کنفرانس مهندسی برق ایران

صفحه اصلی / سی و چهارمین کنفرانس بین المللی مهندسی برق

A Framework for Enhancing Code Security in LLMs via Hierarchical Security-Context RAG

نویسندگان :

Abbas Mirheidari¹ Amir Jalali Bidgoli² Ali Taei Zadeh³

1- دانشگاه قم 2- دانشگاه قم 3- دانشگاه قم

کلمات کلیدی :

Large Language Models (LLMs)،Secure Code Generation،Retrieval-Augmented Generation (RAG)،Fine-tuning

چکیده :

While Large Language Models (LLMs) are transforming software development, they often generate insecure code, posing significant security risks. Existing methods like fine-tuning can enhance security but are computationally expensive and create static model’s incapable of adapting to the dynamic threat landscape without costly retraining. To address these limitations, we propose HSC-RAG (Hierarchical Security-Context RAG), a novel retrieval-augmented generation framework that dynamically injects security knowledge into LLMs at inference time, eliminating the need for retraining. HSC-RAG leverages a knowledge base of secure/insecure code pairs and employs a multi-stage retrieval and filtering process to construct a highly relevant, security-focused context. Our experiments on models including StarCoder and Deepseek-coder show that HSC-RAG achieves up to 91% of the security performance of a fully fine-tuned model, while preserving the model’s utility on the HumanEval benchmark - all without incurring retraining costs.