mlsanityData to 14 Oct 2026

A Systematic Evaluation of Parameter-Efficient Fine-Tuning Methods for the Security of Code LLMs

arXiv 2509.12649 ↗First posted 16 Sep 2025cs.CR cs.AIcited by 0

Not on the map. Why?

Abstract (arXiv)

Code-generating Large Language Models (LLMs) significantly accelerate software development. However, their frequent generation of insecure code presents serious risks. We present a comprehensive evaluation of seven parameter-efficient fine-tuning (PEFT) techniques, demonstrating substantial gains in secure code generation without compromising functionality. Our research identifies prompt-tuning as the most effective PEFT method, achieving an 80.86% Overall-Secure-Rate on CodeGen2 16B, a 13.5-point improvement over the 67.28% baseline. Optimizing decoding strategies through sampling temperature further elevated security to 87.65%. This equates to a reduction of approximately 203,700 vulnerable code snippets per million generated. Moreover, prompt and prefix tuning increase robustness against poisoning attacks in our TrojanPuzzle evaluation, with strong performance against CWE-79 and CWE-502 attack vectors. Our findings generalize across Python and Java, confirming prompt-tuning's consistent effectiveness. This study provides essential insights and practical guidance for building more resilient software systems with LLMs.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 30 of its 50 references that are in the map. First posted on arXiv 16 Sep 2025.

Builds on

30 of 50 references.

References · 30

  1. 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,380
  2. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  3. 2021Evaluating Large Language Models Trained on Codecited by 8,320
  4. 2021Prefix-Tuning: Optimizing Continuous Prompts for Generationcited by 3,915
  5. 2021The Power of Scale for Parameter-Efficient Prompt Tuningcited by 3,795
  6. 2023QLoRA: Efficient Finetuning of Quantized LLMscited by 3,418
  7. 2023Code Llama: Open Foundation Models for Codecited by 2,139
  8. 2022Few-Shot Parameter-Efficient Fine-Tuning is Better and Cheaper than In-Context Learningcited by 896
  9. 2022CodeGen: An Open Large Language Model for Code with Multi-Turn Program Synthesiscited by 885
  10. 2021Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributionscited by 431
  11. 2023CodeT5+: Open Code Large Language Models for Code Understanding and Generationcited by 333
  12. 2023Parameter-Efficient Fine-Tuning Methods for Pretrained Language Models: A Critical Review and Assessmentcited by 230
18 more
  1. 2018Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learningcited by 225
  2. 2022Do Users Write More Insecure Code with AI Assistants?cited by 192
  3. 2023Large Language Models for Code: Security Hardening and Adversarial Testingcited by 155
  4. 2018Stronger Data Poisoning Attacks Break Data Sanitization Defensescited by 135
  5. 2020You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completioncited by 131
  6. 2023CodeGen2: Lessons for Training LLMs on Programming and Natural Languagescited by 125
  7. 2023LLM360: Towards Fully Transparent Open-Source LLMscited by 104
  8. 2022Lost at C: A User Study on the Security Implications of Large Language Model Code Assistantscited by 91
  9. 2023SlimPajama-DC: Understanding Data Combinations for LLM Trainingcited by 72
  10. 2020Subpopulation Data Poisoning Attackscited by 70
  11. 2023TrojanPuzzle: Covertly Poisoning Code-Suggestion Modelscited by 60
  12. 2023How Effective Are Neural Networks for Fixing Security Vulnerabilitiescited by 52
  13. 2023LLM Censorship: A Machine Learning Challenge or a Computer Security Problem?cited by 49
  14. 2023SkCoder: A Sketch-based Approach for Automatic Code Generationcited by 40
  15. 2023Vulnerabilities in AI Code Generators: Exploring Targeted Data Poisoning Attackscited by 33
  16. 2023Poisoned ChatGPT Finds Work for Idle Hands: Exploring Developers' Coding Practices with Insecure Suggestions from Poisoned AI Modelscited by 17
  17. 2024Black-Box Adversarial Attacks on LLM-Based Code Completioncited by 14
  18. 2023A Comparative Study of Code Generation using ChatGPT 3.5 across 10 Programming Languagescited by 12

Built on by

Not cited yet.