Many Repairs, One Direction: Steering Code Models Toward Safer Cryptographic API Use

Many Repairs, One Direction: Steering Code Models Toward Safer Cryptographic API Use Tianhe Lu, Sakuna Harinda Jayasundara, Eric Spero, Ewan Tempero, Robert Biddle, Giovanni Russello University of Auckland Auckland, New Zealand {tlu202,sjay950}@aucklanduni.ac.nz {eric.spero,e.tempero,robert.biddle,g.russello}@auckland.ac.nz Abstract

2016), and LLM-generated programs also contain cryptographic API misuses (Mousavi et al., 2024). Existing approaches improve the security of LLM-generated programs through fine-tuning (He and Vechev, 2023; He et al., 2024), prompt engineering (Tony et al., 2025a), retrieval-augmented generation (RAG) (Zhang et al., 2024), and feedback repair (Le et al., 2024). However, these gains leave open how models represent security-sensitive choices and whether the associated representation changes can guide generation. Activation steering modifies a model’s internal activations during generation while keeping model weights and prompts fixed (Rimsky et al., 2024; Li et al., 2023; Zou et al., 2025; Turner et al., 2024; Hernandez et al., 2024). This allows us to study how representations associated with different API misuses can be used to influence the API choices in newly generated programs. Recent studies show that activation steering directions constructed for individual Common Weakness Enumeration (CWE) categories can reduce vulnerabilities in generated programs (Yan and Yao, 2026; Sandoval et al., 2026; Yu et al., 2025). However, different uses of cryptographic APIs involve different security requirements. Replacing an unsuitable source of randomness, increasing a key length, and changing an algorithm configuration require different code changes (Mousavi et al., 2024; Krüger et al., 2021). We investigate how their representation changes vary across languages and misuse categories, and whether these different changes can support one reusable generation intervention. In this study, we use matched secure and misuse program pairs that differ only in a specified cryptographic API decision for the same task. Repairs may alter an algorithm, a parameter value, or a source of randomness, providing distinct edits whose representation changes can be compared (Mousavi et al., 2024; Krüger et al., 2021). We construct 48,000 matched secure/misuse pro-

arXiv:2610.25133v1 [cs.CR] 18 Oct 2026

Cryptographic API misuse in large language model-generated code can compromise software security. While many existing approaches improve code security by modifying model parameters or inputs, how representation changes associated with different cryptographic API repairs can support a shared intervention for safer code generation remains underexplored. To investigate this, we construct 48,000 matched program pairs across four programming languages and ten cryptographic API misuse categories. Each pair changes a specified API decision while preserving the programming task. Subtracting the misuse program’s internal representation from its secure counterpart’s gives a repair vector. Across five models, comparisons of mean repair vectors reveal stronger organization by misuse category than by language. These category-specific patterns also support a shared intervention. We introduce CrypSteer, which extracts a shared direction by normalizing repair differences and selecting a principal component aligned with repairs across misuse categories. With model weights fixed, adding one shared direction per model to its internal activations during generation improves aggregate target security rates by 5.28–15.00 percentage points over unsteered generation across languages and misuse categories. These findings connect the shared structure of cryptographic repair representations to a reusable intervention for safer code generation.

1

Introduction

Large language models (LLMs) assist developers with code generation, but they also introduce security vulnerabilities in generated programs (Pearce et al., 2025; Perry et al., 2023). Software applications rely on cryptographic application programming interfaces (APIs) to protect data, and their secure use requires appropriate algorithms, parameters, and randomness (Krüger et al., 2021). These choices are difficult for developers (Nadi et al., 1

Figure 1: Matched repairs support representation analysis and CrypSteer’s shared generation intervention. Secureminus-misuse program representations provide repair vectors for analysis and direction construction. The threedimensional inset visualizes Llama’s 40 repair directions for each language-misuse category combination, using uncentered principal component analysis (PCA). CrypSteer selects a repair-aligned principal component (security PC) and adds a scaled version to token activations during generation, reusing one direction per model across languages and misuse categories.

• A controlled resource for studying repairs. A collection of 48,000 secure/misuse program pairs that contain matched API edits and structural variants enables comparisons of representation changes across programming languages, misuse categories, and program structures. • Evidence connecting repair structure to shared control. Across five models, repairs differ by misuse category, but they support a shared generation intervention, including when the target misuse category is excluded from direction fitting. • A shared steering method for safer generation. CrypSteer, which normalizes repair vectors and selects a principal component (PC) aligned across misuse categories, improves aggregate target security in generated programs across all five models using one shared direction per model.

gram pairs across four programming languages, ten misuse categories, and four code structures. We use repair to describe the change from a misuse program to its secure counterpart, and use repair vector to describe the difference between their program representations. By matching the task and surrounding implementation, each vector can be connected to a specified repair. Varying language, misuse category, and program structure then allows us to compare these changes across controlled sources of variation. Across five models, repair vectors are strongly grouped by misuse category, and their shared changes support safer code generation. We introduce CrypSteer, which normalizes repair vectors and selects a component aligned across misuse categories. Using CrypSteer in activation steering improves target security in generated programs. Comparisons show consistent gains from normalization, with the additional benefit of component selection. Figure 1 summarizes our study. We first construct matched secure/misuse programs to support comparisons of repair vectors between them across languages, misuse categories, and code structures (Section 2). We then examine how these repair vectors are organized, construct a shared direction (Section 3), and test its effects on generation (Section 4). This paper has the following contributions.

2

Investigating Cryptographic Repairs with Matched Programs

To understand how cryptographic API repairs are represented in models and analyze their organization and causal influence on program generation, we first construct paired programs that isolate a target API decision and use their representation dif2

ferences to describe repairs. For each model, we then choose a common layer at which to analyze those repair vectors and apply generation interventions. 2.1

ID

Dataset contrast (secure / misuse)

M01 Predictable cryptographic Random / fixed literal key keys M02 Insecure mode of CBC mode / ECB mode encryption M03 Predictable IVs in CBC Random / constant IV mode M04 Short cryptographic keys 2048 / 1024 bits for RSA M05 Predictable random output Cryptographic / general-purpose PRNG M06 Predictable salts for key Random / constant salt derivation M07 Low iteration counts for 100,000 / 100 iterations key derivation M08 Hardcoded constant Environment / hardcoded passwords password M09 Broken hash functions SHA-256 / SHA-1 M10 Compromised MAC HMAC-SHA-256 / algorithms HMAC-MD5

Matched Programs with Structural Variants

We build a dataset that keeps the programming task and surrounding implementation scaffolds fixed while changing the target cryptographic API decision for each misuse category listed in Table 1. This resource covers Java, TypeScript, C#, and Python, with ten misuse categories adapted from Mousavi et al. (2024). We refer to each language–misuse category combination as a cell, e.g., Python–M09. We use this term for the same grouping throughout the paper. We design language-specific tasks adapted from Mousavi et al. (2024) and use five GPT models to generate candidate original programs with an editable target decision. We retain 300 originals in each of the 40 cells, giving 12,000 originals and equal representation for every language and misuse category. Based on the original programs and the category-specific contrasts in Table 1, GPT-5.6sol produces matched secure and misuse versions from each original. To examine how code structure affects repair representations, we construct four structural variants of each pair, which forms across two choices. This includes whether the target value reaches the API through a named variable or directly at the call site, and whether it is constructed inline or returned by a helper function. Both programs in a pair use the same structural form, and each original contributes four matched pairs, or eight programs. Therefore, the full resource contains 48,000 pairs, or 96,000 programs. We conduct a quality check of the resource that covers required operations, arguments, dataflow, and target labels, which we specify in Appendix A.2. The security rules follow category-specific policies from Mousavi et al. (2024). Appendix A gives the construction procedure. 2.2

Misuse definition

Table 1: Misuse categories adapted from Mousavi et al. (2024) and instantiated in four languages. Each contrast lists the secure and misuse implementations used to construct a matched pair. CBC and ECB denote cipher block chaining and electronic codebook modes, respectively. IV denotes initialization vector. PRNG denotes pseudorandom number generator. MAC denotes message authentication code. Appendix H specifies the label policies.

the program body gives one fixed-size program representation, h̄ℓ (x), following mean-pooling approaches to code representation (Jain et al., 2021; Guo et al., 2022). The leading imports and package declarations remain in the input as context but are excluded from the average, so the program representation summarizes the implementation, including definitions, API calls, and later uses. For original i in structural form s at layer ℓ, let secure h̄i,s,ℓ and h̄misuse be the paired program represeni,s,ℓ tations. Their secure-minus-misuse difference defines a structure-specific repair vector δi,s,ℓ , whose orientation and length capture the representation change associated with the specified edit in that structural form. misuse δi,s,ℓ = h̄secure i,s,ℓ − h̄i,s,ℓ .

(1)

We combine the four forms of each original by averaging their structure-specific repair vectors:

Program Representation and Repair Vectors

4

We supply each program’s complete source code x directly to the model in one forward pass. At layer ℓ and token position t, we record token activations hℓ,t (x) from the residual stream, which carries the current token representations between decoder blocks. Averaging these activations over

1X di,ℓ = δi,s,ℓ . 4

(2)

s=1

This gives one original-level repair vector di,ℓ per original, with equal weights for its four structural forms. We find that cross-structure repair vectors 3

have strong direction alignment, which we report in Appendix C. This supports using these originallevel repair vectors to study category-level patterns. Subsequent geometry analysis and direction fitting use these 12,000 vectors di,ℓ , one per original, and we omit ℓ for the selected layer. Layer selection classifies individual implementations, while intervention scale calibration needs to capture variation across structural forms, so they both use all 96,000 program representations.

1 2 3 4 5 6 7 8 9 10

2.3

Figure 2: Geometry of Llama repair vectors at layer 14. (a) Cosine similarities between 40 cell-mean directions. (b) Row/column ratios of 40 cell-average repair norms. On both axes, 1–10 denote misuse categories M01–M10. Within each category, rows and columns follow the order Java, TypeScript, C#, and Python.

1 2 3 4 5 6 7 8 9 10

−1

0 Java

We study five instruction-tuned models spanning general-purpose and code-specialized models to understand whether different LLM structure and architecture influence the results. The models include: Llama-3.1-8B-Instruct (Llama) (Grattafiori et al., 2024), CodeGemma7B-IT (CodeGemma) (CodeGemma Team et al., 2024), Qwen2.5-7B-Instruct (Qwen) (Qwen et al., 2025), Qwen2.5-Coder-7B-Instruct (Qwen-Coder) (Hui et al., 2024), and DeepSeek-Coder-V2-LiteInstruct (DeepSeek) (DeepSeek-AI et al., 2024). Each model has its own representation space, selected layer and steering directions. We use the short names in parentheses throughout the paper. To reuse one direction across languages and misuse categories, we select one layer that contributes most for the cryptographic API misuse concept for representation analysis and generation intervention within each model. We compare layers by testing how well a linear classifier can distinguish secure from misuse programs using their program representations. At each layer, we train a logistic regression classifier, called a linear probe, to predict secure/misuse labels from the program representations (Belinkov, 2022). We hold out one misuse category or one language at a time to test the generalizability of the classification, and train a separate probe on the remaining groups and evaluate it on the held-out group. This results in ten misuse category folds and four language folds at each layer. We use the area under the receiver operating characteristic curve (AUROC) to measure the ranking performance of each probe for each fold (Fawcett, 2006). We first average the ten misuse category scores and the four language scores separately, then give the two averages equal weight, to give both transfer equal importance. The layer with the highest combined score is selected as the common layer for that model. The selected layers

1 2 3 4 5 6 7 8 9 10

1 1/32 TypeScript C#

(a) Direction cosine

Models and Layer Selection

1 2 3 4 5 6 7 8 9 10

1/4

1 Python

4

32

(b) Norm ratio

lie in the middle to upper-middle parts of the model, consistent with empirical steering studies of alignment (Rimsky et al., 2024), personality (Feng et al., 2026), sentiment (Zhao et al., 2026), and emotiondriven preferences (Sofroniew et al., 2026). Appendix B.2 gives the selected layers and optimization settings.

3

Misuse Category Structure and Shared Repair Directions

Different uses of cryptographic APIs involve different security requirements, but they may produce distinct representation changes while still sharing an orientation that can guide generation. We examine this possibility by comparing repair vectors across misuse categories and languages, constructing a shared direction, and testing its alignment with new programs and its responses to combined repairs. 3.1

Representation Organization Across Languages and Misuse Categories

We use cosine similarity to measure directional alignment of repair vectors across misuse categories and languages (Ethayarajh, 2019). Cosine values near one indicate similar orientations, zero indicates orthogonality, and negative values indicate opposing orientations. At each model’s selected layer, we average the 300 original repair vectors within each language–category cell, which gives 40 cell-mean directions. The cosine heatmap in Figure 2(a) shows the directional structure for Llama, and Table 2 compares samecategory cosines across languages with different4

Model Llama CodeGemma Qwen Qwen-Coder DeepSeek

Mean cosine same category across languages

Mean cosine different categories within a language

Category matches

Norm ratio

0.607 0.673 0.673 0.694 0.650

0.130 0.111 0.095 0.118 0.112

40/40 40/40 38/40 38/40 38/40

19.2 22.5 14.6 14.3 16.2

ticularly from early-middle to late layers. At the probe-selected layers for each model, similarity to the immediately preceding and following layers ranges from 0.993 to 0.998. Therefore, the selected layers lie within regions of stable repair relationships. Appendix D provides detail of the geometry and additional clustering analyses.

Table 2: Full-corpus repair geometry at the selected layer. Category matches use references from other languages. Norm ratio compares the largest and smallest cell-average repair norms.

3.2

Constructing a Shared Direction

Distinct misuse category repair vectors can align with a common axis. CrypSteer seeks such an axis by first normalizing repair vectors to give each repair equal length, then selecting a component with positive mean alignment in as many misuse categories as possible. This construction turns the observed misuse category structure into a candidate for shared generation control. We compare CrypSteer with three variants of difference-in-means (DiffMean) constructions. For matched pairs, averaging secure-minus-misuse repair vectors is equivalent to subtracting the mean misuse representation from the mean secure representation (Rimsky et al., 2024). Cell DiffMean averages the 300 original repair vectors within each cell, giving 40 directions per model. Pooled DiffMean averages all repair vectors across 40 cells. Normalized DiffMean first normalizes each repair vector, then averages across cells. The latter two each produce one shared direction per model. Every steering vector is normalized to unit length before intervention for a fair comparison. Appendix B.3 gives the formulas. For CrypSteer, let di = di,ℓ and ui = di /∥di ∥2 at the selected layer, with N = 12, 000 originals. We apply uncentered singular value decomposition (SVD) to the matrix with rows ui to approximate the unit repair vectors by their projections onto a common axis. Keeping the vectors uncentered preserves the origin as the point of no change between paired program representations. SVD finds axes that capture large squared projections of the unit repair vectors. The first component solves

category cosines within languages for all five models. Directions from the same misuse category across languages are substantially more aligned than directions from different misuse categories within one language. We also test whether a repair category can be identified using directions from other languages. For each language, we build ten misuse category references by averaging the unit cell-mean directions from the other three languages. Each of its ten cell directions is then assigned to the reference with the highest cosine similarity. This gives 40 queries across four languages and ten misuse categories. Results in Table 2 show that this recovers the correct category in 38–40 of 40 cases per model. Together, these results identify misuse category as the stronger organizing factor while retaining language-dependent variation. However, repair magnitudes vary substantially. For this comparison, we average the 300 original repair L2 norms within each cell and compare the largest and smallest cell averages. A value near one means similar vector lengths. Figure 2(b) shows the cell-wise norm ratio comparison for Llama. Table 2 shows that the largest cell-averaged repair norm is 14.3–22.5 times the smallest across five models. Therefore, simply averaging the raw repair vectors will give some repairs substantially more influence than others. This motivates comparing aggregation of the raw repair vectors with aggregation that first gives every repair equal length. We also test whether the structure of repair representations is stable across layers. We compute the pairwise cosine similarities between the repair directions at each layer, and then compute the pairwise cosine similarities of these cosine similarity matrices across layers to analyze the representational similarity (Kriegeskorte et al., 2008). We find that the structure of repair geometry is relatively stable throughout most of the model, par-

1 X ⊤ 2 (ui v) . ∥v∥2 =1 N

v1 ∈ arg max

(3)

i

Geometrically, v1 defines the line through the origin that minimizes the sum of squared distances from the unit repair vectors to the line (Eckart and Young, 1936). Each repair ui has an approximation which is the projection (u⊤ i v1 )v1 onto this axis. Each later component maximizes the same 5

Model

Positive repairs (%) Mean cosine Positive cells

Llama CodeGemma Qwen Qwen-Coder DeepSeek

95.36 88.86 95.22 91.11 97.86

0.343 0.332 0.324 0.318 0.337

38/40 36/40 38/40 37/40 40/40

Table 3: Held-out alignment of repair vectors. Positive repairs have cosine above zero. Positive cells have positive mean cosine. Model

Java

TypeScript

C#

Python

Llama CodeGemma Qwen Qwen-Coder DeepSeek

0.930 0.770 0.986 0.950 0.978

0.819 0.615 0.996 0.964 0.991

0.971 0.838 0.997 0.866 0.985

0.990 0.946 0.987 0.986 0.965

Figure 3: Python M09 paired span projections using the Llama layer-14 CrypSteer direction. Green and red indicate positive and negative paired projection differences.

tor. Table 3 reports the proportion of positive cosines, the mean cosine over all test originals, and the number of cells with positive mean cosine. Positive alignment holds for 88.86%–97.86% of test originals, with positive mean test cosine in 36–40 cells per model. Therefore, the shared orientation extends to repairs beyond the direction-fitting set.

Table 4: Prediction R2 for 1,013 multi-repair combinations per language using the all-misuse and ten singlerepair programs as references.

objective subject to orthogonality to all earlier components. The squared objective treats an axis and its reverse equally, so we use the secure-minus-misuse orientation of the repairs to choose a component and its sign. We consider both signs of the first ten PCs, which are right singular vectors v1 , . . . , v10 . For each candidate, we average the projections of the repair vectors within each misuse category and count how many category means are positive. We select the candidate with the largest count, with detailed rules in Appendix B.3. This criterion prioritizes alignment across misuse categories among the leading components. The selected unit direction vCrypSteer , or security PC, is PC2 for Qwen and PC1 for the other four models. CrypSteer uses this model-specific direction across all four languages and ten misuse categories in activation steering. 3.3

Misuse 3 message = b"release artifact" 4 digest = hashes.Hash(hashes.SHA1()) 5 digest.update(message) 6 result = digest.finalize() 7 print(len(result)) Secure 3 message = b"release artifact" 4 digest = hashes.Hash(hashes.SHA256()) 5 digest.update(message) 6 result = digest.finalize() 7 print(len(result))

3.4

Response to Individual and Combined Security Choices

We use additional controlled programs to test how responses to individual repairs combine within a program. Each language has one program template with ten operations corresponding to the ten misuse categories, each switchable between secure and misuse implementations. This gives 210 = 1, 024 combinations per language that separate from the direction-fitting resource. We measure each program’s scalar projection, which is the dot product of its representation with the fixed unit direction. The all-misuse program and the ten single-repair programs provide eleven reference measurements. For each repair, we measure the projection change from the all-misuse program. We predict a program with several repairs by adding their individual changes to the all-misuse projection, then evaluate these predictions on the remaining 1,013 combinations. Table 4 reports the prediction R2 , which measures prediction accuracy. Across the five models and four languages, the median is 0.968. Therefore, individual repair responses often combine approximately additively. Appendix E gives the prediction rule and a complementary descriptive analysis that fits an additive model to all 1,024 configurations. To examine where a repair changes the representation of a program, we also curate paired programs with secure and misuse decisions for each language and misuse category. We use paired heatmaps to show how individual repairs affect token activa-

Alignment on Held-Out Programs

We test whether the shared direction aligns with repairs excluded from its construction. With the layer selected from the full corpus, we split originals into 70% discovery and 30% test sets, stratified by language, misuse category, and task. The split contains 8,400 discovery originals and 3,600 test originals, with all four structural variants of an original kept together. Using only original-level repair vectors in the discovery set, we perform SVD and select the component and its orientation. We keep the resulting direction fixed and compute its cosine similarity with each test repair vec6

additionally test CrypSteer at 0.5σ and 2σ. Appendix B.4 gives the scale formula and generation settings. We measure three single-sample success rates using the k = 1 case of the pass@k estimator (Chen et al., 2021). secure@1 is the proportion of outputs labeled secure under the target cryptographic API usage policy, valid@1 is the proportion that pass structural validity checks, and secure-valid@1 requires both on the same output. Structural validity checks cover source-level parsing or compilation, imports, and required API operations, arguments, and connections. Appendix H reports a blinded manual review of evaluator labels. For each prompt, we calculate the fraction of its 30 attempts that satisfies each criterion, retaining all attempts in the denominator. Aggregate results give equal weight to each of the 40 cells. Table 5 reports the main results, and Appendix F gives paired statistics and results for each language and misuse category.

tion projections onto the fixed shared direction, which shows their direction similarity. In Figure 3, replacing SHA-1 with SHA-256 changes projections at the algorithm choice and the unchanged result in result=digest.finalize() and print(len(result)). The unchanged expressions receive different activations because their preceding context has changed. This connects the API repair to the model’s representation of a later output expression. Appendix E.2 gives the heatmap construction procedure.

4

Steering Code Generation with Shared Repairs

The representation analyses show that repairs have category-specific structure while aligning with a shared direction. We then test whether that direction can guide security-sensitive choices when a model generates a new program. The experiments compare repair aggregation methods, vary the sources used to fit a direction, and examine the effect of intervention strength. 4.1

4.2

Using one shared direction per model for all four languages and ten misuse categories, CrypSteer improves the security of generated programs for all five models. As shown in Table 5, at +1σ, CrypSteer improves secure@1 by 5.28–15.00 percentage points (pp) and secure-valid@1 by 2.32–9.67 pp. Reversing the direction also reduces aggregate security. These opposing effects provide causal evidence that the direction is a shared representation of cryptographic API misuse that can be reused for generation-time intervention. CrypSteer even achieves a higher observed secure-valid@1 than Cell DiffMean in all five models, and Appendix F shows this also holds for most language and misuse category groups. This suggests that aggregating repairs across tasks could be more useful than restricting construction to closely matched examples. A possible explanation is that repair differences reflect both the target security change and its interaction with the surrounding implementation. Aggregation may emphasize recurring security-related changes while reducing the influence of components specific to other contexts. In addition to CrypSteer, Pooled DiffMean and Normalized DiffMean also improve observed secure@1 and secure-valid@1 over the unsteered baseline. Normalizing repairs before averaging consistently improves both rates over Pooled DiffMean. Raw averaging gives longer repair vec-

Intervention and Evaluation

We steer model generation by adding a scaled unit direction to the selected layer’s residual stream activation at the final prompt position and each generation step: h′t = ht + ασv,

Shared Control and Aggregation Choices

(4)

where ht is the token activation at position t at the selected layer, v is a unit direction, and α controls the sign and strength of the intervention. We measure the intervention strength in units of σ, which is the square root of the total sample variance of all program representations at the selected layer. This measures how widely program representations are spread around their mean, and provides a model-specific reference scale for intervention. Because v has a unit length, the update in Equation 4 has length |α|σ. Each condition uses five fixed generation prompts per language–misuse category cell and 30 generation attempts per prompt, giving 200 prompts and 6,000 outputs per model. These prompts are designed to form a separate catalog covering cryptographic functionalities shared with the resource construction tasks. We reuse the prompts and attempt seeds across conditions. We evaluate Cell DiffMean, Pooled DiffMean, Normalized DiffMean, and CrypSteer at α = ±1, and 7

Model

Metric (%)

α = −1

α=0

α = +1

Cell Pooled Normalized Cell Pooled Normalized Baseline DiffMean DiffMean DiffMean CrypSteer DiffMean DiffMean DiffMean CrypSteer secure@1 62.08 valid@1 72.67 secure-valid@1 47.52

39.28 66.97 28.25

45.97 64.73 32.12

37.58 58.67 23.08

33.22 53.78 18.20

71.90 68.23 52.33

72.12 70.02 54.40

74.88 69.47 56.33

77.08 69.50 57.18

secure@1 46.27 37.92 CodeGemma valid@1 secure-valid@1 21.33

32.23 36.27 12.63

33.03 38.30 15.28

30.57 36.47 13.37

28.63 35.25 12.22

54.07 39.43 25.67

53.73 36.95 24.30

55.45 38.37 25.95

56.68 39.30 26.53

secure@1 56.17 valid@1 74.68 secure-valid@1 44.83

38.95 71.55 29.63

41.55 71.20 32.52

35.90 68.62 27.07

36.15 69.70 27.38

63.65 70.77 48.67

64.10 72.03 48.65

67.95 73.10 51.58

66.97 72.00 50.53

secure@1 64.23 Qwen-Coder valid@1 73.82 secure-valid@1 50.58

54.85 74.87 44.62

55.32 74.77 45.23

51.47 74.80 42.67

50.43 74.82 41.35

67.77 72.68 51.93

68.50 71.88 51.40

69.70 71.23 52.28

69.52 72.15 52.90

secure@1 61.87 valid@1 89.12 secure-valid@1 55.83

50.20 88.17 44.57

54.50 87.17 48.25

50.38 87.28 44.68

50.82 87.37 45.05

69.03 86.40 60.80

67.62 86.92 59.98

68.47 86.67 60.62

68.72 86.92 60.87

Llama

Qwen

DeepSeek

Table 5: Single-generation success rates over 6,000 outputs per model and condition. Bold marks the highest secure@1 and secure-valid@1 among the four directions at α = +1 for each model. Underlining marks the lowest secure@1 at α = −1, corresponding to the largest observed decrease.

Excluded from direction fitting Model

Metric

15.00 9.80 9.53 5.05 11.37 5.98 5.02 1.77 5.10 2.82

13.20 8.57 8.27 4.40 10.20 5.65 3.87 1.57 6.53 4.18

13.42 9.05 8.02 4.50 9.88 5.60 4.47 1.62 6.73 4.58

Llama

SCS-Code Surgical Repair CrypSteer

75.45 66.57 77.08

72.62 70.87 69.50

58.47 50.62 57.18

SCS-Code CodeGemma Surgical Repair CrypSteer

51.50 51.20 56.68

40.35 39.58 39.30

25.02 23.80 26.53

SCS-Code Surgical Repair CrypSteer

63.17 60.30 66.97

73.93 71.42 72.00

50.05 45.12 50.53

SCS-Code Qwen-Coder Surgical Repair CrypSteer

65.40 64.43 69.52

74.30 74.27 72.15

51.43 50.95 52.90

SCS-Code Surgical Repair CrypSteer

62.15 63.40 68.72

85.98 88.52 86.92

54.98 56.63 60.87

Qwen

Table 6: CrypSteer gains over the unsteered baseline in percentage points at +1σ. None denotes full-source fitting.

DeepSeek

Table 7: Direction construction comparisons under common +1σ steering. Bold marks the highest secure@1 and secure-valid@1 among the three methods.

tors larger influence, while Normalized DiffMean gives each repair equal weight regardless of length. Together with the norm variation analysis, this comparison supports combining orientations with equal influence for each repair. Component selection gives CrypSteer the highest secure-valid@1 improvement in four models. This suggests that component selection captures more distribution structure of repair vector directions and the cross-misuse category alignments, and provides additional security benefits. 4.3

Method

None Language Misuse Both

secure@1 15.00 secure-valid@1 9.67 Code secure@1 10.42 Gemma secure-valid@1 5.20 secure@1 10.80 Qwen secure-valid@1 5.70 Qwensecure@1 5.28 Coder secure-valid@1 2.32 secure@1 6.85 DeepSeek secure-valid@1 5.03 Llama

securesecure@1 valid@1 valid@1

Model

direction fitting. For each target cell, language exclusion retains all ten misuse categories in the other three languages. Misuse category exclusion retains the other nine misuse categories in all four languages. Joint exclusion retains the other nine misuse categories in the other three languages. These fits use 9,000, 10,800, and 8,100 original-level repair vectors, respectively. We repeat SVD, component and orientation selection on each retained subset. A languageexcluded direction is reused for that language’s

Reuse with Excluded Fitting Sources

We next test how much shared control depends on including the target language or misuse category in 8

ten misuse categories. A misuse category-excluded direction is reused for that misuse category in four languages. A joint exclusion direction is used for the target cell. This gives four, ten, and forty directions per model. We evaluate the resulting directions on the same task descriptions, with the same layer and scale determined from the full corpus. As shown in Table 6, CrypSteer’s useful control extends beyond the languages and misuse categories used to fit a direction. All exclusion settings retain positive security gains for every model, supporting reuse across languages and misuse categories. This provides an interpretation for repair vector geometry. Different misuse categories have different repair patterns, but changes from retained misuse categories can guide safer choices in the excluded misuse category.

Rate (%)

4.4

Figure 4: CrypSteer strength responses, with 6,000 outputs per point. Zero is the unsteered baseline.

Llama CodeGemma 100

DeepSeek

(a) secure@1

50 0 100

(b) valid@1

50 0 100

(c) secure-valid@1

50 0

Comparing with Other Security Steering Methods

We compare CrypSteer with two other ways to obtain a steering direction. We use SCS-Code’s code-choice judgments (Wendlinger et al., 2026) and Surgical Repair’s contrasting implementation instructions (Sandoval et al., 2026). We use our paired program repair dataset for SCS-Code, and design a set of contrasting instructions for uses of cryptographic APIs for Surgical Repair. We extract the activation differences following their respective extraction procedures, and average them to derive a shared direction for activation steering. We normalize each vector to obtain a steering direction and evaluate it with the same prompts, layer, scale, and +1σ intervention. Table 7 shows that CrypSteer achieves the highest security rate in all models, while the joint outcome depends on how well the intervention preserves structural validity. For Llama, SCS-Code yields more structurally valid outputs and a slightly higher secure-valid@1. The results suggest that program repair differences are a useful source of steering directions, while different methods have different trade-offs between target security and structural validity. Appendix G details the input construction, extraction, and paired comparisons. 4.5

Qwen Qwen-Coder

−1

0

0.5

1

Steering strength (model-specific σ)

2

+1σ to +2σ reduces structural validity and lowers secure-valid@1 in four models. The curves support +1σ as a practical reference strength across the five models. Scaling the intervention by each model’s program representation spread gives a useful balance between security and validity across the evaluated models. This distinction between target security and structural validity parallels the separation between preference and utility in Xu et al. (2026). Here, the target preference is a secure API choice, and utility concerns whether the implementation satisfies the requested program requirements measured by structural validity. These objectives interact because a changed API choice must remain compatible with imports, arguments, and operations. Their interaction motivates a complementary direction learned from repairs that restore structural validity while retaining the target security choice.

5

Related Work

Improving the Security of LLM-Generated Code. Researchers have developed several techniques for improving the security of LLMgenerated code. Training-based approaches use security-related examples or objectives to update model parameters or learn additional prefixes (He and Vechev, 2023; He et al., 2024; Xu et al., 2025). Prompt-based approaches provide explicit security instructions and optimize prompt wording (Tony et al., 2025a; Nazzal et al., 2024). Retrieval-based

Intervention Strength and Outcome Variation

Steering strength affects the balance between target security and structural validity. As shown in Figure 4, moderate positive steering improves security and the joint outcome together. But moving from 9

methods supply security-related knowledge, examples, and coding guidelines in the input context (Zhang et al., 2024; Tony et al., 2025b; Lu et al., 2026). Decoding-time control methods guide nexttoken selection using a security-focused helper model or masking rule (Li et al., 2024; Storhaug et al., 2023). Feedback-guided generation and repairs use program analysis results to revise the candidate program (Le et al., 2024; Kulsum et al., 2024). These methods can also be combined, and a system can first retrieve security guidelines and then iteratively revise the generated program (Tony et al., 2025b). Our study connects controlled API edits to internal representation changes and generation-time intervention for safer code generation.

pairs (Yu et al., 2025). DuoSteer combines separate safety and correctness directions at selected attention heads (Yan and Yao, 2026), while T HEA identifies vulnerability-related sparse-autoencoder features (El Husseini et al., 2026). However, adverse steering of security steering remain and crossvulnerability transferability remains unclear (Yan and Yao, 2026). These studies motivate examining shared changes across repairs and their effects on generation.

6

Conclusion

This study connects the representation of cryptographic API misuse repairs to safer code generation. Matched program pairs reveal categoryspecific repair vectors with shared structure across languages and misuse categories. CrypSteer turns these shared changes into one steering direction and improves the proportion of outputs that are both secure and structurally valid across all five models. Refitting after source exclusion connects this control to repairs beyond the target language and misuse category. These findings establish controlled program repair as a useful basis for understanding and improving security-sensitive decisions in code models, and motivate shared repair directions for other vulnerabilities and complementary interventions for security and validity.

Activation Steering. Activation steering is a control technique within representation engineering that guides generation by modifying a model’s internal activations (Subramani et al., 2022; Rimsky et al., 2024). Subtracting the average activations of negative examples from those of positive examples gives a steering direction known as DiffMean (Rimsky et al., 2024). The DiffMean direction has outperformed classifier-weight directions in evaluations of truthfulness, instruction following, and fluency (Li et al., 2023; Wu et al., 2025). Effectiveness varies across models and tasks (Da Silva et al., 2025), and interventions can shift individual inputs away from the intended response (Tan et al., 2024). The linear representation hypothesis provides a basis for studying these directions. Concept-related variation can be expressed along directions in representation space (Park et al., 2024; Jiang et al., 2024). Hierarchical child features can retain a shared parent component while adding orthogonal refinements (Park et al., 2025). Separable concepts are orthogonal under a causal inner product (Park et al., 2024). These results motivate examining common components alongside category-specific repair variation.

Limitations Our resource covers all ten cryptographic API misuse categories identified by Mousavi et al. (2024) in LLM-generated programs and four widely used programming languages (Charisma, 2026), with four structural variants per original program. It is built from LLM-generated candidates and controlled rewrites. We study five 7B–16B instructiontuned models with dense and Mixture-of-Experts (MoE) architectures. However, human-written programs, larger repositories, alternative implementations, and larger models remain to be evaluated. The held-out alignment analysis uses the layer selected from the full corpus. The source-exclusion steering also retains the full-source intervention scale. Further independent evaluation would select layers and calibrate scales using only fitting data. Projection diagnostics use specific templates and API implementations. Testing additional forms would assess their generality. Evaluation measures structural validity and compliance with the target security policy adapted

Steering for Code Generation. Activation steering has been used to control programming language and library choices (Rahman et al., 2026) and improve test diversity (Zhu et al., 2026). For security, SCS-Code builds directions from answer-position activations in security judgments (Wendlinger et al., 2026). Surgical Repair constructs directions from paired secure/insecure implementation instructions (Sandoval et al., 2026). MoC constructs directions from secure and vulnerable program 10

from Mousavi et al. (2024). But deployment requires broader security checks. Evaluator errors may affect results. One author conducted an audit of the evaluators, but an independent second annotator would allow us to further assess evaluator reliability. In the comparison with other security steering methods, we adapt SCS-Code (Wendlinger et al., 2026) and Surgical Repair (Sandoval et al., 2026) with our dataset and contrasting instructions. We use a common layer, generation settings, and +1σ intervention strength for fair comparison of the steering vectors. However, each method’s layer and intervention strength could be optimized separately to get a better result.

2024. CodeGemma: Open code models based on Gemma. Preprint, arXiv:2406.11409. Patrick Queiroz Da Silva, Hari Sethuraman, Dheeraj Rajagopal, Hannaneh Hajishirzi, and Sachin Kumar. 2025. Steering off course: Reliability challenges in steering language models. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 19856–19882, Vienna, Austria. Association for Computational Linguistics. DeepSeek-AI, Qihao Zhu, Daya Guo, Zhihong Shao, Dejian Yang, Peiyi Wang, Runxin Xu, Y. Wu, Yukun Li, Huazuo Gao, Shirong Ma, Wangding Zeng, Xiao Bi, Zihui Gu, Hanwei Xu, Damai Dai, Kai Dong, Liyue Zhang, Yishi Piao, and 21 others. 2024. DeepSeek-Coder-V2: Breaking the barrier of closed-source models in code intelligence. Preprint, arXiv:2406.11931.

Ethical Considerations

Rotem Dror, Gili Baumer, Segev Shlomov, and Roi Reichart. 2018. The hitchhiker’s guide to testing statistical significance in natural language processing. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 1383–1392, Melbourne, Australia. Association for Computational Linguistics.

Our method aligns with the goal of making AI systems more helpful and harmless. By steering the outputs of code models, we contribute to reducing cryptographic API misuse in generated programs, thereby enhancing the safety and reliability of AI code assistants. However, reversing the activation steering direction lowers the security rate, which shows a dual-use risk. The insecure program examples and negative interventions allow us to study models’ internal representations and evaluate the effect of activation steering, but they could also be used to weaken code assistants. We encourage users of this technique to be responsible and avoid increasing unsafe or harmful behaviors via steering.

Carl Eckart and Gale Young. 1936. The approximation of one matrix by another of lower rank. Psychometrika, 1(3):211–218. Ali El Husseini, Yacine Izza, Blaise Genest, and Abhik Roychoudhury. 2026. Repairing LLM executions for secure automatic programming. In Proceedings of the 2026 IEEE/ACM 48th International Conference on Software Engineering, ICSE ’26, page 818–829, New York, NY, USA. Association for Computing Machinery. Kawin Ethayarajh. 2019. How contextual are contextualized word representations? Comparing the geometry of BERT, ELMo, and GPT-2 embeddings. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pages 55–65, Hong Kong, China. Association for Computational Linguistics.

References Yonatan Belinkov. 2022. Probing classifiers: Promises, shortcomings, and advances. Computational Linguistics, 48(1):207–219. Charisma. 2026. Top coding languages for computer programming in 2026. Charisma University. Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde de Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, Alex Ray, Raul Puri, Gretchen Krueger, Michael Petrov, Heidy Khlaaf, Girish Sastry, Pamela Mishkin, Brooke Chan, Scott Gray, and 39 others. 2021. Evaluating large language models trained on code. Preprint, arXiv:2107.03374.

Tom Fawcett. 2006. An introduction to ROC analysis. Pattern Recognition Letters, 27(8):861–874. ROC Analysis in Pattern Recognition. Xiachong Feng, Liang Zhao, Weihong Zhong, yichong Huang, Yuxuan Gu, Lingpeng Kong, Xiaocheng Feng, and Bing Qin. 2026. PERSONA: Dynamic and compositional inference-time personality control via activation vector algebra. In International Conference on Learning Representations, volume 2026, pages 151839–151879.

CodeGemma Team, Heri Zhao, Jeffrey Hui, Joshua Howland, Nam Nguyen, Siqi Zuo, Andrea Hu, Christopher A. Choquette-Choo, Jingyue Shen, Joe Kelley, Kshitij Bansal, Luke Vilnis, Mateo Wirth, Paul Michel, Peter Choy, Pratik Joshi, Ravin Kumar, Sarmad Hashmi, Shubham Agrawal, and 8 others.

Andrew Gelman. 2005. Analysis of variance—why it is more important than ever. The Annals of Statistics, 33(1):1 – 53.

11

Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad AlDahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, Amy Yang, Angela Fan, Anirudh Goyal, Anthony Hartshorn, Aobo Yang, Archi Mitra, Archie Sravankumar, Artem Korenev, Arthur Hinsvark, and 540 others. 2024. The Llama 3 herd of models. Preprint, arXiv:2407.21783.

Ian T Jolliffe and Jorge Cadima. 2016. Principal component analysis: A review and recent developments. Philosophical transactions. Series A, Mathematical, physical, and engineering sciences, 374(2065):20150202. Nikolaus Kriegeskorte, Marieke Mur, and Peter A. Bandettini. 2008. Representational similarity analysis - connecting the branches of systems neuroscience. Frontiers in Systems Neuroscience, Volume 2 - 2008.

Daya Guo, Shuai Lu, Nan Duan, Yanlin Wang, Ming Zhou, and Jian Yin. 2022. UniXcoder: Unified crossmodal pre-training for code representation. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 7212–7225, Dublin, Ireland. Association for Computational Linguistics.

Stefan Krüger, Johannes Späth, Karim Ali, Eric Bodden, and Mira Mezini. 2021. CrySL: An extensible approach to validating the correct usage of cryptographic APIs. IEEE Transactions on Software Engineering, 47(11):2382–2400. Ummay Kulsum, Haotian Zhu, Bowen Xu, and Marcelo d’Amorim. 2024. A case study of LLM for automated vulnerability repair: Assessing impact of reasoning and patch validation feedback. In Proceedings of the 1st ACM International Conference on AI-Powered Software, AIware 2024, page 103–111, New York, NY, USA. Association for Computing Machinery.

Jingxuan He and Martin Vechev. 2023. Large language models for code: Security hardening and adversarial testing. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, CCS ’23, page 1865–1879, New York, NY, USA. Association for Computing Machinery. Jingxuan He, Mark Vero, Gabriela Krasnopolska, and Martin Vechev. 2024. Instruction tuning for secure code generation. In Proceedings of the 41st International Conference on Machine Learning, ICML’24. JMLR.org.

Hung Le, Yingbo Zhou, Caiming Xiong, Silvio Savarese, and Doyen Sahoo. 2024. INDICT: Code generation with internal dialogues of critiques for both security and helpfulness. In Advances in Neural Information Processing Systems, volume 37, pages 85546–85582. Curran Associates, Inc.

Evan Hernandez, Belinda Z. Li, and Jacob Andreas. 2024. Inspecting and editing knowledge representations in language models. In First Conference on Language Modeling.

Dong Li, Meng Yan, Yaosheng Zhang, Zhongxin Liu, Chao Liu, Xiaohong Zhang, Ting Chen, and David Lo. 2024. CoSec: On-the-fly security hardening of code LLMs via supervised co-decoding. In Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis, ISSTA 2024, page 1428–1439, New York, NY, USA. Association for Computing Machinery.

Tim Hesterberg. 2011. Bootstrap. WIREs Computational Statistics, 3(6):497–526. Sture Holm. 1979. A simple sequentially rejective multiple test procedure. Scandinavian Journal of Statistics, 6(2):65–70.

Kenneth Li, Oam Patel, Fernanda Viégas, Hanspeter Pfister, and Martin Wattenberg. 2023. Inference-time intervention: Eliciting truthful answers from a language model. In Advances in Neural Information Processing Systems, volume 36, pages 41451–41530. Curran Associates, Inc.

Lawrence Hubert and Phipps Arabie. 1985. Comparing partitions. Journal of Classification, 2(1):193–218. Binyuan Hui, Jian Yang, Zeyu Cui, Jiaxi Yang, Dayiheng Liu, Lei Zhang, Tianyu Liu, Jiajun Zhang, Bowen Yu, Keming Lu, Kai Dang, Yang Fan, Yichang Zhang, An Yang, Rui Men, Fei Huang, Bo Zheng, Yibo Miao, Shanghaoran Quan, and 5 others. 2024. Qwen2.5-Coder technical report. Preprint, arXiv:2409.12186.

Tianhe Lu, Eric Spero, Sakuna Harinda Jayasundara, Robert Biddle, and Giovanni Russello. 2026. From retrieved evidence to security outcomes: A datadriven analysis of Java security API misuse in LLMGenerated code. Preprint, arXiv:2605.31135.

Paras Jain, Ajay Jain, Tianjun Zhang, Pieter Abbeel, Joseph Gonzalez, and Ion Stoica. 2021. Contrastive code representation learning. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 5954–5971, Online and Punta Cana, Dominican Republic. Association for Computational Linguistics.

Patrick Mair, Patrick J. F. Groenen, and Jan de Leeuw. 2022. More on multidimensional scaling and unfolding in R: smacof version 2. Journal of Statistical Software, 102(10):1–47. Zahra Mousavi, Chadni Islam, Kristen Moore, Alsharif Abuadbba, and M. Ali Babar. 2024. An investigation into misuse of Java security APIs by large language models. In Proceedings of the 19th ACM Asia Conference on Computer and Communications Security, ASIA CCS ’24, page 1299–1315, New York, NY, USA. Association for Computing Machinery.

Yibo Jiang, Goutham Rajendran, Pradeep Ravikumar, Bryon Aragam, and Victor Veitch. 2024. On the origins of linear representations in large language models. In Proceedings of the 41st International Conference on Machine Learning, ICML’24. JMLR.org.

12

Sarah Nadi, Stefan Krüger, Mira Mezini, and Eric Bodden. 2016. Jumping through hoops: why do Java developers struggle with cryptography APIs? In Proceedings of the 38th International Conference on Software Engineering, ICSE ’16, page 935–946, New York, NY, USA. Association for Computing Machinery.

Nicholas Sofroniew, Isaac Kauvar, William Saunders, Runjin Chen, Tom Henighan, Sasha Hydrie, Craig Citro, Adam Pearce, Julius Tarng, Wes Gurnee, Joshua Batson, Sam Zimmerman, Kelley Rivoire, Kyle Fish, Chris Olah, and Jack Lindsey. 2026. Emotion concepts and their function in a large language model. Preprint, arXiv:2604.07729.

Mahmoud Nazzal, Issa Khalil, Abdallah Khreishah, and NhatHai Phan. 2024. PromSec: Prompt optimization for secure generation of functional source code with large language models (LLMs). In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, CCS ’24, page 2266–2280, New York, NY, USA. Association for Computing Machinery.

André Storhaug, Jingyue Li, and Tianyuan Hu. 2023. Efficient avoidance of vulnerabilities in autocompleted smart contract code using vulnerabilityconstrained decoding. In 2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE), pages 683–693. Nishant Subramani, Nivedita Suresh, and Matthew Peters. 2022. Extracting latent steering vectors from pretrained language models. In Findings of the Association for Computational Linguistics: ACL 2022, pages 566–581, Dublin, Ireland. Association for Computational Linguistics.

Kiho Park, Yo Joong Choe, Yibo Jiang, and Victor Veitch. 2025. The geometry of categorical and hierarchical concepts in large language models. In International Conference on Learning Representations, volume 2025, pages 76441–76463. Kiho Park, Yo Joong Choe, and Victor Veitch. 2024. The linear representation hypothesis and the geometry of large language models. In Proceedings of the 41st International Conference on Machine Learning, ICML’24. JMLR.org.

Daniel Tan, David Chanin, Aengus Lynch, Brooks Paige, Dimitrios Kanoulas, Adrià Garriga-Alonso, and Robert Kirk. 2024. Analysing the generalisation and reliability of steering vectors. In Advances in Neural Information Processing Systems, volume 37, pages 139179–139212. Curran Associates, Inc.

Hammond Pearce, Baleegh Ahmad, Benjamin Tan, Brendan Dolan-Gavitt, and Ramesh Karri. 2025. Asleep at the keyboard? assessing the security of GitHub Copilot’s code contributions. Commun. ACM, 68(2):96–105.

Catherine Tony, Nicolás E. Díaz Ferreyra, Markus Mutas, Salem Dhif, and Riccardo Scandariato. 2025a. Prompting techniques for secure code generation: A systematic investigation. ACM Trans. Softw. Eng. Methodol., 34(8).

Neil Perry, Megha Srivastava, Deepak Kumar, and Dan Boneh. 2023. Do users write more insecure code with AI assistants? In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, CCS ’23, page 2785–2799, New York, NY, USA. Association for Computing Machinery.

Catherine Tony, Emanuele Iannone, and Riccardo Scandariato. 2025b. Retrieve, refine, or both? using taskspecific guidelines for secure Python code generation. In 2025 IEEE International Conference on Software Maintenance and Evolution (ICSME), pages 368–379.

Qwen, An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, Huan Lin, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Yang, Jiaxi Yang, Jingren Zhou, Junyang Lin, and 24 others. 2025. Qwen2.5 technical report. Preprint, arXiv:2412.15115.

Alexander Matt Turner, Lisa Thiergart, Gavin Leech, David Udell, Juan J. Vazquez, Ulisse Mini, and Monte MacDiarmid. 2024. Steering language models with activation engineering. Preprint, arXiv:2308.10248. Maximilian Wendlinger, Daniel Kowatsch, Konstantin Böttinger, and Philip Sperl. 2026. Security-by-design for LLM-Based code generation: Leveraging internal representations for concept-driven steering mechanisms. In 2026 IEEE 11th European Symposium on Security and Privacy (EuroS&P), pages 658–678.

Md Mahbubur Rahman, Arjun Guha, and Harshitha Menon. 2026. Steering code LLMs with activation directions for language and library control. Preprint, arXiv:2603.23629.

Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Remi Louf, Morgan Funtowicz, Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Scao, Sylvain Gugger, and 3 others. 2020. Transformers: State-of-the-art natural language processing. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, pages 38–45, Online. Association for Computational Linguistics.

Nina Rimsky, Nick Gabrieli, Julian Schulz, Meg Tong, Evan Hubinger, and Alexander Turner. 2024. Steering Llama 2 via contrastive activation addition. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 15504–15522, Bangkok, Thailand. Association for Computational Linguistics. Gustavo Sandoval, Brendan Dolan-Gavitt, and Siddharth Garg. 2026. Surgical repair of insecure code generation in LLMs. Preprint, arXiv:2604.16697.

13

Zhengxuan Wu, Aryaman Arora, Atticus Geiger, Zheng Wang, Jing Huang, Dan Jurafsky, Christopher D. Manning, and Christopher Potts. 2025. AXBENCH: steering LLMs? even simple baselines outperform sparse autoencoders. In Proceedings of the 42nd International Conference on Machine Learning, ICML’25. JMLR.org.

Representation engineering: A top-down approach to AI transparency. Preprint, arXiv:2310.01405.

Xiangzhe Xu, Zian Su, Jinyao Guo, Kaiyuan Zhang, Zhenting Wang, and Xiangyu Zhang. 2025. PROSEC: fortifying code LLMs with proactive security alignment. In Proceedings of the 42nd International Conference on Machine Learning, ICML’25. JMLR.org.

A

Resource Construction

A.1

Dataset Organization and Task Coverage

The resource is organized by the ten misuse categories M01–M10 in Table 1. We allocate 300 originals per language–misuse category cell, giving every cell equal representation in direction construction. This design yields 1,200 originals per misuse category across the four languages and 12,000 originals in total. Programming tasks provide contexts in which these security decisions vary. The eight functionalities in Table 8 each provide three tasks, giving 24 tasks per language and 96 language-specific task texts. We distribute each cell’s 300 originals evenly over its applicable tasks. M01 covers symmetric encryption (F1) and message authentication codes (F6), while M04 covers asymmetric encryption (F3) and digital signatures (F4). These two misuse categories use six tasks per language, with 50 originals per task. Other misuse categories use three tasks with 100 originals per task. When a task is relevant to multiple misuse categories, we allocate separate originals and target rewrites to each misuse category. Therefore, all misuse categories receive the same total number of originals. We retain the functionality and misuse IDs used by Mousavi et al. (2024) and adapt their Java tasks to the APIs of four languages. Java uses standard cryptography APIs, TypeScript uses Node.js builtins, C# uses .NET APIs, and Python uses PyCA cryptography and standard-library cryptographic and randomness APIs. The Java workflow for F8 (Key storage) functionality in Mousavi et al. (2024) has no direct counterpart shared by the native API families selected for all four languages. Therefore, we omit F8 functionality. Its target misuse M08 (hardcoded constant password) remains covered by F7 functionality. Their original M05 misuse concerns constant or predictable PRNG seeds. However, caller-controlled seeding is not uniformly available in the cryptographic random APIs across the four languages. Therefore, we adapt M05 to the choice between a cryptographically secure random generator and a general-purpose PRNG for a security-sensitive value. Other misuse categories and classification policies follow Mousavi et al. (2024).

Ziwen Xu, Chenyan Wu, Hengyu Sun, Haiwen Hong, Mengru Wang, Yunzhi Yao, Longtao Huang, Hui Xue, Shumin Deng, Zhixuan Chu, Huajun Chen, and Ningyu Zhang. 2026. Why steering works: Toward a unified view of language model parameter dynamics. In Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 31719–31736, San Diego, California, United States. Association for Computational Linguistics. Hao Yan and Ziyu Yao. 2026. Interpreting and steering for safe and correct code generation. Preprint, arXiv:2608.30025. Weichen Yu, Ravi Mangal, Terry Zhuo, Matt Fredrikson, and Corina S. Pasareanu. 2025. A mixture of linear corrections generates secure code. Preprint, arXiv:2507.09508. Boyu Zhang, Tianyu Du, Junkai Tong, Xuhong Zhang, Kingsum Chow, Sheng Cheng, Xun Wang, and Jianwei Yin. 2024. SecCoder: Towards generalizable and robust secure code generation. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 14557–14571, Miami, Florida, USA. Association for Computational Linguistics. Haiyan Zhao, Xuansheng Wu, Fan Yang, Bo Shen, Ninghao Liu, and Mengnan Du. 2026. Denoising concept vectors with sparse autoencoders for improved language model steering. In Findings of the Association for Computational Linguistics: EACL 2026, pages 797–808, Rabat, Morocco. Association for Computational Linguistics. Dongxuan Zhu, Ly Khanh, Andy Yat-Ming Cheung, Man-Chung Yue, and Viet Anh Nguyen. 2026. Exploring diverse generation paths via inference-time stiefel activation steering. In International Conference on Learning Representations, volume 2026, pages 76531–76565. Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, Shashwat Goel, Nathaniel Li, Michael J. Byun, Zifan Wang, Alex Mallen, Steven Basart, Sanmi Koyejo, Dawn Song, Matt Fredrikson, and 2 others. 2025.

14

Functionality

Description

Categories

F1: Symmetric encryption F2: Symmetric encryption in CBC mode F3: Asymmetric encryption F4: Digital signature F5: Hash functions F6: Message authentication code (MAC)

Encrypt and decrypt data with the same secret key. M01, M02 Encrypt data using cipher block chaining (CBC) and an IV. M03 Encrypt with a public key and decrypt with the private key. M04 Produce a signature with a private key and verify it with a public key. M04 Compute a fixed-length digest for detecting changes to data. M09 Compute a keyed authentication tag to check integrity and M01, M10 authenticity. F7: Key derivation function (KDF) Derive cryptographic key material from a password. M06–M08 F9: Pseudorandom number generator (PRNG) Generate pseudorandom values for cryptographic operations. M05

Table 8: Cryptographic functionalities from Mousavi et al. (2024), retaining their IDs. Categories identify the targeted misuses in our resource.

Structure

pendix C. We checked the quality of the corpus before including them in the representation corpus. We check parsing or compilation acceptance, imports, API use, required operations, API arguments, and operation sequence of each program in the dataset, as detailed in Appendix H. All 96,000 programs in the corpus are structurally valid. We also check all ten misuse categories and confirm that each misuse rewrite contains only the target misuse, and each secure rewrite contains the secure use of the corresponding API. For non-target categories, relevant API use is either secure or absent. The first author manually inspected 3% of programs in the dataset and confirmed that they were structurally valid and their API use matched their intended security label.

Value placement Construction

variable_inline Variable variable_helper Variable callsite_inline Call site callsite_helper Call site

Inline Helper return Inline Helper return

Table 9: Four forms of each secure/misuse pair.

A.2

Generation, Rewriting, and Validation

Original programs provide varied implementations from which to construct matched program pairs. They are generated independently by five GPT models (gpt-4.1-mini-2025-04-14, gpt-5.1 -2025-11-13, gpt-5.2-2025-12-11, gpt-5.4 -mini-2026-03-17, and gpt-5.6-luna), with equal weights for program diversity. We remove duplicates and select originals that use the required APIs, implement the requested operation, and expose an editable target decision. We provide each original and its rewrite rules to gpt-5.6-sol. The rewrite rules specify secure and misuse implementations while preserving the task, input/output interface, entry point, and surrounding operations. Each original produces one secure and one misuse implementation in each of four structural forms. The four structural forms cross two choices about the target value. As shown in Table 9, the target value is either assigned to a variable or supplied at a call site, and is either constructed inline or returned by a helper function. Figure 5 gives an example: a key can be stored in a named variable before a cipher call, or supplied directly to that call. Either form can construct the key locally or inside a helper function. Thus, the structure change preserves the controlled security decision while varying how the value reaches the API. Each original contributes four matched secure/misuse pairs, or eight concrete programs. Their representation stability is examined in Ap-

A.3

Diagnostic Programs with Combined Security Choices

To examine how combining several API choices within a program affects its representation (Section 3.4), we construct a separate diagnostic corpus. Each language uses one program template containing ten cryptographic operations, one for each misuse category. Each operation decision can be changed while keeping the other nine choices fixed. Enumerating all 210 choices yields 1,024 programs per language and 4,096 programs overall, including all-secure and all-misuse endpoints. Appendix E describes the diagnostic analysis.

B

Representation and Intervention Details

B.1

Models and Program Representations

We use the released checkpoints and tokenizers in Section 2.3 through Hugging Face Transformers (Wolf et al., 2020). Representation extraction uses bfloat16 weights and a batch size of one. Layer indices count decoder blocks from zero, excluding 15

key = secrets.token_bytes(32) cipher = AESGCM(key)

cipher = AESGCM(secrets.token_bytes(32))

(a) variable_inline

(b) callsite_inline

def create_key_material(): return secrets.token_bytes(32)

def create_key_material(): return secrets.token_bytes(32)

key = create_key_material() cipher = AESGCM(key)

cipher = AESGCM(create_key_material())

(c) variable_helper

(d) callsite_helper

Figure 5: Example Python snippets showing the four structures for the same M01 key choice. Each secure form creates a 32-byte random key and constructs an AES-GCM cipher. The corresponding misuse form replaces secrets.token_bytes(32) with ’correct-horse-battery-staple-123’.encode(’utf-8’), keeping the structure unchanged. The package import, encryption and decryption operations are omitted in the example.

Model

Para- Total Selected AUROC Selected meters layers layer Jℓ PC

Llama CodeGemma Qwen Qwen-Coder DeepSeek

8B 7B 7B 7B 16B

32 28 28 28 27

14 18 17 16 11

0.783 0.803 0.793 0.821 0.784

1 1 2 1 1

B.2

σ

We select a common layer by measuring how well linear classifiers trained on some misuse categories or languages predict security labels in the others (Belinkov, 2022). At each layer, ten leave-onecategory-out folds train on nine misuse categories and evaluate on the remaining one, retaining all languages. Each fold contains 86,400 training and 9,600 evaluation program representations. For four leave-one-language-out folds, we train on three languages and evaluate on the remaining language, retaining all misuse categories. Each fold contains 72,000 training and 24,000 evaluation program representations. The probes are L2 -regularized logistic regression classifiers. For training representation h̄j , the predicted probability of the secure label is

1.45 3.74 12.26 17.58 2.72

Table 10: Model settings: layers indexed from zero, layer selection AUROC Jℓ (Equation 8), PCs indexed from one, and intervention scales σ.

the embedding layer. All selected layers are intermediate layers that contain the residual output after attention and feed-forward updates. Each program is supplied as source code without a chat template in one forward pass. Let hℓ,t (x) ∈ RD denote the token activation at position t and layer ℓ for program x, with hidden dimension D. We obtain its program representation h̄ℓ (x) by averaging token activations over the program body: h̄ℓ (x) =

1 |Ibody (x)|

X

hℓ,t (x),

Linear Probes and Layer Selection

pj =

1 , 1 + exp[−(w⊤ h̄j + b)]

(6)

where w and b are the probe weights and intercept. With yj = 1 for secure and yj = 0 for misuse, the loss over n training representations is

(5)

ℓj = −yj log pj − (1 − yj ) log(1 − pj ), n 1X ∥w∥22 LC (w, b) = ℓj + . n 2Cn

t∈Ibody (x)

where Ibody (x) contains the token positions overlapping the source code after the leading Java package/import declarations, TypeScript imports, C# using directives, or Python imports. The leading declarations remain in the input and provide context for later activations. Averaging the body positions gives every program a representation of the same dimension D despite differences in source length.

j=1

(7) This combines a binary cross-entropy loss with inverse regularization strength C = 1. We use the LBFGS algorithm and optimization tolerance 10−4 , and all fits converged within the 10,000-iteration limit. We score each fold by the AUROC, which measures how well the probe ranks secure programs 16

Llama TypeScript M02, Layer 14

above misuse programs (Fawcett, 2006). The layer score gives equal total weight to misuse category and language transfer:   10 4 X X 1 , Amisuse + 14 Alanguage Jℓ = 12  10 ℓ,g ℓ,a

B.4

Cosine

2% 0% 0.00

0.99

0.15

0.30

Raw repair norm

(b) Repair norm

Scale and Generation Settings

We calibrate intervention strength from the spread of program representations within each model. For Nprog = 96, 000 program representations h̄j at the 1 PNprog selected layer, let µh = Nprog j=1 h̄j . We use v u Nprog u X 1 t ∥h̄j − µh ∥22 . (11) σ= Nprog − 1 j=1

q b where Σ b is the sample Equivalently, σ = tr(Σ), covariance matrix (Jolliffe and Cadima, 2016). In the activation steering experiment, every unit direction receives the same perturbation norm |α|σ with a fixed α. The activation steering hook adds ασv to token activations at the selected decoder block’s output and updates the last prompt token and every decoding position. Each condition generates 30 attempts for each of five prompts per cell. Generation uses the model’s chat template with one user message, temperature 0.8, top-p 0.95, and at most 2,048 new tokens. Seeds 2000–2029 are reused across conditions for the 30 attempts.

For CrypSteer, Equation 3 defines the SVD objective. Let W = {v1 , −v1 , . . . , v10 , −v10 } be the set of twenty signed candidates with w ∈ W, and let Ig index the repairs in misuse category g. We measure each candidate’s alignment with repairs in every misuse category. We define 1 X ⊤ ui w, |Ig | i∈Ig

w∈W

0.96

4%

Figure 6: Structure agreement for 300 originals in Llama layer 14 TypeScript–M02 cell. (a) Each structure contributes 900 cosine values from comparisons with the other three structures within each original. (b) Each structure contributes 300 raw repair norms.

i=1

vCrypSteer ∈ arg max

0.93

(a) Direction cosine

For original-level repair vectors di from Equation 2, define unit(x) = x/∥x∥2 , and ui = unit(di ). With N = 12, 000 and Ic containing the 300 originals of cell c, the steering vectors for Cell DiffMean vcell,c , Pooled DiffMean vpooled , and Normalized DiffMean vnorm are ! 1 X di , vcell,c = unit |Ic | i∈Ic ! N 1 X (9) vpooled = unit di , N i=1 ! N 1 X ui . vnorm = unit N

10 X

4%

0%

Direction Construction

ag (w) =

Proportion

a=1

(8) language misuse where Aℓ,g and Aℓ,a are the AUROCs for held-out category g and language a, respectively. We select the layer with the highest Jℓ . Table 10 reports the selected layer and its Jℓ . B.3

variable/helper variable/inline

8%

Proportion

g=1

callsite/helper callsite/inline

(10) 1[ag (w) > 0],

C

g=1

where 1[·] is the indicator function, and ag (w) is candidate w’s mean cosine with category g’s repairs. A positive mean indicates alignment with the category’s secure-minus-misuse changes. Here vCrypSteer is the selected unit direction for CrypSteer steering. If multiple signed components rank for the first place, we select the component with the largest worst-category mean cosine. Each vector has unit length, which allows for fair comparison at the same intervention strength.

Representation Stability Across Program Structures

In the dataset, the controlled rewrites for each original appear in four code structures, which we average before fitting a shared direction. This provides a controlled way to examine how program organization affects its repair vector. We examine structure-specific repair vectors δi,s to assess their stability to support our choice of averaging repair vectors for four program structures before fitting a shared direction. 17

C.1

An Illustration at the Original Level

references, one for each candidate misuse category k, by averaging its unit directions from the other three structures in the same language.   X 1 cl,k,−s = unit al,k,r  . (14) 3

We first inspect whether the four repair vectors for each original point in similar directions and have similar lengths. We give an example in Figure 6 to show what agreement looks like. The example is the TypeScript-M02 cell at Llama’s selected layer. For each of the 300 originals, four vectors yield six distinct pairwise cosine similarities. Figure 6(a) groups these comparisons by structure. Each distribution compares one structure with the other three across 300 originals, giving 300 × 3 = 900 cosine values. Each pairwise comparison appears in two curves, one for each structure. Across the 300 × 6 = 1, 800 comparisons, the mean cosine is 0.988, indicating close alignment. Figure 6(b) shows the repair vector norms, with 300 values per structure. These distributions include differences in repair length between originals. To isolate variation among the four forms of the same original, we compute their coefficient of variation (CV), which is the population standard deviation dividedP by their mean. Writing ri,s = ∥δi,s ∥2 and r̄i = 41 s ri,s , the CV is q P 4 1 2 s=1 (ri,s − r̄i ) 4 CVi = . (12) r̄i

r̸=s

We assign the category with the highest cosine similarity gb = arg maxk∈{1,...,10} a⊤ l,g,s cl,k,−s . This dot product is the cosine similarity as they have unit length. Retrieval is correct when gb = g. Repeating this procedure for four languages, ten misuse category queries, and four structures gives 4 × 10 × 4 = 160 queries per model. The results show that all models correctly recover the category for 159 or 160 queries. Therefore, the identity of the misuse category is largely preserved in the four structures. This supports averaging the four repair vectors within each original to summarize their signals before constructing a shared direction.

D

We conduct additional geometry analysis to examine whether repair vectors are organized by misuse category across languages, how much language changes that organization, and whether it persists across layers. For each cell with language l and misuse category g, let Il,g index its 300 originals. We average repair differences di from Equation 2 to get the cell’s mean repair difference d¯l,g , then normalize the resulting mean to get its unit-length direction vcell,l,g , which is the Cell DiffMean direction vcell,c in Appendix B.3 with c = (l, g) written explicitly.

The average CV across the 300 originals is 1.36%. Therefore, within a cell, changing code structure has little effect on either the direction or the length of the repair vector, which supports averaging the four vectors to represent the repair of each original program. C.2

Additional Geometry Analysis and Clustering

Category Correspondence Across Structures

We next test whether category-level directions remain recognizable across structures throughout the resource. Given a misuse category’s direction in one structure, we find its closest match among ten category references built from the other three structures in the same language. For example, the TypeScript M02 direction should be closest to the M02 reference among all misuse category references. For language l, misuse category g, and structure s, the direction to be matched is   X 1 al,g,s = unit δi,s  . (13) 300

1 X d¯l,g = di , 300 i∈Il,g

d¯l,g vcell,l,g = ¯ . ∥dl,g ∥2

(15)

Normalization preserves the orientation while removing its magnitude, which allows comparison of the 40 cell directions independently of their lengths. D.1

i∈(l,g)

Category Alignment and Repair Magnitude

We first use cosine similarity to test whether the same misuse category repair has a recognizable direction across different languages. We compare

where unit(x) = x/∥x∥2 . We treat al,g,s as the query. We hold out structure s, and construct ten 18

the other three languages and choose the one that has the highest cosine similarity to it:   X 1 vref,−l,k = unit vcell,b,k  , 3 (16)

CodeGemma M01

M01

M02

M02

M03

M03

M04

M04

M05

M05

M06

M06

M07

M07

M08

M08

M09

M09

M10

M10

b̸=l

gb = arg

max k∈{1,...,10}

⊤ vcell,l,g vref,−l,k .

Qwen M01

M01

M02

M02

M03

M03

M04

M04

M05

M05

M06

M06

M07

M07

M08

M08

M09

M09

M10

where unit(x) = x/∥x∥2 , and vref,−l,k is the unit reference direction for misuse category k, formed without language l. A match is correct when gb = g. There are 40 queries per model, one for each language-misuse category cell. The results are shown in the correct category matches column in Table 2. All six incorrect matches concern M05, which could be explained by the adaptation of M05 definition from Mousavi et al. (2024) and M05 concerns about choosing to use cryptographic API instead of misuse a cryptographic API. We also analyze the repair length because direction and length answer different questions. We average each original’s repair representation length within each cell to get a scalar mean ρl,g of them:

M10

Qwen-Coder M01

M01

M02

M02

M03

M03

M04

M04

M05

M05

M06

M06

M07

M07

M08

M08

M09

M09

M10

M10

DeepSeek

−1

0 Java

TypeScript

(a) Direction cosine

1 C#

(17)

The last column in Table 2 shows the maxl,g ρl,g / minl,g ρl,g , which compares the largest and smallest cell-average repair representation lengths. The substantial ratios show why we need to use unit repairs to construct a shared direction because the raw repair representations gives longer repairs more influence. In Section 3.1, we show repair representation geometry heatmaps for the selected layer for Llama. Figure 7 extends Figure 2 to the other four models. Figure 7(a) shows cross-language alignment by strong off-diagonal entries inside the diagonal blocks corresponding to individual misuse categories. Alignment also appears between some categories, such as M09 and M10. The horizontal and vertical bands in the norm ratio heatmap in Figure 7(b) show scale differences for different misuse categories.

M10

M09

M08

M07

M06

M05

1/32

M04

1

M03

M10 M02

M09

M10

1 X ∥di ∥2 . 300 i∈Il,g

M01

M08

M09

ρl,g =

M10

M08

M09

M07

M08

M07

M07

M06

M06

M05

M06

M05

M04

M05

M04

M03

M04

M03

M02

M03

M02

M01

M02

M01

M01

32

Python

(b) Norm ratio

Figure 7: Repair representation geometry for the other four models. Panel definitions and color scales follow Figure 2.

two sets of pairs. First, the same misuse category
in different languages, which gives 10 × 42 = 60 pairs. Second, different misuse categories within
10 one language, which gives 4 × 2 = 180 pairs. The two mean-cosine columns in Table 2 report the mean cosine for same category different language and same language different category pairs. The high same category mean cosine values indicate that the misuse category correspondence extends across programming languages.

D.2

Category and Language Main Effects

We use the sum-of-squares decomposition of balanced two-way analysis of variance (ANOVA) to quantify the variation associated with misuse category and programming language (Gelman, 2005). This analysis examines whether repair vectors are

We next use a retrieval test to ask whether a cell’s category can be identified from directions in other languages. For language l and misuse category g, the query is vcell,l,g . We build ten references using 19

Category main effect Language main effect

Llama CodeGemma Qwen Qwen-Coder DeepSeek

64.42% 70.80% 71.24% 72.39% 68.86%

0.5

Table 11: Category and language shares of total centered variation among 40 unit cell directions.

M07 M07 M09

M10

−0.5

M05

Category ARI Language ARI

Llama CodeGemma Qwen Qwen-Coder DeepSeek

0.565 0.657 0.771 0.798 0.895

−1.0

−0.046 −0.064 −0.110 −0.112 −0.119

Java

organized more strongly by misuse category or by programming language. Write vcell,l,g = vcell,c for cell c = (l, g). Let v̄ denote the mean of the 40 unit cell repair vectors, v̄l,· average the ten misuse category repair vectors in language l, and v̄·,g average misuse category g across four languages. We compare the total centered variation T , the variation between misuse category means SSG , and the variation between language means SSL : X T = ∥vcell,l,g − v̄∥22 , ∥v̄·,g − v̄∥22 ,

M06 M01

M01

TypeScript

M01

M03 M01

M03 M03

M03

M05 M05

M08 M08

0.0

MDS 1 C#

0.5

1.0

Python

index (ARI) (Hubert and Arabie, 1985). An ARI of 1 indicates that the clustering exactly matches the reference grouping, while scores around 0 indicate agreement comparable to random grouping. As shown in Table 12, the partitions correspond closely to misuse categories. Figure 8 uses metric multidimensional scaling (MDS) to approximate DeepSeek’s pairwise direction distances in two dimensions (Mair et al., 2022). The clusters largely bring together the four languages of the same category.

l,g

X

M06

Figure 8: DeepSeek cell directions at the selected layer, visualized with MDS. Colors denote clusters, shapes indicate languages, and point labels identify misuse categories.

Table 12: Agreement of the k = 10 clustering of 40 unit cell directions with category and language labels at the selected layer.

SSG = 4

M02

M08

−0.5

M06

M06 M02

M09 M10 M04 M09 M04 M10 M04 M10 M05 M04 M08

−1.0

Model

M07

M09

0.0

M02

M02

M07

1.0

5.52% 4.67% 4.67% 4.57% 5.17%

MDS 2

Model

(18)

g

SSL = 10

X ∥v̄l,· − v̄∥22 .

D.4

l

The category term SSG measures separation between misuse category means after averaging over languages. The language term SSL measures separation between language means after averaging over misuse categories. The factors 4 and 10 account for the number of cells represented by each mean. Table 11 reports the category and language sums of squares as percentages of the total variation 100SSG /T and 100SSL /T , respectively. The larger category effect supports the category organization observed in the cosine similarity analysis. D.3

Geometry Stability Across Layers

Following representational similarity analysis (Kriegeskorte et al., 2008), we compare the cell-to-cell similarity across layers. For each layer, we collect the strict upper triangle of its 40 × 40 cell-direction
cosine matrix into a vector. The 40 resulting 2 = 780 entries describe the same cell pairs at every layer. Cosine similarity between two such vectors measures agreement between the two layers’ relational geometry. We use Figure 9 to show the layer-wise relational geometry. High similarity across layers suggests that the geometry of repair representations persists in different layers. Figure 9 shows the results, suggesting stable geometric relationships between repair vectors across most of the layers, particularly from early-middle to late layers.

Clustering of Cell Directions

We group 40 unit cell repair vectors in their original representation space using Euclidean k-means with k = 10. We measure correspondence with category and language labels using the adjusted Rand 20

L0

L0

L0

L0

L0

L15

L13

L13

L13

L13

L31

L0

L15

Llama

L27 L31 L0

L13

CodeGemma

L27 L27 L0

L27 L27 L0

L13

Qwen

0

L26 L27 L0

L13

Qwen-Coder

0.5

L13

DeepSeek

L26

1

Measured projection

Figure 9: Cross-layer repair geometry in all five models. 2 0.03 R = 0.981

2 0.1 R = 0.967

2 0.5 R = 0.999

2 0.4 R = 0.980

0.00

0.0

0.0

0.0

−0.03

−0.1

−0.5

−0.4

−0.03

0.00

Llama

0.03

−0.1

0.0

CodeGemma

0.1

−0.5

0.0

0.5

Qwen Additive prediction

0.15

R 2 = 0.996

0.00

−0.4

0.0

0.4

Qwen-Coder

−0.15 −0.15

0.00

DeepSeek

0.15

Figure 10: Full-configuration additive fits for Java across all five models, using their selected layer and shared direction. Each panel contains 1,024 combinations. Dashed lines mark equality.

E

Controlled Program Diagnostics

Prediction from individual repairs. Next, using the all-misuse program and ten single-repair programs, we predict the projection of each remaining combination as

E.1 Additive Fits and Combination Prediction The diagnostic programs in Appendix A.3 vary ten security choices within one template per language. Let z ∈ {0, 1}10 encode the configuration, with zg = 1 for the secure implementation of category g and zg = 0 for misuse. We fix each model’s unit direction vCrypSteer for the analysis. We center projections at the midpoint between the all-misuse and all-secure endpoints. Writing 0 and 1 for these two configurations, and h̄mid = (h̄(0) + h̄(1))/2, we calculate the centered projection:  ⊤ p(z) = h̄(z) − h̄mid vCrypSteer .

pbpred (z) = p(0) +

10 X

zg [p(eg ) − p(0)],

(20)

g=1

where eg is the configuration in which only operation g is secure. We evaluate these predictions on the remaining 1,013 configurations. Table 4 shows the R2 for the prediction. The results show that responses to individual repairs can approximate those of combined repairs.

(19)

E.2

Paired Code Heatmaps

In Section 3.4, we use a paired code heatmap to show how cryptographic API repairs change token projections onto the shared direction at both edited expressions and unchanged downstream uses. When computing the token projection, the complete program enters the model, and we show excerpts. At the selected layer, for token t in program x, its scalar projection is

We use midpoint centering to make visualization intuitive while preserving projection differences. Descriptive additive fit. We fitPand evaluate the additive model pbfit (z) = β0 + 10 g=1 βg zg on all 1,024 configurations using ordinary least squares, with intercept β0 and category contribution βg that minimize the sum of squared differences between fitted and measured projections. Figure 10 shows the Java fits for all five models, and each point is one configuration. We can find that all points are close to the equality line, which indicates a close fit.

pt (x) = ht (x)⊤ vCrypSteer ,

(21)

where ht (x) is the token activation and vCrypSteer is the unit steering direction. 21

∆secure@1

∆valid@1

∆secure-valid@1

Model

Comparator

Llama

Baseline Cell DiffMean Pooled DiffMean Normalized DiffMean

15.00 [12.83, 17.18]∗ −3.17 [−5.13, −1.25]∗ 5.18 [3.25, 7.12]∗ 1.27 [−0.68, 3.22] 4.97 [3.33, 6.62]∗ −0.52 [−2.28, 1.22] ∗ 2.20 [0.95, 3.47] 0.03 [−1.50, 1.53]

9.67 [7.35, 11.98]∗ 4.85 [2.75, 6.95]∗ 2.78 [0.87, 4.68]∗ 0.85 [−0.73, 2.43]

CodeGemma

Baseline Cell DiffMean Pooled DiffMean Normalized DiffMean

10.42 [8.28, 12.60]∗ 2.62 [0.73, 4.47]∗ 2.95 [0.93, 4.97]∗ 1.23 [−0.77, 3.28]

1.38 [−0.92, 3.68] −0.13 [−2.27, 2.02] 2.35 [0.38, 4.38] 0.93 [−0.88, 2.78]

5.20 [3.23, 7.17]∗ 0.87 [−1.05, 2.78] 2.23 [0.47, 4.03] 0.58 [−1.12, 2.30]

Qwen

Baseline 10.80 [8.58, 13.08]∗ Cell DiffMean 3.32 [1.47, 5.18]∗ Pooled DiffMean 2.87 [1.60, 4.13]∗ Normalized DiffMean −0.98 [−2.12, 0.12]

−2.68 [−4.83, −0.55] 1.23 [−1.03, 3.48] −0.03 [−1.43, 1.40] −1.10 [−2.55, 0.37]

5.70 [3.18, 8.27]∗ 1.87 [−0.33, 4.10] 1.88 [0.50, 3.32]∗ −1.05 [−2.37, 0.28]

−1.67 [−3.47, 0.15] −0.53 [−2.22, 1.12] 0.27 [−1.37, 1.90] 0.92 [−0.42, 2.27]

2.32 [0.55, 4.10] 0.97 [−0.70, 2.67] 1.50 [−0.12, 3.13] 0.62 [−0.75, 1.98]

−2.20 [−3.97, −0.45] 0.52 [−1.25, 2.27] 0.00 [−1.23, 1.23] 0.25 [−0.88, 1.37]

5.03 [2.40, 7.67]∗ 0.07 [−2.53, 2.65] 0.88 [−0.53, 2.35] 0.25 [−1.13, 1.57]

Baseline 5.28 [3.75, 6.82]∗ Cell DiffMean 1.75 [0.45, 3.08]∗ Qwen-Coder Pooled DiffMean 1.02 [−0.20, 2.27] Normalized DiffMean −0.18 [−1.23, 0.90] Baseline 6.85 [4.35, 9.33]∗ Cell DiffMean −0.32 [−2.97, 2.28] Pooled DiffMean 1.10 [−0.18, 2.42] Normalized DiffMean 0.25 [−0.97, 1.50]

DeepSeek

Table 13: CrypSteer minus each comparator at +1σ. The baseline is unsteered. Differences are in percentage points, with 95% confidence intervals over 6,000 paired attempts. ∗ denotes Holm-adjusted p < 0.05.

F.1

We align corresponding lines and lexical spans, such as identifiers and API expressions, across the paired programs. The span alignment allows us to compare corresponding source expressions when their tokenization differs. For each aligned span pair a and program version y ∈ {secure, misuse}, the span projection is y y t wa,t pt (x ) P y , t wa,t

We pair outputs across conditions by model, language–misuse category cell, prompt, and generation seed. To estimate uncertainty in the aggregate difference, we compute 95% confidence intervals using 20,000 paired hierarchical bootstrap replicates. Within each of 40 cells, we resample five prompts and then 30 generation attempts per prompt with replacement, preserving paired indices across conditions (Hesterberg, 2011). Then we average the resulting cell rates with equal weight. The 95% confidence interval is defined by the 2.5th and 97.5th percentiles of the replicated rate differences. We further conduct significance tests that treat each prompt as a cluster of 30 attempts. We average the paired differences within each prompt, then apply a two-sided sign-flip test with 100,000 replicates (Dror et al., 2018). Each replicate independently keeps or reverses the sign of each prompt mean. The test compares the absolute aggregate difference with the resulting distribution. For each model and metric, the unsteered baseline and four
steering methods at +1σ define a family of 52 = 10 pairwise comparisons. We apply Holm corrections to this comparison family (Holm, 1979), and use an adjusted significance threshold of 0.05. Table 13 supplements Table 5 by reporting four of the ten comparisons, contrasting CrypSteer with the unsteered baseline, Cell DiffMean, Pooled DiffMean, and Normalized DiffMean. The stars denote Holm-adjusted significance.

P p̄ya =

(22)

y where xy is the corresponding program and wa,t counts the source characters shared by token t and the span. For visualization, the paired difference is

∆a = p̄secure − p̄misuse . a a

(23)

We color spans with |∆a | > 0.2, and display ∆a on the secure side and −∆a on the misuse side, with colors clipped at ±0.5. Green denotes positive differences, and red denotes negative differences. A highlighted unchanged span identifies a contextdependent activation change at that location.

F

Paired Comparisons

Generation Evaluation Details and Subgroup Results

We report the aggregate generation results in Section 4. Here we provide paired statistical comparisons and breakdown results by language and misuse category to quantify uncertainty and examine how steering effects vary across languages and cryptographic functionalities. 22

Cell DiffMean

Baseline

Pooled DiffMean

Normalized DiffMean

CrypSteer

Model

Language

secure valid secure- secure valid secure- secure valid secure- secure valid secure- secure valid secure@1 @1 valid@1 @1 @1 valid@1 @1 @1 valid@1 @1 @1 valid@1 @1 @1 valid@1

Llama

Java TypeScript C# Python

53.53 62.00 62.67 70.13

59.87 73.47 70.47 86.87

33.47 48.47 43.93 64.20

74.33 68.07 70.67 74.53

55.47 66.60 68.93 81.93

42.60 52.87 49.47 64.40

76.73 63.80 71.80 76.13

59.00 67.53 67.33 86.20

46.53 52.73 49.40 68.93

81.00 68.27 72.93 77.33

57.67 67.67 67.87 84.67

48.93 55.20 52.20 69.00

81.33 72.07 74.47 80.47

57.00 67.47 68.07 85.47

48.33 56.47 52.27 71.67

CodeGemma Java TypeScript C# Python

56.20 49.67 47.27 31.93

37.87 49.87 23.20 40.73

25.80 28.40 13.67 17.47

68.40 56.47 51.73 39.67

39.07 52.07 24.60 42.00

30.93 33.53 15.93 22.27

68.33 58.73 50.00 37.87

37.33 48.53 21.87 40.07

29.47 33.07 13.93 20.73

70.67 57.93 51.13 42.07

37.40 48.87 22.27 44.93

30.47 33.13 14.87 25.33

72.47 62.20 52.07 40.00

39.93 51.20 19.80 46.27

32.00 36.27 14.40 23.47

Qwen

Java TypeScript C# Python

53.60 56.87 60.33 53.87

75.60 65.67 76.33 81.13

42.93 40.33 47.73 48.33

64.00 59.13 68.20 63.27

67.60 58.13 76.60 80.73

46.73 38.20 53.73 56.00

66.00 60.47 67.67 62.27

72.33 59.07 72.80 83.93

49.53 38.40 49.33 57.33

70.73 63.87 69.20 68.00

72.87 59.33 73.87 86.33

51.53 39.87 51.53 63.40

68.53 62.47 70.67 66.20

73.53 57.47 72.53 84.47

52.13 38.40 50.87 60.73

Qwen-Coder Java TypeScript C# Python

61.67 63.07 70.87 61.33

75.00 65.47 74.87 79.93

45.07 43.13 55.53 58.60

71.07 65.80 71.67 62.53

71.27 60.33 77.87 81.27

49.33 41.93 56.73 59.73

70.20 66.47 72.13 65.20

64.27 61.07 78.13 84.07

44.73 42.47 57.27 61.13

73.20 67.27 73.00 65.33

65.27 59.40 77.27 83.00

47.80 41.73 58.00 61.60

75.53 65.67 73.13 63.73

68.93 60.73 76.47 82.47

51.13 42.87 56.67 60.93

DeepSeek

61.13 62.87 62.67 60.80

94.33 80.27 90.00 91.87

57.93 52.53 56.20 56.67

71.73 68.20 66.13 70.07

91.33 76.67 88.47 89.13

66.20 54.60 58.40 64.00

68.67 66.53 66.93 68.33

94.47 72.07 88.80 92.33

64.40 51.47 60.07 64.00

69.67 67.60 67.80 68.80

93.33 73.13 90.40 89.80

65.00 52.33 62.00 63.13

70.27 68.40 67.13 69.07

93.40 73.87 89.80 90.60

65.40 53.27 61.13 63.67

Java TypeScript C# Python

Table 14: Single-generation success rates over 1,500 outputs per model and condition for each language. Bold and underlining mark the highest and second-highest secure@1 and secure-valid@1 among the four directions at +1σ.

F.2

Subgroup Results

48,000 matched program pairs in our resource. Each input contains the two programs as two options and asks the model to choose one snippet. We use the original code-choice template with the language name and code-fence tag replaced as appropriate, which is shown below. Following their original design, a shuffle assigns the secure answer to A and B 24,000 times each. We subtract the misuse-selecting token activation from the secureselecting token activation at the selected layer to obtain a direction from each pair.

Tables 14 and 15 report unsteered baseline and +1σ steering results broken down by language and misuse category. These results show how steering effects and method rankings vary across tasks. CrypSteer ranks first or second on secure-valid@1 in 16 of 20 model–language groups and 33 of 50 model–category groups. The misuse category M05 gives a recurring example of the benefit of the shared direction for steering. Cell DiffMean lowers both secure@1 and secure-valid@1 relative to the baseline in all five models, but CrypSteer increases both in all models. For this misuse category, the shared direction provides more effective generation intervention than the mean direction fitted specifically to the target misuse category.

G

Hello, I am a researcher on <language name> programming code. I will give you two <language name> code snippets in the following, marked with (A) and (B). You need to choose one code snippet. Here are the snippets: (A) ```<language tag> <code A> ```

Comparison with SCS-Code and Surgical Repair

(B) ```<language tag> <code B> ```

Section 4.4 compares three methods of constructing a security direction. The experiment uses the same checkpoint, tokenizer, 200 prompts, and 30 attempt seeds across methods within a model. We use the common layer, scale, and activation update in Equation 4, and replace the original method’s layer and strength searches, to separate the influecen of the direction-construction method. SCS-Code (Wendlinger et al., 2026) uses all

Which snippet do you choose, (A) or (B)?

For Surgical Repair (Sandoval et al., 2026), we use 144 plain-text instruction pairs without a chat template. Each instruction pair requests the same cryptographic functionality with contrasting secure and misuse implementation choices. For each pair, we obtain a direction by subtracting the activation 23

Baseline Model

Cell DiffMean

Pooled DiffMean

Normalized DiffMean

CrypSteer

secure valid secure- secure valid secure- secure valid secure- secure valid secure- secure valid secureCategory @1 @1 valid@1 @1 @1 valid@1 @1 @1 valid@1 @1 @1 valid@1 @1 @1 valid@1 M01 M02 M03 M04 M05 M06 M07 M08 M09 M10

55.17 73.17 67.67 63.67 58.00 61.17 64.67 36.67 74.00 66.67

66.17 63.67 50.83 64.50 84.17 82.50 69.50 73.83 90.00 81.50

43.17 48.50 40.33 44.50 46.83 50.50 49.00 27.67 67.33 57.33

68.00 78.67 68.17 82.67 48.83 74.00 67.83 42.50 94.17 94.17

59.50 65.50 43.83 54.33 83.83 76.67 65.67 70.17 85.50 77.33

45.67 56.50 37.33 51.33 38.33 58.67 48.00 29.67 81.50 76.33

66.33 70.50 69.00 80.33 58.83 77.33 74.00 51.67 87.33 85.83

63.17 59.00 39.33 68.17 84.67 81.67 68.17 72.00 86.33 77.67

49.33 50.00 35.50 59.67 46.50 63.83 53.17 37.83 77.33 70.83

68.50 77.50 70.33 82.33 60.17 77.67 80.83 50.50 90.00 91.00

61.00 61.00 44.50 63.83 85.33 81.50 70.17 69.83 84.83 72.67

48.17 56.33 39.67 58.50 49.67 65.67 59.83 35.17 79.17 71.17

67.33 82.33 74.33 83.33 62.83 78.33 85.33 48.83 94.50 93.67

57.67 64.00 48.33 60.17 83.17 81.83 70.50 71.83 85.50 72.00

43.33 61.17 44.17 56.83 50.67 65.67 61.50 35.17 82.00 71.33

CodeGemma M01 M02 M03 M04 M05 M06 M07 M08 M09 M10

17.50 71.67 28.67 52.83 62.33 30.00 43.67 24.50 76.33 55.17

29.00 30.50 20.17 24.17 63.83 32.00 23.50 27.83 63.83 64.33

7.67 24.17 7.00 11.33 41.83 5.67 8.67 13.17 52.00 41.83

29.83 74.00 35.67 60.33 60.00 37.50 48.83 30.50 91.50 72.50

32.83 35.33 27.33 26.67 60.33 28.83 25.17 27.00 65.17 65.67

15.83 25.83 10.33 14.83 41.17 8.17 10.83 12.00 63.00 54.67

23.17 73.67 39.33 62.33 63.17 41.83 52.00 34.17 85.83 61.83

31.00 30.67 23.17 25.33 60.33 25.83 25.67 26.17 61.50 59.83

10.67 23.50 12.67 17.67 40.50 9.00 12.67 14.00 59.83 42.50

25.50 74.17 37.33 65.83 64.67 40.50 56.00 30.67 89.83 70.00

29.17 28.83 26.50 27.67 64.50 29.50 26.50 23.50 64.33 63.17

11.00 24.17 12.33 20.17 45.17 9.50 14.00 10.50 61.83 50.83

25.00 73.83 39.17 67.50 65.00 46.17 58.17 31.33 90.67 70.00

35.00 29.00 23.83 25.83 63.33 30.50 28.33 31.17 61.67 64.33

13.17 22.83 11.50 19.17 46.17 11.67 15.00 13.17 59.83 52.83

Qwen

M01 M02 M03 M04 M05 M06 M07 M08 M09 M10

29.17 64.33 46.83 78.83 58.50 49.50 45.17 14.00 81.83 93.50

67.17 75.00 54.33 66.67 85.67 80.83 75.83 70.83 85.83 84.67

24.83 51.17 27.83 55.17 51.00 38.33 37.33 9.50 72.17 81.00

39.50 70.33 53.17 90.33 55.17 70.17 52.17 24.17 88.50 93.00

63.67 69.00 50.00 66.00 84.67 74.00 71.17 67.33 83.17 78.67

29.83 53.67 29.33 63.00 49.50 52.67 41.33 13.00 78.00 76.33

40.83 78.67 51.83 87.33 60.17 66.83 53.17 19.83 91.33 91.00

64.00 75.50 53.33 66.67 85.33 74.00 74.50 69.83 83.67 73.50

31.00 59.83 30.67 61.83 52.67 46.67 40.33 13.83 79.67 70.00

43.67 79.83 54.67 91.83 62.33 69.17 71.17 22.00 93.33 91.50

63.67 78.83 58.00 66.67 86.67 76.17 74.50 71.50 81.33 73.67

31.00 65.50 33.67 64.67 54.50 49.33 52.50 14.33 80.00 70.33

43.83 79.33 52.33 90.67 63.00 71.00 68.00 19.83 90.50 91.17

67.00 75.33 53.50 69.50 85.67 71.50 74.00 70.67 80.00 72.83

32.50 61.67 29.50 66.67 54.33 48.33 51.50 13.33 77.50 70.00

Qwen-Coder M01 M02 M03 M04 M05 M06 M07 M08 M09 M10

54.00 55.67 67.83 77.83 63.83 54.50 55.50 22.83 94.00 96.33

76.83 68.00 64.33 77.67 80.67 72.83 61.50 62.33 88.50 85.50

47.33 41.17 47.00 63.33 48.17 38.50 39.67 13.33 84.00 83.33

60.17 62.83 68.67 83.33 60.33 62.83 59.67 27.83 94.33 97.67

81.83 68.67 62.50 74.50 79.33 63.17 64.17 64.00 86.17 82.50

51.00 47.17 47.67 66.33 45.67 35.17 43.83 19.00 81.83 81.67

55.83 61.17 69.17 86.33 62.00 65.33 63.00 30.33 94.83 97.00

75.33 67.67 60.00 82.33 79.17 67.00 61.17 62.67 87.00 76.50

43.33 45.50 44.33 75.33 46.67 39.67 41.50 18.33 83.17 76.17

58.50 63.67 70.50 85.83 63.83 68.67 66.50 29.33 94.67 95.50

71.83 67.83 59.50 79.50 81.33 67.67 61.17 61.00 87.00 75.50

43.33 48.83 44.67 72.83 50.17 43.00 44.33 17.67 83.33 74.67

57.83 66.50 71.33 84.33 65.50 64.83 66.50 25.50 95.00 97.83

76.17 69.83 59.17 77.67 81.67 69.33 62.50 61.17 85.17 78.83

45.83 52.83 44.00 69.50 51.17 43.17 48.17 14.33 81.83 78.17

DeepSeek

46.17 47.00 54.50 61.83 68.67 68.83 79.83 25.33 89.33 77.17

86.33 89.33 87.83 76.50 91.17 91.83 88.33 93.00 97.50 89.33

41.83 41.50 47.17 44.83 60.50 65.83 72.67 24.17 87.83 72.00

56.50 51.50 61.17 85.17 66.00 65.17 82.17 48.33 97.00 77.33

84.17 91.33 77.67 74.00 88.33 89.33 88.67 90.50 95.33 84.67

51.00 45.50 46.33 66.00 55.33 61.67 74.17 45.67 92.50 69.83

52.17 52.00 61.83 74.50 71.00 58.17 83.67 45.50 94.17 83.17

82.50 93.17 80.17 72.17 90.17 90.00 83.67 91.00 94.17 92.17

46.33 47.67 46.83 57.67 61.67 55.83 72.17 42.50 89.17 80.00

52.67 50.67 64.33 79.33 70.67 61.17 86.67 42.00 94.50 82.67

83.83 93.00 82.17 74.33 88.67 86.50 86.33 91.50 92.33 88.00

45.83 47.00 52.33 62.83 59.83 56.67 77.67 39.17 88.33 76.50

53.67 51.83 64.00 77.83 70.67 62.83 83.00 43.17 96.00 84.17

83.33 92.50 82.17 74.83 88.83 87.00 82.50 91.33 94.33 92.33

47.33 47.83 52.50 61.17 61.00 57.50 70.50 39.83 91.00 80.00

Llama

M01 M02 M03 M04 M05 M06 M07 M08 M09 M10

Table 15: Single-generation success rates over 600 outputs per model and condition for each misuse category. Bold and underlining mark the highest and second-highest secure@1 and secure-valid@1 among the four directions at +1σ.

at the final token of the insecure instruction from that of the secure instruction at the common selected layer. For both methods, we average the secureminus-misuse activation differences with equal pair weights and normalize the resulting vector before applying the common intervention scale. We compare the generation outcomes of the three directionconstruction methods using paired statistics. Table 16 reports differences over 6,000 paired outputs per model, with a common intervention strength of +1σ. We use the same significance tests as in Appendix F and apply Holm corrections to all six

pairwise comparisons among the unsteered baseline and three methods.

H

Evaluation and Output Audits

We evaluate structural validity and target security in model-generated outputs and audit the evaluators. The three metrics in Section 4.1 use the single-sample case of the HumanEval pass@k estimator (Chen et al., 2021). For c successful samples among n attempts, the estimator is
n−c k
\ pass@k = 1 − n . (24) k

24

Model

Comparator

∆secure@1

∆valid@1

∆secure-valid@1 ∗

Llama

SCS-Code +1.63 [−0.17, 3.43] −3.12 [−5.05, −1.18] Surgical Repair +10.52 [8.42, 12.65]∗ −1.37 [−3.42, 0.68]

−1.28 [−3.38, 0.80] +6.57 [4.27, 8.87]∗

CodeGemma

SCS-Code Surgical Repair

+5.18 [3.02, 7.32]∗ +5.48 [3.40, 7.55]∗

−1.05 [−3.13, 1.05] −0.28 [−2.42, 1.85]

+1.52 [−0.38, 3.42] +2.73 [0.90, 4.55]∗

Qwen

SCS-Code Surgical Repair

+3.80 [1.57, 6.03]∗ +6.67 [4.62, 8.75]∗

−1.93 [−4.33, 0.35] +0.58 [−1.53, 2.68]

+0.48 [−2.15, 3.00] +5.42 [3.10, 7.77]∗

Qwen-Coder

SCS-Code Surgical Repair

+4.12 [2.53, 5.72]∗ +5.08 [3.47, 6.70]∗

−2.15 [−3.92, −0.40] −2.12 [−3.98, −0.25]

+1.47 [−0.47, 3.38] +1.95 [0.10, 3.82]

DeepSeek

SCS-Code Surgical Repair

+6.57 [4.20, 8.97]∗ +5.32 [2.20, 8.52]∗

+0.93 [−1.15, 3.03] −1.60 [−3.38, 0.18]

+5.88 [3.18, 8.63]∗ +4.23 [1.03, 7.52]

Table 16: CrypSteer minus each comparator at +1σ. Differences are in percentage points, with 95% confidence intervals over 6,000 paired attempts. ∗ denotes Holm-adjusted p < 0.05.

We use n = 30 attempts per request, use k = 1 for the reported results, and use the secure label, structural validity, or both on the same output as the criterion.

choices or thresholds used to classify generated programs. The evaluator combines evidence from the target API uses into a program-level label, because there might be multiple target API uses in a program. When all target API use is secure, we label a program as secure. When there is misuse API uses but no secure use, we label a program as misuse. When both secure and misuse API use exist in the same program, we label it as mixed. Otherwise, we label the program as unknown, such as in cases where the security of API usage depends on user input. We report secure@1 and secure-valid@1 as the main outcomes because our main goal is to increase the proportion of outputs that are secure.

Structural Validity Structural validity checks whether the output contains a coherent implementation of the requested cryptographic functionality. It requires the following six checks to pass: 1. Parses or compiles. 2. Uses resolvable imports. 3. Uses supported APIs for the cryptographic functionality. 4. Uses the API operations required by that cryptographic functionality. 5. Uses compatible API signatures and argument roles. 6. Has a connected sequence of operations to complete the cryptographic functionality.

Evaluator Checks We implement evaluators tailored to these structural and security criteria. We test the quality of evaluators by a blinded review. Within each language–misuse category cell for every model, we randomly selected one sample from 150 generations in that cell for the unsteered baseline, and chose the sample from Normalized DiffMean and CrypSteer with +1σ steering that share the same prompt and generation random seed with that sample. This gives a set of 600 outputs. The first author manually reviewed these generations and assigned labels for security and validity. Among the 600 samples, 16 of them have disagreements between manual and evaluator labels for security, and 9 of them have disagreements for validity. This gives an overall agreement of 97.33% for security labels, and 98.50% for structural validity. Replacing evaluator labels with human judgments within this sample preserves the signs of the comparison of secure@1, valid@1, secure-valid@1 among unsteered baseline, Normalized DiffMean,

A program is structurally valid only when all six checks complete successfully. We choose structural validity to evaluate the utility of the generated programs because they have no common entry point or input/output interface, which makes executionbased functional testing not feasible. We conduct an exploratory AI-assisted review of 500 outputs to assess the feasibility of functional testing. Only 76 of them are suitable for reusable adapters for execution-based functional testing. This supports our choice of using structural validity to evaluate the utility of generated programs. Security of API Usage We assess the security of the misuse category targeted by each task request. We follow the security policy for benchmark evaluation, and Table 17 lists the parameters, algorithm 25

ID

Misuse

Secure use

M01 Cryptographic key from a fixed string, fixed byte array, or general-purpose PRNG M02 AES with ECB mode

Cryptographic key generated by a CSPRNG or derived by a KDF AES encryption with other secure modes, such as CBC, CTR, GCM, CCM, OFB, CFB AES CBC encryption with IV generated by a CSPRNG

M03 AES CBC encryption with IV from fixed bytes, a fixed string, or predictable randomness M04 RSA key size < 2,048 bits RSA key size ≥ 2,048 bits M05 General-purpose PRNG output or a predictable generator CSPRNG output seed M06 Fixed salt, or predictably reused salt Fresh random salt M07 PBKDF2/PBE iteration count < 1,000 PBKDF2/PBE iteration count ≥ 1,000 M08 Hardcoded password or password derived from constants or Password from environment, user input or a CSPRNG predictable randomness M09 Broken hash functions: MD2, MD4, MD5, or SHA-1 Other secure hash functions, such as SHA-224/256/384/512, SHA3-224/256/384/512 M10 Compromised MAC algorithms: HMAC-MD5, Other secure MAC algorithms, such as HMAC with HMAC-SHA-1 SHA-224/256/384/512 or SHA3-224/256/384/512

Table 17: Security rules for each misuse category. CSPRNG denotes a cryptographically secure pseudorandom number generator.

Model Llama CodeGemma Qwen Qwen-Coder DeepSeek

Activation Layer Full-source Source-exclusion extraction probes generation generation 1.8 2.5 1.8 1.9 3.0

1.1 0.8 1.1 1.3 1.0

124.0 104.5 60.6 72.0 194.7

65.1 56.1 33.0 39.3 103.2

Table 18: Approximate elapsed hours by model and stage. Full source generation includes the unsteered baseline.

and CrypSteer, with changes of at most 1.50 percentage points. This suggests that the evaluator results are reliable and not likely to affect the overall results.

I

Reproducibility and Computational Budget

Our code and data are available at https://gi thub.com/tianhe-lu/CrypSteer. We use one NVIDIA GeForce RTX 4090 for experiments with Llama, CodeGemma, Qwen and Qwen-Coder models, and use one NVIDIA A100-SXM4-80GB GPU for DeepSeek. Table 18 reports the approximate elapsed time for the main GPU-based stages of the study. We used fixed steering strength settings without a hyperparameter search process.

26

Related documents

• Many Repairs, One Direction: Steering Code Models Toward Safer Cryptographic API Use#1390079
• Beyond Static Guarantees: Measuring the Static-Pass Dynamic-Fail Gap in Security-Sensitive and LLM-Generated Python Code#997752
• Beyond Static Guarantees: Measuring the Static-Pass Dynamic-Fail Gap in Security-Sensitive and LLM-Generated Python Code#673433
• Simple Cryptographic Program Interface (Crypto API)#136753
• A Maintainable Extensible And Performant Compiler Toolchain For The TrustGuard Architecture#651438