SecCodePRM: A Process Reward Model for Code Security

Large Language Models are rapidly becoming core components of modern software development workflows, yet ensuring code security remains challenging. Existing vulnerability detection pipelines either rely on static analyzers or use LLM/GNN-based detectors trained with coarse program-level supervision. Both families often require complete context, provide sparse end-of-completion feedback, and can degrade as code length grows, making them ill-suited for real-time, prefix-level assessment during interactive coding and streaming generation. We propose \textbf{SecCodePRM}, a security-oriented process reward model that assigns a \textbf{context-aware}, \textbf{step-level} security score along a code trajectory. To train the model, we derive step-level supervision labels from static analyzers and expert annotations, allowing the model to attend more precisely to fine-grained regions associated with inter-procedural vulnerabilities. SecCodePRM has three applications: full-code vulnerability detection (VD), partial-code VD, and secure code generation (CG). For VD, SecCodePRM uses risk-sensitive aggregation that emphasizes high-risk steps; for CG, SecCodePRM supports inference-time scaling by ranking candidate continuations and favoring higher cumulative reward. This design yields dense, real-time feedback that scales to long-horizon generation. Empirically, SecCodePRM outperforms prior approaches in all three settings, while preserving code functional correctness, suggesting improved security without a safety–utility tradeoff.

Modern software is increasingly written with the help of AI coding assistants powered by large language models. While these tools dramatically speed up development, they sometimes introduce security flaws — bugs that hackers can exploit to steal data or take over systems. Today's tools for catching such flaws usually need to see the entire finished program, which means they cannot warn a developer until after the risky code has already been written. In this work, we built SecCodePRM, a system that watches code as it is being typed and gives a security score after every few lines, much like a spell-checker that highlights mistakes in real time. To train it, we used examples of real-world vulnerabilities and the corresponding fixes, teaching the model exactly which lines turned safe code unsafe. Across several benchmarks, SecCodePRM detects vulnerabilities more accurately than existing tools, and — crucially — it works on partial, half-written code. When connected to a code-generating AI, it also steers the AI toward writing safer programs without making the code any less functional. This brings us closer to AI assistants that help developers ship secure software by default.