Learning from Failures: Error Notebook-guided Secure Code Generation

摘要

Large Language Models (LLMs) have demonstrated a remarkable ability in code generation, yet ensuring the security and functionality of the produced code remains a critical challenge. Existing security code generation methods often rely solely on abstract security knowledge, typically resulting in a suboptimal trade-off: they either produce code with lingering vulnerabilities due to insufficient guidance or sacrifice functionality for the sake of absolute security. To address this limitation, we propose SAFENOTE, a novel framework that integrates a Security Error Notebook and a Function Error Notebook to transform failure experiences into concrete, actionable guidance. This method facilitates a form of contrastive guidance during inference, effectively steering the LLMs away from identified vulnerabilities while preserving functional correctness. Extensive experiment results across five LLMs on CodeGuard+ and LiveCodeBench benchmarks demonstrate the effectiveness of our method. Specifically, SAFENOTE achieves a substantial leap in SP@1 metric, with GPT-4o-mini performance improving from 60.21% to 66.7% on CodeGuard+. Furthermore, SAFENOTE provides security and functional guidance that generalizes effectively to “unseen” CWE scenarios, significantly outperforming existing baselines.