一句话：提出安全感知微调策略并结合RAG增强LLM安全代码审查，构建数据集与SecureBLEU指标。
在开发早期识别安全问题至关重要，代码审查是有效实践，但现有基于大语言模型的自动审查方法主要面向通用代码审查，对安全问题的识别与修复效果不足，且面临数据稀缺与评测指标缺失的挑战。本文提出SecureReviewer：首先构建面向安全代码审查训练与评估的专用数据集；在该数据集上采用安全感知微调策略，使LLM生成的审查评论能有效识别安全问题并给出修复建议；引入检索增强生成（RAG）将生成内容锚定于领域安全知识，以缓解幻觉并提升输出可靠性；同时提出新评测指标SecureBLEU，用于衡量评论解决安全问题的有效性。实验表明，SecureReviewer在安全问题检测准确率以及生成评论的整体质量与实用性上均优于当前最优基线。
Identifying and addressing security issues during the early phase of the development lifecycle is critical for mitigating the long-term negative impacts on software systems. Code review serves as an effective practice that enables developers to check their teammates’ code before integration into the codebase. To streamline the generation of review comments, various automated code review approaches have been proposed, where Large Language Model (LLM)-based methods have significantly advanced the capabilities of automated review generation. However, existing models primarily focus on general-purpose code review, their effectiveness in identifying and addressing security-related issues remains underexplored. Moreover, adapting existing code review approaches to target security issues faces substantial challenges, including data scarcity and inadequate evaluation metrics. To address these limitations, we propose SecureReviewer, a new approach designed for enhancing LLMs’ ability to identify and resolve security-related issues during code review. Specifically, we first construct a dataset tailored for training and evaluating secure code review capabilities. Leveraging this dataset, we fine-tune LLMs to generate code review comments that can effectively identify security issues and provide fix suggestions with our proposed secure-aware fine-tuning strategy. To mitigate hallucination in LLMs and enhance the reliability of their outputs, we integrate the Retrieval-Augmented Generation (RAG) technique, which grounds the generated comments in domain-specific security knowledge. Additionally, we introduce SecureBLEU, a new evaluation metric designed to assess the effectiveness of review comments in addressing security issues. Experimental results demonstrate that SecureReviewer outperforms state-of-the-art baselines in both security issue detection accuracy and the overall quality and practical utility of generated review comments. Our code and data are available at https://github.com/SIMIAO515/SecureReviewer.
@inproceedings{abs-2510-26457,
title = {SecureReviewer: Enhancing Large Language Models for Secure Code Review through Secure-Aware Fine-Tuning},
author = {Fang Liu and Simiao Liu and Yinghao Zhu and Xiaoli Lian and Li Zhang},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3773191}
}