一句话：提出双 LoRA 子空间解耦框架 OrthCoder，用正交性约束缓解安全对齐导致的“安全税”。
大语言模型在自动代码生成上表现出色，却常产出含关键安全漏洞的代码。现有的监督微调与偏好优化等对齐手段虽能提升安全性，却带来显著的“安全税”：通用功能实用性下降，在复杂编程任务上尤为严重。作者将这一权衡归因于参数干扰，即安全驱动的更新与模型预训练的功能表示发生冲突；而推理期的免参数方法虽可缓解，却增加推理开销或不稳定性。本文聚焦片段级安全代码生成（由自然语言提示生成自包含函数或短代码例程），提出 OrthCoder：采用双 LoRA 架构，将功能实用性与安全对齐分配给独立的适配器，并在联合训练中引入几何正交约束 Lorth，促使两类适配器学到重叠更少的参数更新。作者在四个约 7B 规模的基础模型、七个覆盖片段级安全与通用代码生成实用性的基准上评估，结果显示 OrthCoder 在 CodeGuard+、CWEval 等联合安全—实用性基准上达到最优，且显著缓解了基线方法中的安全税；对学到的适配器参数分析表明功能与安全更新的重叠大幅减少，验证了解耦机制的有效性。
Large Language Models (LLMs) have significantly advanced automated code generation, yet they frequently produce code with critical security vulnerabilities. While recent alignment techniques (e.g., supervised fine-tuning and preference optimization) have attempted to mitigate this, existing methods often suffer from the notorious safety tax—a severe degradation in general functional utility, particularly on complex programming tasks. This trade-off can arise from parameter interference, where security-driven updates interact with the model’s pre-trained functional representations. Alternative approaches that avoid modifying model parameters (e.g., inference-time methods) can alleviate this issue but often introduce additional inference overhead or instability. In this work, we focus on snippet-level secure code generation, where a model generates a self-contained function or short code routine from a natural-language prompt. Within this setting, we propose OrthCoder, a novel secure code generation framework based on subspace decoupling. OrthCoder employs a Dual-LoRA architecture, dedicating separate adapters to functional utility and security alignment. By introducing a geometric orthogonality constraint (Lorth) during joint training, we encourage the utility and security adapters to learn less-overlapping parameter updates. Extensive evaluations across four diverse foundational models (∼7B scale) on seven benchmarks covering snippet-level security and general code-generation utility demonstrate that OrthCoder achieves state-of-the-art performance on joint security-utility benchmarks such as CodeGuard+ and CWEval. More importantly, OrthCoder mitigates the severe safety tax observed in existing alignment baselines. Furthermore, analyses of the learned adapter parameters show substantially reduced overlap between utility and security updates, supporting the effectiveness of the proposed decoupling mechanism.
@inproceedings{paperbot12180,
title = {OrthCoder: Balancing Security and Utility in Secure Code Generation via Orthogonal Adaptation},
author = {Menghan Tian and Youliang Yuan and Zhiqing Zhong and Pinjia He},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3837499}
}