AlquistCoder: A Synthetic Data Approach to Training Compact Secure Coding Assistants and Building Security Benchmarks

Abstract

Large language models are increasingly used as programming assistants, but their security behavior remains uneven: they may generate code with vulnerable patterns, and they may provide actionable help for malicious requests. This paper introduces AlquistCoder, a compact 3.8B‐parameter coding assistant designed to address both risks through targeted synthetic‐data alignment. Starting from Phi‐4‐mini, we train the model with supervised fine‐tuning and direct preference optimization on data produced by our constitution‐guided Design–Amplify–Refine framework, which generates secure‐coding examples, refusal demonstrations, and preference pairs from structured specifications of vulnerability classes, coding domains, and malicious‐intent patterns. We evaluate AlquistCoder on CyberSecEval, HumanEval, SecurityEval, and two benchmarks released with this work: VulnBench, for hard Python secure‐coding prompts, and MalBench, for multi‐turn adversarial manipulation. Across these benchmark‐level evaluations, AlquistCoder reduces statically detected vulnerability patterns and judged malicious‐assistance rates relative to its base model and to baselines of comparable or larger size, while retaining competitive coding performance for its size. We publicly release the trained model, datasets, benchmarks, and evaluation scripts to support reproducible research on security alignment for code‐generation models.