LATIDIA · Ciberseguridad

SecReason: Detección de vulnerabilidades y autorreparación en flujo para la generación de código LLM

arXiv: 2610.14453v2Announce Type: replace Resumen: Los modelos de lenguaje grandes (LLM) pueden introducir vulnerabilidades de seguridad en el código generado, que pueden persistir en la producción cuando la verificación se centra en el corre funcional

La noticia

arXiv:2610.14453v2 Announce Type: replace Abstract: Large language models (LLMs) may introduce security vulnerabilities into generated code, which can persist into production when verification focuses on functional correctness. Existing defenses act before, during, or after generation, but none inspects the code during generation. Security prompts and retrieved security knowledge act before any code exists, constrained decoding limits token choices but cannot guide repair, and post-hoc repair must regenerate the full response. Reasoning LLMs draft code early in their streamed chain of thought, and in this pre-delivery window the code exists only inside the reasoning stream. We present SecReason, an in-stream defense that monitors this window. Dual-track incremental scanning applies security rules,