PurpCode: Reasoning for Safer Code Generation

TL;DR

PurpCode is a novel two-stage training approach for creating safer code generation models that reference cybersecurity rules and use reinforcement learning to enhance safety without sacrificing utility.

Contribution

It introduces a new post-training recipe combining rule learning and reinforcement learning to improve the safety of code generation models against cyber threats.

Findings

PurpCode-32B outperforms existing models in cybersafety.

The alignment method reduces overrefusal rates.

The approach maintains code utility and security knowledge.

Abstract

We introduce PurpCode, the first post-training recipe for training safe code reasoning models towards generating secure code and defending against malicious cyberactivities. PurpCode trains a reasoning model in two stages: (i) Rule Learning, which explicitly teaches the model to reference cybersafety rules to generate vulnerability-free code and to avoid facilitating malicious cyberactivities; and (ii) Reinforcement Learning, which optimizes model safety and preserves model utility through diverse, multi-objective reward mechanisms. To empower the training pipelines with comprehensive cybersafety data, we conduct internal red-teaming to synthesize comprehensive and high-coverage prompts based on real-world tasks for inducing unsafe cyberactivities in the model. Based on PurpCode, we develop a reasoning-based coding model, namely PurpCode-32B, which demonstrates state-of-the-art cybersafety, outperforming various frontier models. Meanwhile, our alignment method decreases the model overrefusal rates in both general and cybersafety-specific scenarios, while preserving model utility in both code generation and common security knowledge.