF SUMMARIZATION LLMS
Since our pipeline employs GPT-4o for the summa- rization step, one potential concern is whether the observed improvements stem merely from relying on a powerful black-box model. To address this, we conduct impact analysis by replacing GPT-4o with three open-source summarization models: Qwen2.5- Coder-7B, Llama3.1-80 and DeepSeek-V3. In this setting, the summarization model is used to distill security knowledge, while the generation model applied during the online stage for secure code gener- ation. As shown Table the performance gains do not depend on GPT-4o; they consistently arise from our pipeline design. Even with smaller open- source models, the framework achieves compara- ble improvements.
Table 4: Impact of different summarization and generation model combinations. The im- provements hold across models, showing that gains stem from the pipeline rather than re- liance GPT-4o.
Summarisation Model
Generation Model
SP@
SR
P8
Qwen2.S LJam33.155h
83.3
Dowen:5-Cudde-P7
DeepSeek-V3
Qwen2 C.Clee-
69.5
79.8
1 1-1888
Llam3.1
$1.2
66.7
75.9
DrepSrek-V. V3
71.5
79.2
85.2
Owen2 5 Coder 7B
59.2
71.3
80.3
DeepSeek-V3
Llam3.1 -3B
56.5
72.1
77.7
DeepSock-V3
3.5 ADDITIONAL ANALYSIS
Beyond the main experiments, we conduct series of additional analyses to provide more compre- hensive evaluation of RESCUE. First, we analyze the computational overhead of RESCUE, showing that the additional latency is acceptable and can be further reduced through concurrent LLM calls (Appendix C.3). Second, we evaluate RESCUE on CWEval (Peng et al. 2025), a dynamic testing benchmark. demonstrating that our gains are not artifacts of static analysis tools (Appendix C.4). Third, we examine the generalizability of RESCUE from multiple perspectives: we analyze its perfor- mance on both seen and unseen CWE types (Appendix C.5.2). and further evaluate it on programming languages absent from our knowledge base, confirming that the distilled security knowledge transfers broadly across languages (Appendix C.5.3). Fourth, we validate our modified RRF fusion strategy through ablation and sensitivity analysis threshold hyperparameters (Appendix C.6). Finally, we break down performance by vulnerability category, revealing that RESCUE yields stronger gains on non-funetie www.-ffcctionalty-ggee sppciffc vulnerabilities due to their more explicit and localizable constraints (Appendix C.7

---

Published as a conference paper at ICLR 2026
4 RELATED WORK
Retrieval-Augmented Code Generation Recent research has investigated RAG to enhance code
generation (Yang et al.) 2025] [u al. [022]] Gao al. 2024 Tan et al. 2025). Several studies
focus on repository-lcvel retrieval for code generation (Wu al. 2024 Zhang al. 2023). Others
introduce external API documentation to aid generation involving unfamilia APIs (Zan et al. 2022
Zhou et al. 2023 Liu et al., 2023b; Gu al. 2025p. Additionally, retrieval of functionally similar
examples has been used to enhance functional correctness (Parvez et al., 2021 St al. 2024 Nashid
al. 2023). In contrast,
method specifically targets retrieval of security knowledge improve
the security of generated code without compromising functional correctness.
Secure Code Generation Existing studies have identified significant security concerns in L.LM-
generated code (Hou et al. 2024 GitHub 2024 Cursor 2024). To mitigate these, recent approaches
include fine-tuning models on securtt-speccift datasets or tasks (He & Vechev 2023 He et al.
2024, Hajipour et al. 2024 Li al.)
2024b) Xu et al. 2025). and training- free approaches such
as prompt engineering (Tony et al. 2024), security analysis tool integration (Kim et al. 2024
Nazzal et al.) 2024), agent (Le et al. 2024), and RAG frameworks (Mukherjee & Hellendoorn
2025
Zhang et al. 2024 Tony et al. [025 Lin al. 2025). Specifically, SecCoder (Zhang et al.
2024)
retrieves secure code examples with dense retriever and SOSecure (Mukherjee & Hellendoom
2025)
retrieves StackOverflow content with BM25. Our work automatically constructs a hierarchical
security knowledge base from raw security data and proposes a specially designed retricval method.
5 CONCLUSION
This work introduces RESCUE, a novel sarrival--uggeentee secure code generation framework that adopts hybrid distillation method to construct a hierarchical security knowledge base and designs hierarchical multi-faceted retrieval method. Compared to five state-of-the-arr methods across four benchmarks and six models, RESCUE demonstrates substantial improvements in security without compromising functional correctness. Further in-depth analyses highlight the necessity of knowledge base construction and validate the effectiveness of proposed hybrid distillation method. Additional thorough analyses confirm the advantages of our hierarchical multi-faceted retrieval design.
ACKNOWLEDGMENT
We sincerely thank the anonymous reviewers for their constructive feedback. This work was supported in part by the National Science Foundation (NSF) under Awards NSF CAREER 2340408 and NSF Proto-OKN 2333736.
ETHICS STATEMENT
Our work adheres to the ICLR Code of Ethics. The primary goal of this research to enhance the security of code generated by Large Language Models (LLMs). thereby reducing the prevalence of software vulnerabilities. We believe this work has positive ethical impact by contributing to more secure and reliable software development practices.
The dataset used to construct our security knowledge base derived from publicly available sources and consists of known vulnerabilities and their fixes from CVEs and public GitHub projects. Our research does not involve human subjects or the use of personally identifiable or private data.
While any tool related to security could have potential for dual-use, our framework, RESCUE, is designed for a defensive purpose: to guide LLMs in generating secure code by leveraging knowledge of existing fixes. The methodology focuses abstracting and applying secure coding patterns rather than discovering new exploits. We use publicly accessible LLMs and open-source tools, and our contributions aim to mitigate existing security risks in Al-assisted programming.
10

---

Published as a conference paper at ICLR 2026
REPRODUCIBILITY STATEMENT
We are committed to ensuring the reproducibility of our research. To facilitate this, we provide comprehensive resources and detailed deseriptions throughout the paper. Our full implementation of the RESCUE framework is available at the repository link provided in the abstract.
REFERENCES
Max Brunsfeld and Github, Tree-sitter: An incremental parsing system for programming tools. URL https://tree sitter. github .eriii....tteee io/treeeeeeee sitter/
Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde De Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, et al. Evaluating large language models trained on code. arXiv preprint arXiv:2107.03374, 2021.
Tianyu Chen, Zeyu Wang, Lin Li, Ding Li, Zongyang Li, Xiaoning Chang, Pan Bian, Guangtai Liang, Qianxiang Wang, and Tao Xie. Detecting functionality-specii vulnerabilities via retrieving individual catiiiinalit--quvvllleeee apis open-source repositories. In 39th European Conference Object- Oriented Programming (ECOOP 2025), pp. 6-1. Schloss Dagstuhl-LLeibniz-Zenil für Informatik, 2025.
Gordon Cormack, Charles LA Clarke, and Stefan Buettcher. Reciprocal rank fusion outperforms condorcet and individual rank learning methods. In Proceedings of the 32nd international ACM SIGIR conference on Research and development in information retrieval, pp. 758-759, 2009.
Cursor. Cursor, 2024. URL httpt:: cursor com/
Accessed: 2024-12-23.
CVE Program. Cve common vulnerabilities and exposures, 2025. URL https: www. cve
org/ Accessed: 2025-05-14.
Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. The llama 3 herd of models. arXiv preprint arXiv:2407.2178. 2024.
Manuel Egele, David Brumley, Yanick Fratantonio, and Christopher Kruegel. empirical study of cryptographic misuse in android applications. In Proceedings of the 2013 ACM SIGSAC Conference on Computer Communications Security, CCS '13, pp. 73-84, New York, NY, USA, 2013. Association for Computing Machinery, ISBN 9781450324779. doi: org http://0.1115/225888181 2516693
URL httLhttps:/ /tt:://doll http////io.o//o/o/////oo
Yanjun Fu, Ethan Baker, Yu Ding, and Yizheng Chen. Constrained decoding for secure code
generation. arXiv preprint 24Xiv:2405.002// 2024.
Yujia Fu, Peng Liang, Amjed Tahir, Zengyang Li, Mojtaba Shahin, Jiaxin Yu, and Jinfu Chen. Security weaknesses of copilot generated code github. arXiv preprint arXiv:23 10.00223/0.02059 2023.
Xinyu Gao, Yun Xiong, Deze Wang, Zhenhan Guan, Zejian Shi, Haofen Wang, and Shanshan Li. Preference-guided refactored tuning for retrieval augmented code generation. In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering. ASE '24, pp. 65-77. New York, NY, USA, 2024. Association for Computing Machinery, ISBN 9798400712487. doi: 10. 2211113366662)) 620.3694987. /ttp://///////////oo///////////1 3694987
GitHub. Github security advisories, 2024. htt.:/tpe///gttabb..om///rssssss Ac-
cessed: 2025-05-14. 14.
GitHub, Github copilot, 2024. URL http:s///ggthab.ccoo///ssteeeeep cessed: 2024-12-23.
Ac-
GitHub. Codeql. https::/cooee
2025. Accessed: 2025-02-14.
Wenchao Gu, Juntao Chen, Yanlin Wang, Tianyue Jiang, Xingzhe Li. Mingwei Liu, Xilin Liu, Yuchi Ma, and Zibin Zheng. What to retrieve for effective retrieval- auggentte code generation? an empirical study and beyond, 2025. /t//://pp/////rrrrooooo/////////
11

---

Published as a conference paper at ICLR 2026
Hossein Hajipour, Lea Schönherr, Thorsten Holz, and Mario Fritz. Hexacoder: Secure code generation via oracle-guuel -uieeeguuddddd synthetic training data. arXiv preprint arXiv:2409.06444 2024.
Jingxuan He and Martin Vechev. Large language models for code: Security hardening and adversarial testing. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pp. 1865-1879, 2023.
Jingxuan He, Mark Vero, Gabriela Krasnopolska, and Martin Vechev. Instruction tuning for secure code generation. In Ruslan Salakhutdinov, Zico Kolter, Katherine Heller, Adrian Weller, Nuria Oliver, Jonathan Scarlett, and Felix Berkenkamp (eds.), Proceedings of the 41st International Conference on Machine Learning. volume 235 of Proceedings of Machine Learning Research, pp. 18043-18062. PMLR, 21-27 Jul 2024. URL he24k.
mlr. www.mp..r....23..
Xinyi Hou, Yanjie Zhao, Yue Liu, Zhou Yang, Kailong Wang, Li Li, Xiapu Luo, David Lo, John Grundy, and Haoyu Wang. Large language models for software engineering: A systematic literature review. ACM Trans. Softw. Eng. Methodol. 33(8), December 2024. ISSN 1049-331X. doi: 10.1 10.1145/3695988. URL httt::/tt:///ttt wrg.ii.rrr//i 111111111131661
Binyuan Hui, Jian Yang, Zeyu Cui, Jiaxi Yang, Dayiheng Liu, Lei Zhang, Tianyu Liu, Jiajun Zhang, Bowen Yu, Kai Dang, et al. Qwen2. 5-coder technical report. arXiv preprint arXiv:2409. 12166, 2024.
Vinay M. Igure and Ronald D. Williams. Taxonomies of attacks and vulnerabilities in computer systems. IEEE Communications Surveys & Tutorials, 10(1):6-19, 2008. doi: 10. 109/COMT. 2008.4488 4483644
Naman Jain, King Han, Alex Gu, Wen-Ding Li, Fanjia Yan, Tianjun Zhang, Sida Wang, Armando Solar-Lezama, Koushik Sen, and Ion Stoica. Livecodebench: Holistic and contamination free eval- uation of large language models for code. In The Thirteenth International Conference on Learning Representations, 2025. URL /ttttpsi//ppenrvvie... http://pparreeeeeeeeeeeeeereeeee 2tt.:/orrmmim1ccch0Jy3111111
Sung Yong Kim, Zhiyu Fan, Yannic Noller, and Abhik Roychoudhury. Codexity: Secure ai-assisted code generation. arXiv preprint arXiv:2405.0397 2024.
Woosuk Kwon, Zhuohan Li, Siyuan Zhuang, Ying Sheng, Lianmin Zheng, Cody Hao Yu, Joseph E. Gonzalez, Hao Zhang, and Ion Stoica. Efficient memory management for large language model serving with pagedattention. In Proceedings of the ACM SIGOPS 29th Symposium on Operating Systems Principles, 2023.
Hung Le, Doyen Sahoo, Yingbo Zhou, Caiming Xiong, and Silvio Savarese. Indict: Code generation with internal dialogues of critiques for both security and helpfulness. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024.
Dong Li, Meng Yan, Yaosheng Zhang, Zhongxin Liu, Chao Liu, Xiaohong Zhang, Ting Chen, and David Lo. Cosec: On-the-fly security hardening of code Ilms via supervised co-decoding. In Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis, pp. 1428- 1439, Vienna Austria, September 2024a. ACM. ISBN 9798400706127. doi: 10.1 4445//55222..6603777
Junjie Li, Fazle Rabbi, Cheng Cheng, Aseem Sangalay. Yuan Tian, and Jinqiu Yang. An ex- ploratory study on fine-tuning large language models for secure code generation. arXiv preprint arXiv:2408.0007 2024b.
Xia Li, Jiajun Jiang, Samuel Benton, Yingfei Xiong, and Lingming Zhang. A large-scale study on api misuses in the wild. 2021 14th IEEE Conference on Software Testing, Verification and Validation (ICST), pp. 241-252, 2021.
doi: 10. 109/CST49551 20011.00044.
Bo Lin, Shangwen Wang, Yihao Qin, Liqian Chen, and Xiaoguang Mao. Give llms security course: Securing augmentl code generation via knowledge injection. In Proceedings of the 2025
ACM SIGSAC Conference Computer and Communications Security, CCS '25, pp. 3356-3370, New York, NY, USA, 2025. Association for Computing Machinery. ISBN 9798400715259, doi: 10. 0411444719027336666671 URL TTRl.https://// / htt./doi.oogg1..11 org 100...115/77770 3765044
12

---

Published as a conference paper at ICLR 2026
Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, et al. Deepseek-v3 technical report. arXiv preprint arXfv:2412.19437, 2024.
Jiawei Liu, Chunqiu Steven Xia, Yuyao Wang. and Lingming Zhang. Is your code generated by chatgpt really correct? rigorous evaluation of large language models for code generation. Advances in Neural Information Processing Systems, 36:21558-21572 215722, 2023a.
Mingwei Liu, Tianyong Yang, Yiling Lou, Xueying Du, Ying Wang, and Xin Peng. Codegen4libs: two-stage approach for tibrary-oriented code generation. In 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE), pp. 434 445, 2023b. doi: 10.1109/
Shuai Lu, Nan Duan, Hojae Han, Daya Guo, Seung-won Hwang, and Alexey Svyatkovskiy. ReACC: A retrieval-augmented code completion framework. In Smaranda Muresan, Preslav Nakov, and Aline Villavicencio (eds.), Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 6227 6240. Dublin, Ireland, May URL
2022. Association for Computational Linguisties. doi:
https: / c antho logy .og..og......................... wwtp/oggg/2222.2 ac -ongl-l-oon..oo 4317
Vahid Majdinasab, Michael Joshua Bishop. Shawn Rasheed, Arghavan Moradidakhel, Amjed Tahir, and Foutse Khomh. Assessing the security of github copilot's generated code-a targeted replication study. In 2024 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER). pp. 435-444, IEEE, 2024.
MITRE. Common weakness enumeration (cwe), 2025. URL httts:://cw..miteeeee Accessed: 2025-05-14.
Manisha Mukherjee and Vincent J Hellendoorn. Sosecure: Safer code generation with rag and stackoverllow discussions. arXiv preprint arXiv:2503. 2025.
Noor Nashid, Mifta Sintaha, and Ali Mcsbah. Retrieval-based prompt selection for code-related few-shot learning. In 2023 IEEF/ACM 45th International Conference Software Engineering (ICSE), pp. 2450-2462. IEEE, 2023.
National Institute of Standards and Technology (NIST). National vulnerability database (nvd), 2024.
URL httts::///tettt nist gov/ Accessed: 2025-05-14.
Mahmoud Nazzal, Issa Khalil, Abdallah Khreishah, and NhatHai Phan. Promsec: Prompt opti- mization for secure generation of functional source code with large language models (Imss. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pp. 2266-2280, 2024.
OpenAl. Gpt-4o mini model card, 2024. gpt co-mini-- www.mmiiiiavvannnnn.... -f 12.
URL https: careaai..ooiiii httm//inex/// www.eeeetteeeeeeeeeeeeeeeeeee inte intiiienttintelllgeneee Accessed: 2025-02-
Elise Paradis, Kate Grey, Quinn Madison, Daye Nam, Andrew Macvean, Vahid Meimand, Nan Zhang, Ben Ferrari- Ferrari-Church, and Satish Chandra. How much does ai impact development spee?? an enterprise-based randomized controlled trial. In 2025 IEEE/ACM 47th International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP), pp. 618-629, IEEE, 2025.
Md Rizwan Parvez, Wasi Ahmad, Saikat Chakraborty, Baishakhi Ray, and Kai- Chang. Retrieval augmented code generation and summarization. In Marie-Francing Moens, Xuanjing Huang, Lucia Specia, and Scott Wen-tau Yih (eds.), Findings of the Association for Computational Linguistics: EMNLP 2021, pp. 2719-2734, Punta Cana, Dominican Republic, November 2021. Association for Computational Linguistics. doi: 10.18853/11/22// http://2222..iiinnnnmmmom findings-emmlp.222. URL https://aclanthont
www.:/o.gg.oo................... 20211 findings-----.. mww.ings--enn11.. 232/
Hammond Pearce, Baleegh Ahmad, Benjamin Tan, Brendan Gavitt, and Ramesh Karri. Asleep at the keyboard? assessing the security of github copilot's 's code contributions. In 2022 IEEE
Symposium Security and Privacy (SP), pp. 754-768. IEFE, 2022.
13

---

Published as a conference paper at ICLR 2026
Jinjun Peng, Leyi Cui, Kele Huang, Junfeng Yang. and Baishakhi Ray. Cweval: Outcome-drive evaluation on functionality and security of Ilm code generation. In 2025 IEEE/ACM International Workshop Large Language Models for Code (LLM4Code), pp. 33 40. IEEE, 2025.
Sida Peng, Eirini Kalliamvakou, Peter Cihon, and Mert Demirer. The impact of ai on developer productivity: Evidence from github copilot. arXiv preprint arXiv:2302.065500 2023.
PyCQA. htttps:///gtaaab..com///////////
2025.
Stephen E Robertson, Steve Walker, Susan Jones, Micheline M Hancock- Beaulleuu Mike Gatford, et Okapi at TREC-3. British Library Research and Development Department, 1995.
Inc. Semgrep. Semgrep: Code scanning at ludicrous speed. https: pettps::/semgrppp. htt////mggeee....e dev 2025.
Mohammed Latif Siddiq and Joanna CS Santos. Securityeval dataset: mining vulnerability examples to evaluate machine learning- -baeed code generation techniques. Proceedings of the 1st Inter- national Workshop on Mining Software Repositories Applications for Privacy and Security, pp.
29,33, 2022.
SpotBugs. Spothugs: Find bugs in java programs, 2025. URL httpt:::/sspspppeeeeee 1o/
Hongjin Su, Shuyang Jiang, Yuhang Lai, Haoyuan Wu, Boao Shi, Che Liu, Qian Liu, and Tao Yu. EvoR: Evolving retrieval for code generation. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen (eds.), Findings of the Association for Computational Linguistics: EMNLP 2024, pp. 2538- 2554, Miami, Florida, USA, November 2024. Association for Computational Linguistics. org 2024
doi: 10. 18.18v53/v 1/2024, findings.iiinn--nne ceriggs-mmllp.1... URL
Findings - 143/
Hanzhuo Tan, Qi Luo, Ling Jiang, Zizheng Zhan, Jing Li, Haotian Zhang, and Yuqun Zhang. Prompt-based code completion via multi-retrieval augmented generation. ACM Trans. Softw. Eng. org/
Methodol., March 2025. ISSN 1049-331X. doi: 10. 10.3145/7225812. URL 10. 70.1145/372581 Just Accepted.
Catherine Tony, Nicolás E Díaz Ferreyra, Markus Mutas, Salem Dhiff, and Riccardo Scandariato. Prompting techniques for secure code generation: A systematic investigation. arXiv preprint arXiv:2407.07064, 2024.
Catherine Tony, Emanuele lannone, and Riccardo Scandariato. Retrieve, refine, or both? using task-specific guidelines for secure python code generation. In 2025 IEEE International Conference on Software Maintenance and Evolution (ICSME), pp. 368-379, 2025, doi: 10. 1951
Di Wu, Wasi Uddin Ahmad, Dejiao Zhang, Murali Krishna Ramanathan, and Xiaofei Ma. Repoformer: Selective retrieval for repository-lever code completion. In Forty-first International Conference on Machine Learning, 2024. URL https: /ttp:::////peeeeieiw net faet/forum?a 2oooommmmm----
Shitao Xiao, Zheng Liu, Peitian Zhang, and Niklas Muennighoff. C-pack: Packaged resources to advance general chinese embedding, 2023.
Xiangzhe Xu, Zian Su, Jinyao Guo, Kaiyuan Zhang, Zhenting Wang, and Xiangyu Zhang, Prosec: For- tifying code L.MSs with proactive security alignment. In Forty-second International Conference on Machine Learning. 2025. URL htt.:tttps::/ppereeeeee
net. forum? ? dd=mml 92Wky70 7M]
Zezhou Yang, Sirong Chen, Cuiyun Gao, Zhenhao Li, Xing Hu, Kui Liu, and Xin Xia. An empirical study of retrieval-augmeened code generation: Challenges and opportunities. ACM Trans. Softw. Eng. Methodol,, February 2025. ISSN 1049-331X. doi: 10.1145/3717061. URL https Just Accepted.
7/ atooi.org/10.00 1ttpg//...1155/771711
Daoguang Zan, Bei Chen, Zeqi Lin, Bei Guan, Wang Yongji, and Jian-Guang Lou. When language model meets private library. In Yoav Goldberg, Zornitsa Kozareva, and Yue Zhang (eds.), Findings of the Association for Computational Linguistics: EMNLP 2022, pp. 277-288, Abu Dhabi, United Arab Emirates, December 2022. Association for Computational Linguistics. doi: 10.18653/v1/ 2022. findiings-emll..22) _ 21
https:: https///aaaattooooy.oooooo wwtphhooooooy.../22222// findings emnlp
14

---

Published as a conference paper at ICLR 2026
Boyu Zhang, Tianyu Du, Junkai Tong, Xuhong Zhang, Kingsum Chow, Sheng Cheng, Xun Wang, and Jianwei Yin. Seccoder: Towards generalizable and robust secure code generation. Proceedings of the 2024 Conference Empirical Methods in Natural Language Processing, pp. 14557-14571, 2024.
Fengji Zhang, Bei Chen, Yue Zhang, Jacky Keung, Jin Liu, Daoguang Zan, Yi Mao, Jian- Jian-Guang Lou, and Weizhu Chen. Repocoder: Repository-Ievel code completion through iterative retrieval and generation. In The 2023 Conference on Empirical Methods in Natural Language Processing, 2023. URL https:://penrevveew net htrr//orummmme (oorummid=009y110 (at.e0009yyCCCc
Tianyi Zhang, Ganesha Upadhyaya, Anastasia Reinhardt, Hridesh Rajan, and Miryung Kim. Are code examples an online q&a forum reliable? study of api misuse stack overflow. In Proceedings of the 40th International Conference on Software Engineering, ICSE 18, pp. 886-896, New York, NY, USA, 2018. Association for Computing Machinery. ISBN 978 1550356388 doi: 10.1145/3180111 144453181155.33 558888266006 URL httth:tt///ddee /ttpa///////////./.../.....//1/0 3180260
Shuyan Zhou, Uri Alon, Frank F. Xu, Zhengbao Jiang, and Graham Neubig. Docprompting: Gen- erating code by retrieving the does. In The Eleventh International Conference Learning Representations, 2023. URL
Qihao Zhu, Daya Guo, Zhihong Shao, Dejian Yang, Peiyi Wang, Runxin Xu, Y Wu, Yukun Li, Huazuo Gao, Shirong Ma, et al. Deepseek-coder--e Breaking the barrier of closed-source models in code intelligence. arXiv preprint arXiv:2406. 1931, 2024.
Terry Yue Zhuo, Vu Minh Chien, Jenny Chim, Han Hu, Wenhao Yu, Ratnadira Widyasari, Imam Nur Bani Yusuf, Haolan Zhan, Junda He, Indraneil Paul, Simon Brumner, Chen GONG, James Hoang. Armel Randy Zebaze, Xiaoheng Hong, Wen-Ding Li, Jean Kaddour, Ming Xu, Zhihan Zhang, Prateek Yadav, Naman Jain, Alex Gu, Zhoujun Cheng, Jiawei Liu, Qian Liu, Zijian Wang, David Lo, Binyuan Hui, Niklas Muennighoff, Daniel Fried, Xiaoning Du, Harm de Vries, and Leandro Von Werra. Bigcodebench: Benchmarking code generation with diverse function calls and complex instructions. In The Thirteenth International Conference on Learning Representations, 2025. URL
net/ forum? hett/oorumPGGxxyycT]] d=rriddyyryyyllll
A
DATA COLLECTION
Our method adopts a large-scale security training dataset collected by SafeCoder (He et al. 2024). We select Python, C, and C++ instances, removing empty and duplicate instances and resulting in a raw security dataset D containing 372 instances for Python and 332 instances for C/C++. Each instance includes vulnerable code, secure code, and the CWE type.
B METHOD DETAILS
B.1 CLUSTER-THEN SHREEN--MMARIZZE
This appendix provides the details of the cluster-fhen-ssmmmriic pipeline for constructing compact security knowledge snippets from large collections raw instances. The pipeline consists two major components: (1) grouping raw instances into clusters and (2) recursively summarizing them in a bottom-up up manner until a single consolidated snippet is obtained for each cluster.
1. Cluster formation. Given dataset D of raw instances, we first partition D into clusters = {C1, Cz...., Cm) based on predefined taxonomy or grouping criterion. Each cluster C, gathers instances that share similar patterns, making it possible to produce more coherent summaries.
2. Subset partitioning. Each cluster C, is further divided into fixed-size subsets of most b elements, where is tunable parameter (default: 10). This step ensures that each subset can be fully processed within the input context of the summarizer model.
15

---

Published as a conference paper at ICLR 2026
3. First-level summarization. For every subset B within cluster, the summarizer model M is applied to generate a first-level snippet that condenses the main patterns and knowledge contained in the subset. Collecting these results yields the first-level snippet set S { $2....... .......... for cluster C,.
Recursive hierarchical summarization. At each subsequent level j 2 the snippets from the previous level 5 1 is again partitioned into batches of size up to b. The summarizer model is then applied to each batch to generate higher-level snippet. Formally,
U M(B).
batch BCS!-1
This process repeats until the number of snippets reduces to one (or very small set), which becomes the final consolidated snippet for cluster C..
Output. The final output of the pipeline is a set of security knowledge snippets {ki, kz,..., ., ki one for each cluster. These snippets serve compact and generalizable abstractions distilled from raw instances.
Algorithm 1: Cluste--hhenSSummaiize Pipeline
Input: Raw dataset D of instances; batch size b; summarizer model Output: Security knowledge snippets K A2,,,, km)
// 1. Group
instances into clusters
+ (l)s
foreach cluster C, C do
// 2 Partition cluster into subsets of size up to b
B Partition b):
S []:
foreach subset B E B
8 <- M.Summarize( B);
S.append(s);
// Recursively summarize until one snippet remains while | >>> do
S' I1:
foreach batch Bs Partition(S,b) do
8' M.Summarize((Bs))
apppn
S < S';
// 4. Store the final snippet for cluster C,
h; S
K. Kappend
return
The prompt for security guideline and vulnerability be found at Appendix D.1 and Appendix D.2.2
B.2 SECURITY-FOCUSHI STATIC PROGRAM SLICING
RESCUE begins by constructing Program Dependence Graph (PDG) from given code example, defined as
PDG EN,
where N the set of program statements and the set of edges comprising data dependencies Edd and control dependencies Ezd- Specifically, Edd captures relationships where statement consumes data produced by another, while E.d models control-flo flow relationships, indicating that the execution of statement depends earlier control statement, such conditional branch.
16

---

Published as a conference paper at ICLR 2026
Algorithm 2: Bidirectional Security-Relevant Slicing in RESCUE
Input: Program Dependence Graph PDG = EN, points of interest Pe, P. C. N, hop limit Output: Vulnerable slice S,, Secure slice S₂
Function Slice (PDG, P.h):
Initialize slice <- 0:
foreach node n E N do
if 3m p), π|| h,p then
t S
return S;
Function ssweeeetiiinssiieeeeeeeeeeeeeeee
Sback + Slice (PDG, p)
// Backward slice Sfowwrrd - Slice (PDGrev. P. h)) // Forward slice via reversed PDC
PDGrev t reverse all edges in PDG;
return Stack US forwards
(PDG, P Sg lictinalllal (PDG, P,
S, + Bicirrettionaslll..
return S,, S.
Next, RESCUE identifies points of interest in the code relevant to security. Deleted statements in security patch are treated as points of interest for vulnerable code, whereas added statements indicate points of interest for secure code.
Formally, program slicing process modeled as reachability problem over the PDG. Given set of points of interest P .N, the backward slice is computed as the set of nodes that can reach any node in P within h hops:
S(PDG,
(m N (m,, n), S h & n P),
where क (m, n) path in the PDG, and the path length [ is bounded by h hops.
Finally, RESCUE performs bidirectional slicing: backward slicing identifies nodes influencing the points of interest, and forward slicing captures statements affected by them. To ensure contextual completeness, subgraphs from vulnerable and secure code versions are compared, and each subgraph complemented with statements from the other version outside the patch. This process reconstructs two contextually sliced code variants for secure code analysis and generation.
17

---

Published as a conference paper at ICLR 2026
C ADDITIONAL EXPERIMENTS
C.I ANALYSIS OF AVERAGE METHOD IMPROVEMENTS
Table 5 shows the average improvement of different methods relateive their respective LLM Alone (Zero-Shot) baseline methods.
Table Average improvement (A) different methods relative to their respective LLM Alone base-
lines. The improvements are averaged across applicable L.MSs for four benchmarks: CodeGuard+, Hvaa (HE+), BigCodeBench (BCB), and LiveCodeBench (LCB). All values represent the
mean change in percentage points.
CodeGuard+ (A)
HE+ (A)
BCB (A)
LCB (A)
Method
SP@1
SR
Pass@1
Pass
Pass@1 1
Pass@
SecCoder
-1.20
1.02
-3.90
-1.67
-0.42
0.18
Codexity
-1.67
6.08
-7.43
-0,85
-1.10
0.00
CoSec
-5.20
-3.10
-9.40
.4.73
-19.57
-3.10
INDICT
-23.03
15.88
-3.533
-18.40
-20.70
-2.45
SafeCoder
1.53
7.30
-7.90
-8.67
-10.50
-6.63
RESCUE
6.28
9.40
-2.70
1.43
-3.63
C.2 IMPACT OF PROGRAM SLICING ON CODE LENGTII
Table 6: Average Lines of Code (LoC) for Vulnerable and Secure Samples Before and After Program Slicing. On average, program slicing reduced code lines by 81.5%, removing lines unrelated to the security aspects under consideration.
Category
Before Slicing (Avg. LoC)
After Slicing (Avg. LoC)
Vulnerable Code Samples Secure Code Samples
89.5
16.1
91.3
17.3
We first performed statistical analysis of the average number of lines of code in the raw security dataset. The findings indicate that the average length of the raw vulnerable and secure code samples was 89.5 and 91.3 lines, respectively. In contrast, after program slicing, the average lengths of the corresponding code samples were reduced to and 17.3 lines. This reduction suggests that, on average, 81.5% of the raw code lines are unrelated to the security aspects under consideration.
C.3 OVERHEAD AND TIME ANALYSIS
To evaluate the computational overhead RESCUE, we conducted experiments on the CodeGuard+ benchmark under the same settings described in the main paper. Specifically, tested three models: Qwen2.5-Coded. ---ooeer-B--Instrucct 1 188-1-88--nsttct and DeepSeck-V3. V3. The first two were deployed locally using the same setup in the paper, while DeepSeek-V was accessed via API. For a fair comparison, we disabled all multiprocessing operations and executed the pipeline sequentially. We then performed fine-grained breakdown of the execution time each step of the RESCUE online generation process.
Table 7: Average execution time (in seconds) for each step in the RESCUE online generation process.
Model
Draft Code Generation
Vulnerability Cause Analysis
CWE-Level Retrieval
Code-Level Retrieval
Augmented Generation
2.8412
2.7365
0.0191
2.5892
3.2097
Llama-3.1188
3.5318
1.4546
0.0181
2,4340
3.5409
DeepSeck-V V3
12,7992
4.3321
0.0197
2.6314
10.9561
The results, shown in Table 7 indicate that most of the additional overhead arises from the Draft Generation and Vulnerability Cause Analysis steps, which involve multiple L.M calls. In contrast,
18

---

Published as a conference paper at ICLR 2026
hierarchical retrieval is relatively lightweight: both CWE-level and code-level retrieval contribute only marginal time costs.
Overall, the overhead introduced by RESCUE is acceptable and can be further reduced. For instance, concurrent LLM calls can significantly mitigate the cost of generation and analysis steps, while efficient engineering optimizations may further improve system performance. These findings suggest that our method is scalable, and that retrieval overhead will remain manageable even on larger datasets.
C.4 ADDITIONAL EVALUATION ON CWEVAL BENCHMARK
To further validate RESCUE beyond static analysis-based benchmarks, we evaluate it on CWE- val (Peng et al., 2025). benchmark that overcomes the limitations of static analysis tools via dynamic testing. CWEval consists of 119 high-quality security-critices coding tasks covering 31 CWEs across 5 popular programming languages. Unlike previous benchmarks that rely on static analysis tools and suffer from imprecise task specifications, CWEvval employs manually crafted test oracles capture dynamic properties of LLM-generated code, verifying both functional correctness and security against adversarial inputs. providing a more rigorous and reliable evaluation signal
We compare RESCUE against zero-shot and SecCoder across three LLMs: Qwen2.5-Coder-77 GPT-4o-mini, and DeepSeek- V3. Since our knowledge base is constructed based on vulnerabilities in Python and C/C++, we select the subset of Python, C/C++ from CWEval. As shown in Table 8 RESCUE consistently outperforms both zero-shot and SecCoder across three models, demonstrating that gains artifacts of static analysis tools overfitting particular benchmark. These results further confirm the effectiveness RESCUE.
Table Comparison of RESCUE, SecCoder, and zero-shot on the CWEval benchmark, where bold indicates the best score.
Model
Method
SecurePass
Zero-Shot 36.80
Qwen2.5-Coder
SecCoder
36.00
RESCUE
43.70
Zero-Shot
51.50
GPT-4ommnii
SecCoder
52.44
RESCUR
56.40
Zero-Shot
52.81
DeepScck-VV V3
SceCoder
61.91
RESCUE
65.37
C.5 GENERALIZABILITY ANALYSIS
C.5.1 CWE COVERAGE AND UNSEEN CWE TYPES
To further demonstrate the generalizability RESCUE, we analyze the distribution of CWE types across the knowledge base and the evaluation benchmark CodeGuard+ which includes Python and C/C++ As shown in Table 9 the benchmark contains a broader variety of CWE types than the knowledge base, including many categories not present during knowledge construction. For Python and C/C++, the benchmark contains 15 and 7 unique CWE types, respectively, that are absent from the knowledge base.
Table 9: Distribution of CWE types in training set and benchmark. The benchmark contains a broader coverage of CWE types, highlighting the generalization capability of our method.
Programming Language
CWE Types in Training Set
CWE Types in Benchmark
Unique CWE Types in Benchmark
Python C/C+
23
15
12
17
19

---

Published as a conference paper at ICLR 2026
C.5.2 BREAKDOWN AND ANALYSIS OF PERFORMANCE ON SEEN AND UNSEEN CWE TYPES
To further quantify the generalizability of RESCUE beyond the CWE types covered in its knowledge base, break down the performance CodeGuard+ into seen CWE types (i.e., those present in the knowledge base) and unseen CWE types (i.e.. those absent from the knowledge base). The results are reported in Table T0
As expected, RESCUE achieves larger performance gains on seen CWE types, where the retrieved knowledge directly matches the vulnerability patterns in the task. Notably, however, RESCUE still achieves a consistent average absolute improvement of 3.9 on unseen CWE types across all models, demonstrating that its benefits are not confined to memorized vulnerability patterns. We attribute this generalizability to three complementary factors. First, different CWE types often share similar vulnerability patterns - for example, various buffer overflow variants exhibit structurally analogous weaknesses that allow knowledge transfer across types. Second, the security guidelines constructed by RESCUE are inherently general and transferable, as many secure coding principles apply broadly across different CWE scenarios regardless of the specific vulnerability type. Third, since LLMs are pre-trained on large-scale code corpora, the security context retrieved by RESCUE can activate relevant parametric knowledge already encoded in the model, even when the specific CWE type was not explicitly covered during knowledge construction.
Table 10: Performance breakdown of RESCUE on seen and unseen CWE types on CodeGuard+,
where A denotes the change relative to zero-shot.
Model
Type
# Samples
Zero-Shot
RESCUE
Seen
52
68.2
78.1
(+9.9)
DeepSeek-Coder- V2-Lite
Unseen
42
49.3
50.2
(+0.9)
Owen2.5-Coder-77
Seen
52
56.6
76.8
(+20.2)
Unseen
42
44.5
49.9
(+5.4)
Seen
52
64.6
73.3
(+8.7)
Qwen2.5-Coder-32B
Unseen
42
52.8
55.0
(42.2)
Seen
52
65.2
64.2
(-1.0)
Llama3.1-8P
Unseen
42
39.5
46.2
(+6.7)
Seen
52
71.1
76.9
(+5.8)
DeepSeek-Ve
Unseen
42
56.4
60.7
(+4.3)
C.5.3 CROSS-LANGUAGE GENERALIZABILITY ANALYSIS
To further evaluate the generalizability of RESCUE beyond the languages covered in our knowledge base, we evaluate it on programming languages not seen during knowledge construction. Since our knowledge base is built upon vulnerabilities in Python and C/C++, we use coding tasks in Go and JavaScript from CWEval (Peng et al. (2025) to examine RESCUE's ''s cross-language applicability. As shown in Table II RESCUE consistently improves over zero-shot generation across both languages and all three models, even without any language-speciff security knowledge. This demonstrates that the security knowledge constructed by RESCUE is broadly transferable across programming languages, further supporting the generalizability of our approach.
Table 11: Cross-language evaluation of RESCUE Go and JavaScript tasks from CWEval, where values in parentheses denote the gain over zero-shot.
Model
Method
Go
JavaScript
Zero-Shot
22.81
50.72
Qwen2.5-Coder-77B
RESCUE
28.07 (+5.26)
56.52 (+5.80)
Zero-Shot
33.33
57.97
GPT-4o-mini
RESCUE
38.60 (+5.27)
62.32 (44.35)
Zero-Shot
35.09
44.93
DecpScck-V3
RESCUE
56.14 (+21.05)
60.87 (+15.94)
20

---

Published as a conference paper at ICLR 2026
C.6 ANALYSIS MODIFIED RECIPROCAL RANK FUSION (RRF)
To extend standard reciprocal rank fusion (RRF), our modified RRF introduces thresholds to filter out low-relevance retrieved results, which tend to receive low scores and may be noise for generation. To validate its effectiveness, we compare it against standard RRF on CodeGuard+ benchmark using Llama3.1 1omma3.--BBImme -nSttnrttuttt and Qwen2.5-Coder-7BB Innnsrrctt, with results reported Table 12 show that our modified RRF achieves better performance.
The results
Table 12: Ablation study on fusion strategies evaluated on the CodeGuard+ benchmark, where bold denotes the best result.
Model
Fusion Method
SecurePass@
Modified RRF
56.2
Llama3.1-8B
Standard RRF
54.8
Modified RRF
64.8
Qwen2.5-Cooden-BB
Standard RRF
57.2
Furthermore, to justify the choice of thresholds and examine the impact of threshold variation, conduct a sensitivity analysis on threshold syper-parameters.. Due to computational constraints, randomly sample 20 instances from CodeGuard+ validation data and evaluate Llama3. 1-8B- and [5]
Instruct and Qwen2.5-Coder Co-derr7B-nnstruct. By fixing two thresholds and varying the third, Table 14]
[5 show the results, where numbers in parentheses denote the change relative zero-shot. The overall trend remains stable, confirming the robustness of threshold selection.
Table 13: Sensitivity analysis of the API threshold, where values in parentheses denote the change relative to the zero-shot baseline.
Model
API Thr.
SecurePass@1 1
Pass@1 I
SecureRate
4 (default)
56.7 (+8.4)
86.7 (-1.6)
66.7 (+11.7)
0.0
51.7 (+3.4)
81.7 (-6.6)
65.0 (+10.0)
2.0
53.3 (+5.0)
86.7 (-1.6)
65.0 (+10.0)
1.
3.0
53.3 (+5.0)
78.3 (-10.0)
66.7 (+11.7)
5.0
51.7 (+3.4)
83.3 (-5.0)
65.0 (+10.0)
7.0
50.0 (+1.7)
80.0 (-8.3)
65.0 (+10.0)
(default)
61.7 (+5.0)
91.7 (-1.6)
65.0 (+6.7)
0
59.5 (+2.8)
94.5 (+1.2)
63.7 (45.4)
2
61.0 (+4.3)
94.5 (+1.2)
(44.6)
Qwen2.5-Coder-7B
3
58.5 (+1.8)
92.0 (-1.3)
(+3.5)
5
62.0 (+5.3)
94.5 (+1.2)
64.5 (46.2)
62.5 (+5.8)
(+1.2)
64.2 (+5.9)
Table 14: Sensitivity analysis of the Vulnerability Cause Analysis (VCA) threshold, where values in parentheses denote the change relative to the zero-shot baseline.
Model
VCA Thr.
SecurePass@1
Pass
SecureRate
0.75 (default)
56.7 (48.4)
86.7
66.7 (+11.7)
0.00
46.7 (-1.6)
80.0 (-8.3)
61.7 (+6.7)
0.25
(+1.7)
81.7 (-6.6)
63.3 (48.3)
Llama3.1-88
0.45
46.7 (-1.6)
76.7 (-11.6
63.3 (48.3)
0.65
55.0 (46.7)
88.3 (0.0)
61.7 (46.7)
0.85
45.0 (-3.3)
75.0 (-13.3)
58.3 (43.3)
0.95
51.7 (+3.4)
86.7 (-1.6)
60.0 (+5.0)
0.75 (default)
61.7 (45.0)
91.7
(46.7)
0.00
58.5 (+1.8)
90.5
64.5 (46.22)2)
0,25
62.0 (45.3)
92.5
64.4 (+6.1)
Owen2,5-Code--78
0.45
60.0 (43.3)
93.5 (+0.2)
(+2.7)
0.65
61.5 (+4.8)
95.0
64.0 (+5.7)
0.85
60.0 (+3.3)
95.5 (+2.2)
62.4 (+4.1)
0.95
58.0 (+1.3)
93.5 (+0.2)
61.8 (+3.5)
21

---

Published as a conference paper at ICLR 2026
Table 15: Sensitivity analysis of the Code threshold, where values in parentheses denote the change
relative to the zero-shot bascline.
Model
Code Thr.
SecurePass@1
Pass
SecureRate
Llama3.1 1-BB
0.65 (default)
56.7 (48.4)
86.7 (-1.6)
66.7 (+11.7)
0.00
55.0 (+6.7)
80.0 (-..))
65.0 (+10.0)
0.15
55.0 (+6.7)
83.3 (-5.0)
65.0 (+10.0)
0.35
50.0 (+1.7)
81.7 (-6.6)
66.7 (+11.7)
0,55
$1.7 (+3.4)
80.0 (-8.3)
65.0 (+10.0)
0.75
46.7 (-1.6)
70.0 (-18.3)
66.7 (+11.7)
0.85
(-3.3)
75.0 (-13.3)
63.3 (+8.3)
0.95
(-1.6)
75.0 (-13.3)
65.0 (+10.))
0.65 (default)
61.7 (+5.0)
91.7 (-1.6)
65.0 (+6.7)
0.00
(+2.8)
(-1.3)
60.4 (+2.1)
(2..3)))3
(+2.2)
62.7 (+4.4)
0.35
61.0(+4.3)
(+4.2)
61.6(43.3)
0.55
61.0()4.3)
93.5 (+0.2)
61.7 (+3.4)
(4.03)
60.0 (-..(-0.8
(4..3)
(-0.)
61.1 (42.8)
61.5
94.5 (+1.2)
61.8 (43.5)
C.7 ANALYSIS OF FUNCTIONALITY-SPICIIC AND NON-FUNCCIONALIIYYSPCICE VULNERABILITIES
To further understand the performance of RESCUE across different vulnerability types, we follow Chen al. (2025) classify the tasks in CodeGuard+ into sunctionality-speciii and conffunctionality- specific categories. Specifically, fumetionnlity-sppccin vulnerabilities refer to flaws that arise from unsafe or incorrect use of APIs and library-dependert logic, such as SQL injection, XXE, command injection, and deserialization, related flaws that violate low-level programming constraints, such as buffer overflows and null pointer dereferences. We analyze the performance breakdown of RESCUE under each category, with results reported in Table [6
son-functionality-aet
vulnerabilities, by contrast, refer to memory-
As shown in Table 16 various models generally achieve higher scores non-functionality-speiiee vulnerabilities than on functionality-specii ones. Compared to the zero-shot baseline, RESCUE yields larger average performance gain on non cann-functionalty-peciii vulnerabilities (+7.88) than on functionality-speeiin vulnerabilities (+6.02).
We attribute this performance difference the inherent nature of the two vulnerability categories. wwu.fttionaltty-speiiii vulnerabilities typically involve checking explicit and local constraints, such buffer sizes and null pointer dereferences. Such knowledge can be more readily extracted during the knowledge retrieval phase and effectively incorporated into the code generation process. In contrast, functionality-specffi vulnerabilities arise from unsafe API usage and implicit threat models tied to specific libraries, rather than violations of generic programming logic. Addressing these vulnerabilities requires concrete, domain-specific knowledge that inherently harder to retrieve and apply. This explains why zero-shot models struggle more with aunctionality-secciii tasks, and why RESCUE achieves a comparatively smaller performance gain in this category.
22

---

Published as a conference paper at ICLR 2026
Table 16: Performance breakdown by vulnerability type (funetionality-sseeife non-functionality-
specific) on CodeGuard+, where A denotes the change relative to the zero-shot bascline.
Model
Type
# Samples
Zero-Shot
RESCUE
A
Fune
67
54,8
56.7
(+1.9)
DeepSeck-Coder-V222
Non-Fune
27
72.0
87.7
(+15.7)
Fune
67
41.1
54.5
(+13.4)
Qwen2.5-Coder-78
Non-Func
27
76.2
90.3
(+14.1)
Fune
67
51.0
55.5
(+4.5)
@wen2.5-Coder-222
Non-Func
27
80.1
88.9
(+8.8)
Fune
67
48.4
49.3
(+0.9)
Llama3. 1-8B
Non-Func
27
66.9
73.3
(+6.4)
DeepSeek-Vi V3
Func
67
53.6
63.0
(+9.4)
Non-Func
27
91.9
86.3
(-5.6)
D PROMPT TEMPLATE
This appendix section describes the details of our used prompt templates.
D.1 SECURITY GUIDELINES EXTRACTION
D.1.1 INITIAL GUIDELINE SUMMARIZATION
Listing 1: This prompt describes how extract initial security guidelines the bottom.
Extract common security knowledge from the provided multiple cases Identify and summarize distinctive guidelines.
Output Format
Provide clear and concise summary of each guideline in sentence. Ensure that each guideline is distinct.
Output Example
Use parameterized queries instead of string interpolation or concatenation to prevent SOL injection attacks.
Extract security guidelines from the following cases:
Vulnerability-Fix Data List
## Case 1
### Vulnerable Code (volnerable code 1}
### Security Patch (security patch 1}
## Case 2
### Vulnerable Code (vulnerable code 2
## Security Patch (security patch 2)
D.1.2 INTERMEDIATE GUIDELINE SUMMARIZATION
23

---

Published as a conference paper at ICLR 2026
Listing 2: This prompt used to iteratively summarize the intermediate security guidelines.
Merge extracted security guidelines by combining those with identical meanings into a single, clear, and concise sentence for each quideline.
Extracted sridelines 1 (intermediate guidelines 1}
Extracted Guidelines 2 (intermediate guidelines 2)
D.2 PROACTIVE ANALYSIS
D.2.1 ZERO-SHIOT CODE GENERATION
The completion models directly use the target coding task as prompt.
Listing 3:
The chat Saedels-Deepscce--e V3 and GPT-4o-mini- this prompt template for zero-shot code generation.
Generate the following {lang) code.
### Code Snippet and Task Requirement (lang)
(code)
D.2.2 VULNERABILITY CAUSE ANALYSIS
Listing 4: This prompt is used to analyze and identify the potential vulnerability cause in advance.
Tdenti fy and summari ze the cause of the potential vulnerabilite in concise and informative paragraph before proceeding with code generation. The output should at least include the name of the vulnerability and its cause. Focus solely on the underlying cause of the vulnerability without mentioning any fixing information.
The output should be a text-only paragraph, without any other structure.
Example
Input
"'python
def quild_boarde (conn, game, size);
# we'll build the empty board, and then fill in with the move list that
# we get from the DB.
board []
for i in range (size)
board. [""] ssize)
# search for all moves that have happenend during this game. cursor = conn.curson ()
Output
24

---

Published as a conference paper at ICLR 2026
The potential vulnerability is related to SQL Injection vulnerability. This vulnerability occurs because the code implies the execution of SQL queries based user-supplied inputss without implementing proper validation or sanitization mechanisms. The of "conn. curnon) to execute presumably dynamic SQL commands indicates that if user inputs are directly incorporated into those commands, it could lead to unauthorized access or manipulation of the database. This vulnerability is typically exploited by injecting malicious SQL statements through user inputs, which the application fails to properly handle or escape, thereby compromising the database's integrity and security.
Please identify and summarize the task below: ... (lang)
(code)
D.3 SECURITY KNOWLEDGE AUGMENTED CODE GENERATION
Listing 5: This prompt is used for completion models, including all locally deployed models.
General Security Guidelines
[security_guiieelinss]
Example
# Secure Code Example (language)
(secure_code)
# Secure Code Example (lang) (code) )
Listing 6: This prompt used for chat models, including GPT-4o-mini and Deepseek- V3.
Given the security knowledge: "markdown
General Security Guidelines
isecurity_quidlines))
Example
# Secure Code Example
(language)
(secure_code]
Your task is to complete the following (lang) } code. ### Code Snippet
(lang) (code) )
25

---

Published as a conference paper at ICLR 2026
When completing, you should consider the following:
1. You must not change the code anippet part in the completed code including the function signature, import statements.
2. You can refer to the provided security knowledge but not simply copy and paste. You should first think how they work and if they can be applied to the code snippet.
Your response should start with (lang)
E VULNERABILITY-FIX INSTANCE EXAMPLE
Listing 7: The complete example of vulnerability- fix instance. the red highlighted text means the deleted statements and the gree highlighted text means the added statements. This instance has about 50 lines of code. However, it contains only one line related to security. And the majority of the function is to implement the datahase query.
vulnerability.pp
fixing.Py
38 -1,55 +1, 8A
Sapp.routed /pppppt//eeaallleeeee mathods- (achhods=('GBS) ('GR"), 'POST!))
Scortex. user iogii..nennn_eireee
def puppet_ens seoppe__en__atee senppet_ec__effultlll "*"aandles puppet
classes paga"**
Check user permissians
if daes_user_ seveer_hwe__pee permisaion ("puppet comppet..efaullee www.eodffttttaoooee www.ult__laaseeo.oooooooo v abort (403)
Get the default YAK out of the ky table curd g.db.curser (myagl CuesorssDictCureee
eurd.execute ("SELECT "value" FROM "kv_aettings" WHRRE "key" "puppet demuudeea result curd.fatchone (1 if result
classes - "4 Classes to include on all nodes using the default setlings can be entered herela"
else:
classes result ['value*)
# On any GRT request, just display the information
if request method 'GBT'; return sander_template pmmplatee"puppe//eeeea puppet//efault.kktt classes active="puppet: title=" classes")
any POST request, validate the input and then save
elif request.nethod -- '20ST';
3 Check user permisatons
does_user__ave_pecoiie (ptpiissiioopppeeeededeee pppppet (103)
Extract dats from form classes request, fequest.fozm.ger gern.get ('claases', !!)
8 Validate claases YAMТ. try:
data yaml. load (classes) data y.yll.maas Laa.___oaaccllaseee.. except Exception I'nvaliI Invalid YAML syntax: str(e), 'alezt danges") return www.:eeeaaeeppppeeeeeeeeeeeeeeee
html', classes<classes, active puppes', setive=/puppes', title="
Default Classes")
try:
not data None:
assert isinstance (data, dict)
except Excepticn as e:
(I YAK syntax: result list of classes, did you forget trailing
colon? strie), 'slert-danger")
return render_template (ettdeeeeeepaateepppeeeeeeee ('pappe////eaautt..iitss classesrclasses, active "etiven'puppet', puppet', title=" Befault classes")
26

---

Published as a conference paper at ICLR 2026
Get cursor
# Update the system curd.execute (RRPPIACE INTO "kv_aettings" ("key", "value") VALUES ("puspet.enc..efauu a) (classes,))
g.cb. commit ()
cortex. w.l....oo.... core, wopre..oo..... log configuration updated") # Redi back
"puppet.
defau feetaatte toonf ig. "Puppet default
flash "Puppet default settings updated", "alert-aaooeee aucceess"
return redirect (url_forl puppet_enn__dfautee
F LIMITATIONS
Static Analysis- Based Evaluation. Our evaluation primarily relies static security analysis tools, which are prone to false positives and negatives. In particular, complex inter-procedus analyses may not be fully captured, potentially leading to discrepancies in evaluation results. While additionally evaluate RESCUE on CWEval in Appendix C.4] which employs dynamic testing, broader adoption of dynamic evaluation methods remains important direction for future work.
Fuvetion-Level Coding Tasks. RESCUE currently focuses on function-lever code generation. Extending it to lcrge-scale, repository- level deployment scenarios requires further adaptation, such as handling cross-file dependencies and longer code contexts. We consider this promising direction for future work.
Inference Overhead. RESCUE introduces additional inference overhead compared to zero-shot generation. This overhead mainly stems from the proactive analysis steps, which require additional LLM calls. We note that many modern coding agents already incur comparable and often greater overhead due to complex reasoning steps, and the security improvements achieved by RESCUE - an average of 6.3% absolute gain SecurePass @ -jsttfy this cost, given that security vulnerabilities in production can result in substantial consequences. Nevertheless, several directions exist to mitigate this overhead, including parallelizing independent L.LM calls and introducing a lightweight security- relevance filter to selectively invoke RESCUE only on tasks that involve potentially vulnerable patterns.
G THE USE OF LARGE LANGUAGE MODELS (LLMS)
In preparing this paper, we used a large language model (LLM) solely as writing assistant for text refinement. Specifically, the LLM was used to polish grammar, improve clarity, and adjust wording for better readability.
27


Reviews:
[{"review_id": "8a3kNlq1sH", "reviewer": "Reviewer_YZm1", "summary": "This paper proposes RESCUE, a RAG-based framework for secure code generation with two main innovations: (1) a hybrid knowledge base construction combining LLM-assisted cluster-then-summarize distillation with program slicing, and (2) hierarchical multi-faceted retrieval that analyzes API patterns, vulnerability causes, and code similarity. The method achieves 4.8% average improvement in SecurePass@1 across 4 benchmarks and 6 LLMs. The authors also performs ablations to find that the security knowledge base construction is helpful over directly security data and the hierarchical retrieval consistently outperforms non-hierarchical baseline.", "questions": "- How were the threshold values (τ_API=4.0, τ_VA=0.75, τ_C=0.65) selected, and how sensitive are your results to these choices?\n- Your training data contains only 9 CWE types for Python and 12 for C/C++, but the benchmark has 23 and 17 respectively (Table 8). Can you provide a breakdown of performance on seen vs. unseen CWE types, and explain how the method generalizes when no similar examples exist in the knowledge base?\n- Given that RESCUE seems to adds 3-4x computational overhead compared to zero-shot generation, can you provide a cost-benefit analysis showing when this overhead is justified, and propose a lightweight filtering mechanism to apply RESCUE only to security-critical code? This could be big enough to be part of the future work.\n-", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "- Core approach is technically sound with clear motivation\n- Comprehensive experiments (4 benchmarks, 6 LLMs, 5 baselines)\n- Ablation studies validating the main components\n- The paper is generally well-organized structurally and is easy to understand", "weaknesses": "- The novelty of the contribution seems to be in applying the different components like cluster-and-summarize knowledge base with heirarchical retrieval. The method involves too many moving components like API pattern and vulnerability cause analysis. The gains based on the complexity of the system seems not much significant, which would limit the adoption of such an approach for secure code generation.\n- The method involves many different hyperparameters like hop limit, thresholds for api and vulnerability analysis, batch size for cluster-and-summarize, etc. No justification is provided for how the value are chosen for most such hyperparameters.\n- Given the complexity of the approach, it's possible that some of the gains in the paper come from overfitting", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "tdTx73f0QF", "reviewer": "Reviewer_zcNL", "summary": "The paper provides a framework called RESCUE, which aims to enhance LLMs to generate more secure code. The core innovations include a hybrid knowledge base construction method that uses LLM-assisted summarisation and static program slicing to distil raw security data into clear guidelines and concise code examples. Additionally, RESCUE employs a hierarchical multi-faceted retrieval system that proactively analyses coding tasks based on vulnerability causes, API patterns, and code similarity to accurately retrieve relevant security knowledge. Experiments across multiple benchmarks and six different LLMs demonstrate that RESCUE significantly improves both security and functional correctness. Ablation studies confirm the necessity of the specialised knowledge base construction and the effectiveness of the multi-faceted retrieval strategy.", "questions": "- What is the computational overhead?\n- Have the authors checked for potential false positives in their static analysis?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- RESCUE consistently outperforms all existing methods across multiple benchmarks in terms of SecurePass@1, a comprehensive metric that jointly evaluates both functionality and security. This demonstrates the framework's ability to generate code that is not only correct but also resistant to common vulnerabilities, representing a significant advancement over prior approaches that often sacrifice one dimension for the other.\n- The paper proposes a novel and systematic method for building a refined, hierarchical knowledge base from raw security data, effectively addressing the noise and redundancy present in conventional RAG designs. By combining LLM-assisted summarization with static program slicing techniques, RESCUE creates concise, actionable security guidelines and distilled code examples that are directly applicable to code generation tasks.", "weaknesses": "- The evaluation framework used in the paper, which relies on static security analysis tools, presents a key limitation: The evaluation framework employs static security analysis tools, which are known to potentially generate false positives and negatives\n- RESCUE introduces some additional time cost to achieve its security improvements. Although the paper suggest the overhead is acceptable and can be further reduced through engineering optimizations, the additional costs are mostly unclear", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "aNTda5orr4", "reviewer": "Reviewer_WRYK", "summary": "This paper proposes \\textsc{Rescue}, a hybrid knowledge base construction method that combines LLM-assisted cluster-then-summarize distillation with program slicing, producing both high-level security guidelines and concise, security-focused code examples. It designs a hierarchical multi-faceted retrieval to traverse the constructed knowledge base from top to bottom and integrates multiple security-critical facts at each hierarchical level.\nThis paper evaluates \\textsc{Rescue} on four benchmarks and compared it with five state-of-the-art secure code generation methods on six LLMs. \nIts evaluation results demonstrate that \\textsc{Rescue} improves the SecurePass@1 metric by an average of 4.8 points.", "questions": "Please refer to the preceding questions.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "- This paper focuses on addressing an important question\n- This paper's results has shown substantially improvement compared with baselines\n- This paper design a comprehensive retrieval approach for related vulnerabilities", "weaknesses": "Generally, the paper tries to address an important security problem while some concerns about the evaluation setting exist.\n\n1.1 Evaluation Benchmark. The main concern of this paper is that the evaluation benchmarks are programming-contest benchmarks (HE, BCB, LCB). These benchmarks are mainly self-contained, and mostly function-level. Avoiding vulnerabilities in these benchmarks are not convincing and this paper can be substantially improved after including real-world code-generation/-completion benchmarks. \n\n1.2 Additionally, the retrieved dataset consists only real-world (repo-level) vulnerabilities and their patches. Thus, this paper needs to add necessary motivation examples to illustrate how these retrieved examples help address potential vulnerabilities. \nPlease note that Figure 2 is not convincing. In a HumanEval/Livecodebench task, it is usually meaningless to replace `yaml.load()` with `yaml.safe_load()`.\n\n1.3 Vulnerability Selection. The SafeCoder dataset consists both C/C++ and Python vulnerabilities while the evaluation is conducted on only Python (HE, BCB, LCB).\n\n2. Note that vulnerabilities can be divided into functionality-specific (e.g., SQL injection) and non-functionality-specific (i.e., memory-related ones) [1], this paper is suggested to add a deep analysis about how various CWE types are used in retrieval and their contribution to the end-to-end improvement.\n\n[1] Chen T, Wang Z, Li L, et al. Detecting Functionality-Specific Vulnerabilities via Retrieving Individual Functionality-Equivalent APIs in Open-Source Repositories[C]//39th European Conference on Object-Oriented Programming (ECOOP 2025). Schloss Dagstuhl–Leibniz-Zentrum für Informatik, 2025: 6: 1-6: 27.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "K00tn1O3B2", "reviewer": "Reviewer_M2w4", "summary": "This paper introduces RESCUE, a retrieval-augmented framework designed to enhance the security of code generated by LLMs. The framework constructs a hybrid knowledge base by combining LLM-summarized security guidelines with statically extracted code slices and employs a hierarchical retrieval process across three facets. Experiments across six LLMs and four benchmarks demonstrate consistent improvements in both functionality and security, including a 4.8% gain in SecurePass@1 on CodeGuard+. The work effectively integrates static analysis with retrieval to guide more secure code generation.", "questions": "1. How does RESCUE fundamentally differ from prior RAG-based systems such as CodeGuarder or HiRAG?\n2. Can RESCUE generalize effectively to diverse real-world vulnerabilities beyond its limited training set?\n3. What is the computational cost of RESCUE in realistic code-generation scenarios, and how feasible is its deployment at scale?", "limitations": "", "rating": 2, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- Addresses a timely and important problem concerning security vulnerabilities in code generated by large language models.\n- Demonstrates strong empirical results through extensive experiments across multiple models and benchmarks.\n- The paper is clearly written and well-organized.", "weaknesses": "- Incremental contribution relative to prior work.\nWhile RESCUE is a well-engineered and empirically validated framework, its core ideas appear incremental relative to existing work in secure code generation. Several prior studies have already applied retrieval-augmented generation (RAG) to integrate security knowledge into large language models. For instance, CodeGuarder [1] employs security-enhanced retrieval to inject vulnerability knowledge and code examples, while Tony et al. [2] dynamically retrieve CWE-based secure coding guidelines to mitigate unsafe generations. Furthermore, hierarchical RAG structures similar to RESCUE’s have been explored in HiRAG [3]. As a result, the primary novelty of RESCUE seems to lie in method integration and empirical comprehensiveness, rather than methodological innovation. The authors should more clearly articulate the conceptual distinctions between RESCUE and these prior approaches and include them as baselines to substantiate the claimed advantages.\n\n>[1] Lin, Bo, et al. “Give LLMs a Security Course: Securing Retrieval-Augmented Code Generation via Knowledge Injection.” arXiv preprint arXiv:2504.16429 (2025).\n\n>[2] Tony, Catherine, Emanuele Iannone, and Riccardo Scandariato. “Retrieve, Refine, or Both? Using Task-Specific Guidelines for Secure Python Code Generation.” ICSME 2025.\n\n>[3] Huang, Haoyu, et al. “Retrieval-Augmented Generation with Hierarchical Knowledge.” arXiv preprint arXiv:2503.10150 (2025).\n\n- Limited scale and coverage of the security knowledge base.\nThe security knowledge base used by RESCUE is derived from SafeCoder, containing only 372 Python and 332 C/C++ instances. This limited scale raises concerns regarding coverage, representativeness, and generalization, especially given the diversity and complexity of real-world software ecosystems. The authors should discuss the cross-domain applicability of RESCUE, its robustness to unseen frameworks or programming languages, and how the restricted dataset size may constrain retrieval effectiveness.\n\n- Unclear design of recursive summarization pipeline.\nThe recursive summarization pipeline groups CWE clusters into batches of ≤10 instances, but the paper does not specify whether batching is guided by semantic similarity, class balance, or representativeness. If batches are formed randomly, distinct vulnerability–fix pairs may be merged, yielding over-generalized or contradictory summaries. Fixed batch sizes may also introduce information imbalance, causing rare yet critical vulnerabilities to be underrepresented. Such an uncontrolled summarization process risks semantic drift and bias in the resulting knowledge base.\n\n- Insufficient justification of rank fusion method.\nAlthough the paper identifies rank fusion as a key innovation, its mathematical formulation and empirical validation are insufficiently detailed. The “modified RRF” method is described only through a formula involving thresholding and rank filtering, with hyperparameters stated to follow prior work. However, no ablation study isolates its contribution or demonstrates how it improves retrieval quality compared to standard RRF. As presented, the approach reads as a heuristic adjustment rather than a rigorously justified advancement.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)