LEARNING DECODING ORDER IN DIFFUSION FOR SECURE CODE GENERATION

Generating secure code requires making decisions with the right context. A locally plausible implementation can be unsafe when the surrounding program is still unresolved. Diffusion language models provide a natural way to address this problem because they can generate a program in flexible order, committing some decisions while leaving others open for revision. Yet existing decoders typically choose this order using token confidence, which says little about what context a decision requires. We introduce Paco, a framework that learns the order in which code should be constructed. Our key idea is to establish program structure first and defer context-dependent decisions until the information they rely on is available. We learn this ordering from automatically computed program properties and use it to guide diffusion decoding. On CWEval, Paco improves security success by 50% and approximately doubles functional-and-secure generation over language-model-only fine-tuning. The learned ordering transfers to unseen JavaScript and Java, and at 128 decoding steps improves functional-security success by 62% over cached autoregressive decoding while running $1.75\times$ faster.