{"id":"https://openalex.org/W7151512091","doi":"https://doi.org/10.48550/arxiv.2604.03587","title":"SecPI: Secure Code Generation with Reasoning Models via Security Reasoning Internalization","display_name":"SecPI: Secure Code Generation with Reasoning Models via Security Reasoning Internalization","publication_year":2026,"publication_date":"2026-04-04","ids":{"openalex":"https://openalex.org/W7151512091","doi":"https://doi.org/10.48550/arxiv.2604.03587"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.03587","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.03587","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.03587","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5133065604","display_name":"Hao Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Hao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5031813611","display_name":"Niels M\u00fcndler","orcid":"https://orcid.org/0000-0003-3851-2557"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"M\u00fcndler, Niels","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133091315","display_name":"Mark Vero","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Vero, Mark","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133064551","display_name":"Jingxuan He","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"He, Jingxuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133138301","display_name":"Dawn Song","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Song, Dawn","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5133131262","display_name":"Martin Vechev","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Vechev, Martin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.375900000333786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.375900000333786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.20980000495910645,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.17110000550746918,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/correctness","display_name":"Correctness","score":0.6909999847412109},{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.6262000203132629},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.4478999972343445},{"id":"https://openalex.org/keywords/computer-security-model","display_name":"Computer security model","score":0.44510000944137573},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.4429999887943268},{"id":"https://openalex.org/keywords/coding","display_name":"Coding (social sciences)","score":0.40310001373291016},{"id":"https://openalex.org/keywords/generalization","display_name":"Generalization","score":0.39660000801086426},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.385699987411499}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7972000241279602},{"id":"https://openalex.org/C55439883","wikidata":"https://www.wikidata.org/wiki/Q360812","display_name":"Correctness","level":2,"score":0.6909999847412109},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.6262000203132629},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.4478999972343445},{"id":"https://openalex.org/C121822524","wikidata":"https://www.wikidata.org/wiki/Q5157582","display_name":"Computer security model","level":2,"score":0.44510000944137573},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.4429999887943268},{"id":"https://openalex.org/C179518139","wikidata":"https://www.wikidata.org/wiki/Q5140297","display_name":"Coding (social sciences)","level":2,"score":0.40310001373291016},{"id":"https://openalex.org/C177148314","wikidata":"https://www.wikidata.org/wiki/Q170084","display_name":"Generalization","level":2,"score":0.39660000801086426},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.385699987411499},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.37220001220703125},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.3668000102043152},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.3582000136375427},{"id":"https://openalex.org/C195344581","wikidata":"https://www.wikidata.org/wiki/Q2555318","display_name":"Automated reasoning","level":2,"score":0.33219999074935913},{"id":"https://openalex.org/C195518309","wikidata":"https://www.wikidata.org/wiki/Q13424265","display_name":"Security testing","level":5,"score":0.3312000036239624},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.3294999897480011},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3255999982357025},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.32359999418258667},{"id":"https://openalex.org/C133162039","wikidata":"https://www.wikidata.org/wiki/Q1061077","display_name":"Code generation","level":3,"score":0.30880001187324524},{"id":"https://openalex.org/C38369872","wikidata":"https://www.wikidata.org/wiki/Q7445009","display_name":"Security analysis","level":2,"score":0.28679999709129333},{"id":"https://openalex.org/C49937458","wikidata":"https://www.wikidata.org/wiki/Q2599292","display_name":"Probabilistic logic","level":2,"score":0.2815000116825104},{"id":"https://openalex.org/C2779304628","wikidata":"https://www.wikidata.org/wiki/Q3503480","display_name":"Face (sociological concept)","level":2,"score":0.27790001034736633},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.272599995136261},{"id":"https://openalex.org/C37335422","wikidata":"https://www.wikidata.org/wiki/Q6888134","display_name":"Model-based reasoning","level":3,"score":0.26420000195503235},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.259799987077713}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.03587","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.03587","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.03587","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.03587","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.7449485063552856,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Reasoning":[0],"language":[1],"models":[2,182],"(RLMs)":[3],"are":[4],"increasingly":[5],"used":[6],"in":[7,18,167],"programming.":[8],"Yet,":[9],"even":[10],"state-of-the-art":[11,179],"RLMs":[12,84],"frequently":[13,247],"introduce":[14],"critical":[15,30],"security":[16,45,59,88,97,117,147,163,176],"vulnerabilities":[17],"generated":[19],"code.":[20],"Prior":[21],"training-based":[22],"approaches":[23],"for":[24,108,201],"secure":[25,91,199,243],"code":[26,92,244],"generation":[27],"face":[28],"a":[29,49,79,121,126,155],"limitation":[31],"that":[32,82,129],"prevents":[33],"their":[34],"direct":[35],"application":[36],"to":[37,85,160,169,206,215],"RLMs:":[38],"they":[39],"rely":[40],"on":[41,141,175,210,217,235,248],"costly,":[42],"manually":[43],"curated":[44],"datasets":[46,107],"covering":[47],"only":[48,67,234],"limited":[50],"set":[51],"of":[52,143,186,195],"vulnerabilities.":[53,230],"At":[54],"the":[55,138,157,184,193],"inference":[56,100],"level,":[57],"generic":[58],"reminders":[60],"consistently":[61],"degrade":[62],"functional":[63],"correctness":[64],"while":[65],"triggering":[66],"shallow":[68],"ad-hoc":[69],"vulnerability":[70],"analysis.":[71],"To":[72],"address":[73],"these":[74],"problems,":[75],"we":[76],"present":[77],"SecPI,":[78],"fine-tuning":[80],"pipeline":[81],"teaches":[83],"internalize":[86],"structured":[87,127],"reasoning,":[89],"producing":[90],"by":[93,125],"default":[94],"without":[95],"any":[96],"instructions":[98],"at":[99],"time.":[101],"SecPI":[102,191],"filters":[103],"existing":[104],"general-purpose":[105],"coding":[106],"security-relevant":[109],"tasks":[110],"using":[111],"an":[112],"LLM-based":[113],"classifier,":[114],"generates":[115,240],"high-quality":[116],"reasoning":[118,151,181],"traces":[119,152],"with":[120,145,178],"teacher":[122,150],"model":[123,140,158],"guided":[124],"prompt":[128,148],"systematically":[130],"enumerates":[131],"relevant":[132],"CWEs":[133],"and":[134,136,149,198,212,225,242],"mitigations,":[135],"fine-tunes":[137],"target":[139],"pairs":[142],"inputs":[144],"no":[146],"--":[153],"as":[154],"result,":[156],"learns":[159],"reason":[161],"about":[162],"autonomously":[164],"rather":[165],"than":[166],"response":[168],"explicit":[170],"instructions.":[171],"An":[172],"extensive":[173],"evaluation":[174],"benchmarks":[177],"open-weight":[180],"validates":[183],"effectiveness":[185],"our":[187],"approach.":[188],"For":[189],"instance,":[190],"improves":[192],"percentage":[194],"functionally":[196],"correct":[197,241],"generations":[200],"QwQ":[202,238],"32B":[203,239],"from":[204,213],"48.2%":[205],"62.2%":[207],"(+14.0":[208],"points)":[209],"CWEval":[211],"18.2%":[214],"22.0%":[216],"BaxBench.":[218],"Further":[219],"investigation":[220],"also":[221],"reveals":[222],"strong":[223],"cross-CWE":[224],"cross-language":[226],"generalization":[227],"beyond":[228],"training":[229],"Even":[231],"when":[232],"trained":[233],"injection-related":[236],"CWEs,":[237],"9.9%":[245],"more":[246],"held-out":[249],"memory-safety":[250],"CWEs.":[251]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-04-08T00:00:00"}