Back to Paper
cs.CR
Local ID: 2606.03308v2
AI Summary: gemma4:e4b
The Security Budget of Code LLMs: An Information-Theoretic Capacity-Security Bound
By Jianwei Tai
Revision History Timeline
v16/2/2026
6/2/2026
No submitter comment provided.
v26/3/2026
6/3/2026
No submitter comment provided.
★ Version indexed in Explorerv36/10/2026
6/10/2026
No submitter comment provided.
Comparing v2 vs v3
Green = Added • Red = Removed
Title Comparison
The Security Budget of CodeCode-LLM LLMs:Prompt AnHardening: Information-TheoreticProvable Capacity-SecurityLimits BoundUnder Pass-Only Acceptance
Authors Comparison
No author changes.
v2 Comment
No comment for this version.
v3 Comment
No comment for this version.
Abstract Word Diff
AI programmingWe assistantsgive makea natural-languagequantitative promptsimpossibility aresult software-developmentfor interface,pass-only soprompt smallhardening promptof perturbationscode becomeLLMs. usabilityFor andany securitydeterministic risks.prompt Wefilter study$h$ anand information-theoretica trade-offregistered forfamily codeof LLMsfinite betweenexecutable-equivalence functionaltask capacity,variables $\Cap=\rmI(c^*;c_π)$,$\mathcal andY_{\mathrm{exec}}$, perturbationthe retention,shared $\Sec=\rmI(c_π;\tildefiltered-prompt c_π)$.channel Here$\rmI(h(p);h(\tilde $\Sec$p))$ is lower-bounded by a retention-channelworst-$Y$ quantity,Fano notfloor; aon directHumanEval measureand ofMBPP exploitthe successuniversal orpass-only vulnerable-codefloor generation.evaluates Forto code$\mathcal completionF^{\mathrm{op}}\ge modeled0.84$ asand $p\to$1.20$ c_π$nats withat perturbed$η=0.05$ prompttask-collapse $\tildetolerance, p$,and wethe proveidentity $\Cap+\Sec\lerow \rmH(c^*)+\rmI(p;\tilderealizes p)$,$\mathcal decomposingF^{\mathrm{id}}\ge the1.67$ budgetand into$1.80$ tasknats. entropyAn andestimator-invariance promptcorollary leakage.lifts Athe deterministic-embeddingfloor to any deterministic embedding pipeline; a dataset-agnostic corollary givesstates the hidden-statefloor version,in visible-spec entropy and ais tokenizer/gzipempirically companionwitnessed boundby gives$164/164$ aHumanEval+ model-agnosticand ceiling$224/224$ onMBPP+ sequence-level$V(p)$-invariance. taskWe entropy.operationalize Empirically,the wefloor estimateas embeddedthe $\Cap$\emph{Tri-Audit andProtocol}, $\Sec$a fromtwo-axis output-onlyreporting last-tokenprotocol hiddenthat states,separates excludinga promptprompt-side contextdeductive fromregistry attribute (Shannon nats on the $\Sec$visible-spec channel.representation) Sixfrom individuala validationmodel-side rowsempirical acrossproxy two(KSG-1 models,primary, twoMINE datasets,secondary, INT4/BF16on precision,hidden andstates). estimatorA ablationsconstrained satisfybest-of-family thesearch embeddedover checkdeterministic $(\Cap+\max_T\Sec)/(\rmH(z^*)+\max_T\rmI(p;\tildeand p))\le1$.guarded Saturationlearned isfilters 0.27--0.92on CodeLlama-7B, Qwen2.5-Coder-7B/1.5B and theoremDeepSeek-Coder-6.7B slackat is$n=164$ 2.36--26.94yields nats;the a\emph{Cross-Model separateTri-Audit three-seedInvariance}: stabilityof diagnostictwenty-eight haspass-preserving meanrows, saturationtwelve 0.87.antecedent-preserving Adeterministic context-mixedrows cosine,fail usedproxy-axis onlyleakage asreduction aon per-problemevery generation-promptbackbone alignmentwith signal,sign-invariant correlatespositive withdeviations, pass@1twelve onantecedent-changed-of-record CodeLlama-HumanEvallearned-canonicalizer ($ρ{=}0.36$,rows $p{<}10^{-4}$),fail Qwen-HumanEvalproxy-axis ($ρ{=}0.22$,leakage $p{=}0.005$),on every backbone, and CodeLlama-MBPPfour ($ρ{=}0.225$,antecedent-violating $p{=}0.0038$;rows allare $n{=}164$).reported Adaptiveas stressregistered-family testscollapse; withno filter produces a 23-perturbationshared pool,Tri-pass on a fixednine-cell universalgate-sensitivity suffix,sweep. andPass@1 prompt-embeddingalone PGDcannot allcertify leavecode-LLM positiveprompt slack.hardening.