EvoSecCoder: Adversarial Co-Evolution for Secure Code Generation

Large language models increasingly excel at code generation, but still generate vulnerable code. To generate more secure code, models need to learn to follow secure examples and avoid insecure patterns without losing functionality. Models can learn from secure and insecure examples drawn from a fixed dataset or generated by the model itself. However, fixed examples become less useful as the model learns, while the model's own functional insecure examples become rarer as its code becomes more secure. Both sources therefore provide less training signal as the model improves. We present EvoSecCoder, an adversarial co-evolution framework that jointly evolves secure and insecure models from the same base model while preserving functionality. The two models co-evolve by supplying adversarial samples to each other. In each evolution round, both models solve the same tasks, and executable tests verify their programs. Functional but insecure programs challenge the secure model, while secure programs guide the insecure model toward new insecure alternatives. Across five open models, with training rounds selected on held-out validation CWEs, EvoSecCoder improves the mean SecCodeBench correct-and-secure rate on the remaining test CWEs from 17.4% to 23.3%, while mean EvalPlus functional correctness changes from 65.6% to 64.9%. Removing or freezing the insecure model reduces the mean correct-and-secure rate to 21.1% or 21.8%, respectively; these ablations support the value of a dedicated, co-evolving insecure model beyond additional sampling alone.