We argue that when it comes to producing secure code with AI, the prevailing "fighting fire with fire" approach -- using probabilistic AI-based checkers or attackers to secure probabilistically generated code -- fails to address the long tail of security bugs. As a result, systems may remain exposed to zero-day vulnerabilities that can be discovered by better-resourced or more persistent adversaries. While neurosymbolic approaches that combine LLMs with formal methods are attractive in principle, we argue that they are difficult to reconcile with the "vibe coding" workflow common in LLM-assisted development: unless the end-to-end verification pipeline is fully automated, developers are repeatedly asked to validate specifications, resolve ambiguities, and adjudicate failures, making the human-in-the-loop a likely point of weakness, compromising secure-by-construction guarantees. In this paper we argue that stronger security guarantees can be obtained by enforcing security constraints during code generation (e.g., via constrained decoding), rather than relying solely on post-hoc detection and repair. This direction is particularly promising for diffusion-style code models, whose approach provides a natural elegant opportunity for modular, hierarchical security enforcement, allowing us to combine lower-latency generation techniques with generating secure-by-construction code.

翻译：我们认为，在利用AI生成安全代码方面，当前主流的"以火攻火"方法——即使用基于概率的AI检查器或攻击器来保护概率生成的代码——未能解决安全漏洞的长尾问题。因此，系统可能仍然暴露于零日漏洞之下，这些漏洞可能被资源更充足或更持久的对手发现。虽然将LLMs与形式化方法结合的神经符号方法在原则上具有吸引力，但我们认为它们难以与LLM辅助开发中常见的"氛围编码"工作流程相协调：除非端到端的验证流程完全自动化，否则开发者会被反复要求验证规范、解决歧义并裁决失败，这使得人机交互环节很可能成为弱点，从而损害"构造即安全"的保证。本文主张，通过在代码生成过程中强制执行安全约束（例如，通过约束解码），而非仅仅依赖事后检测与修复，可以获得更强的安全性保证。这一方向对于扩散式代码模型尤为前景广阔，其方法为模块化、层次化的安全执行提供了自然而优雅的机遇，使我们能够将低延迟生成技术与生成"构造即安全"的代码相结合。