CoGate Gates the Security Expert by Its Own Confidence, Gaining 12.6% Func-Sec@10 on CWEval

arXiv·medium signalXBlueskyLinkedInCopy link

Co-decoding steers code generation toward security by blending a small expert model with the target model at each step, but existing acceptance rules ignore whether the expert is actually confident — so on out-of-distribution or unseen patterns its guidance can actively mislead. CoGate (arXiv 2607.28529, July 30) conditions the expert's influence on its confidence, and across CodeGen, DeepSeek-Coder, Qwen-Coder, and StarCoder backends on HumanEval, a security suite, and CWEval it beats CoSec+ with up to a 12.6% gain in Func-Sec@10 on CWEval. The finding generalizes beyond code: any guarded-decoding setup that trusts a small guide model unconditionally inherits the same failure mode.