codelion (Asankhaya Sharma)

Over 40 percent of AI-generated code contains security vulnerabilities. We recently worked on a LoRA to write secure code by default using automated Semgrep analysis and GRPO, achieving 97 percent reduction in vulnerabilities without requiring security-specific prompts.

Technical Approach:
Automated security training pipeline combining Semgrep vulnerability detection with preference learning. Generate multiple solutions with varying security awareness, automatically analyze for vulnerabilities, create preference pairs based on security scores, train using GRPO with multi-factor scoring.

Scoring System (100 points total):
- Functionality: 40 points - Does the code work correctly
- Security patterns: 40 points - Uses secure coding practices
- Low vulnerabilities: 20 points - Semgrep score below threshold

This balanced scoring prevents reward hacking where models generate empty functions to avoid vulnerabilities.

Real Transformation Examples:

Database query before:
query = f"SELECT * FROM products WHERE name = '{name}'"

Database query after:
query = "SELECT * FROM products WHERE name = ?"
db.execute(query, (name,))

Password hashing before:
password_hash = hashlib.md5(password).hexdigest()

Password hashing after:
salt = bcrypt.gensalt(rounds=12)
password_hash = bcrypt.hashpw(password.encode('utf-8'), salt)

Model: codelion/Qwen2.5-Coder-0.5B-Instruct-security-grpo-lora
Notebook: https://github.com/codelion/ellora/blob/main/Ellora_Recipe_5_Secure_Code_Generation_LoRA.ipynb
Repository: https://github.com/codelion/ellora

posted an update 8 days ago

Post

326

Over 40 percent of AI-generated code contains security vulnerabilities. We recently worked on a LoRA to write secure code by default using automated Semgrep analysis and GRPO, achieving 97 percent reduction in vulnerabilities without requiring security-specific prompts.

Technical Approach:
Automated security training pipeline combining Semgrep vulnerability detection with preference learning. Generate multiple solutions with varying security awareness, automatically analyze for vulnerabilities, create preference pairs based on security scores, train using GRPO with multi-factor scoring.

Scoring System (100 points total):
- Functionality: 40 points - Does the code work correctly
- Security patterns: 40 points - Uses secure coding practices
- Low vulnerabilities: 20 points - Semgrep score below threshold

This balanced scoring prevents reward hacking where models generate empty functions to avoid vulnerabilities.

Real Transformation Examples:

Database query before:
query = f"SELECT * FROM products WHERE name = '{name}'"

Database query after:
query = "SELECT * FROM products WHERE name = ?"
db.execute(query, (name,))

Password hashing before:
password_hash = hashlib.md5(password).hexdigest()

Password hashing after:
salt = bcrypt.gensalt(rounds=12)
password_hash = bcrypt.hashpw(password.encode('utf-8'), salt)

Model: codelion/Qwen2.5-Coder-0.5B-Instruct-security-grpo-lora
Notebook: https://github.com/codelion/ellora/blob/main/Ellora_Recipe_5_Secure_Code_Generation_LoRA.ipynb
Repository: https://github.com/codelion/ellora

updated a model 8 days ago

codelion/gemma-3-270m-icm

Text Generation • 0.3B • Updated 8 days ago • 107 • 3

Asankhaya Sharma PRO

AI & ML interests

Recent Activity

Organizations

Pre-training Dataset Samples

codelion/finepdfs-1B

codelion/finepdfs-1B

codelion/finepdfs-100M

codelion/finepdfs-10M