💻 computer science

SCAFFOLD-CEGIS: Preventing Latent Security Degradation in LLM-Driven Iterative Code Refinement

This paper identifies a "latent security degradation" paradox where iterative LLM code refinement increases vulnerabilities due to specification drift and ineffective static analysis, and proposes the SCAFFOLD-CEGIS framework—a multi-agent system using counterexample-guided inductive synthesis and explicit verifiable constraints—to achieve 100% safety monotonicity and reduce degradation rates to 2.1%.

Original authors: Yi Chen, Yun Bian, Haiquan Wang, Shihao Li, Zhe Cui

Published 2026-03-10

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Yi Chen, Yun Bian, Haiquan Wang, Shihao Li, Zhe Cui

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very talented, but slightly forgetful, assistant named "The AI." You ask this assistant to write a piece of software code. At first, the code is safe and secure, like a house with strong locks, alarms, and a guard at the door.

But you don't just want the code once; you want to keep asking the AI to improve it. "Make it faster," you say. "Make it easier to read," you ask. "Add this new feature," you request.

The Problem: The "Renovation Paradox"
The paper discovers a strange problem: every time the AI tries to make the code better in one way (like faster or cleaner), it accidentally makes the code worse in another way (less secure).

Think of it like renovating a house. You tell the contractor, "Make the kitchen bigger and the hallway wider." The contractor does a great job, but in the process, they accidentally knock down the front door, remove the smoke detectors, and leave the back gate unlocked. They didn't mean to break the security; they were just focused on the "improvements" you asked for.

The researchers found that after about 10 rounds of these "renovations," nearly half of the code chains ended up with more security holes than when they started. The AI was so busy optimizing for speed or simplicity that it forgot to keep the "locks" on.

The Failed Solution: The "Metal Detector" Gate
You might think, "Okay, let's just put a metal detector at the exit. If the code has a known virus (a specific security bug), we stop it." This is called Static Analysis (SAST).

The paper shows this doesn't work well. Why? Because the AI isn't just adding "viruses"; it's removing the defenses.

The Analogy: Imagine the metal detector only checks if you are carrying a weapon. But the contractor didn't bring a weapon; they just took the guard's gun away and locked the guard in the basement. The metal detector sees nothing wrong because no new weapon was added. The house is now defenseless, but the detector says, "All clear!"

This creates a "fake safety" effect. The code passes the test, but it's actually more dangerous than before.

The Solution: SCAFFOLD-CEGIS (The "Smart Blueprint" System)
To fix this, the authors built a new system called SCAFFOLD-CEGIS. It works like a team of specialized architects and inspectors who don't just look for "bad things," but actively protect the "good things."

Here is how the team works, using a construction metaphor:

The Security Architect (The "Anchor" Maker):
Before the AI starts working, this agent looks at the original code and says, "These are the Anchors."
- Analogy: These are the steel beams, the firewalls, and the main locks. The Architect marks them with bright red tape and says, "Do not touch these. If you move them, the whole building falls."
- The system turns vague instructions like "be secure" into hard, unbreakable rules: "The function named validate_user must exist," or "Every database query must use a parameter."
The Builder (The AI):
The AI tries to make the requested improvements (faster, cleaner) but is strictly forbidden from removing or weakening the "Anchors."
The Gatekeeper (The 4-Layer Inspector):
Before any change is accepted, a Gatekeeper checks it through four layers:
- Does it work? (Correctness)
- Did we lose any security? (Safety Monotonicity)
- Is the change too huge? (Diff Budget - to prevent massive, risky overhauls)
- Did we break the Anchors? (Anchor Integrity)
- Analogy: If the builder tries to remove a steel beam to make the room bigger, the Gatekeeper slams the door shut immediately.
The Learner (The "Experience" Collector):
If the builder fails and gets rejected, this agent doesn't just say "No." It writes down why it failed.
- Analogy: "Oh, the builder tried to delete the validate function again. Next time, tell the builder: 'Never delete functions with 'validate' in the name.'"
- This helps the AI learn from its mistakes so it doesn't make the same security error twice.

The Results
When the researchers tested this new system:

Old Way (Just asking the AI): Security got worse over time.
Middle Way (Just using a metal detector): Security looked fine, but actually got worse because the detector missed the "removed defenses."
New Way (SCAFFOLD-CEGIS): The system successfully stopped the security degradation. It reduced the rate of "hidden security damage" from about 20% down to just 2%.

The Bottom Line
The paper concludes that when we ask AI to keep improving code over and over, it naturally drifts away from security unless we give it explicit, hard rules (Anchors) and a strict inspector (Gatekeeper) that understands that removing a defense is just as dangerous as adding a bug. You can't just rely on the AI to "remember" to be safe; you have to build a system that forces it to stay safe.

Technical Summary: SCAFFOLD-CEGIS

1. Problem Statement: The Iterative Refinement Paradox

The paper identifies a critical, under-explored risk in Large Language Model (LLM)-driven software engineering: latent security degradation during iterative code refinement. While tools like GitHub Copilot facilitate multi-turn interactions to improve functionality and performance, the authors argue that this process often inadvertently degrades security.

The core issue is specification drift in multi-objective optimization. When LLMs optimize for competing goals (functionality, performance, maintainability) alongside security, and security constraints are provided only as "soft prompts," the optimization trajectory gradually diverges from the intended security specification. This leads to the removal of defensive logic, weakening of exception handling, or bypassing of permission checks.

Crucially, the paper demonstrates that Static Application Security Testing (SAST) gating is insufficient to prevent this. SAST tools rely on known vulnerability patterns and often fail to detect structural degradations where security-critical elements are simply deleted or weakened without introducing new, rule-triggering patterns. In fact, the authors observe a "pseudo-security effect" where relying solely on SAST can increase the latent security degradation rate (from 12.5% to 20.8% in their experiments) because models may interpret "passing SAST" as a signal to perform larger, riskier refactors that fall outside SAST coverage.

2. Methodology: The SCAFFOLD-CEGIS Framework

To address these limitations, the authors propose SCAFFOLD-CEGIS, a multi-agent framework inspired by the Counterexample-Guided Inductive Synthesis (CEGIS) paradigm. The framework transforms security constraints from implicit instructions into explicit, verifiable hard constraints.

Core Architecture

The system operates via a closed loop involving four collaborative agents:

SecurityArchitectAgent: Mines Semantic Anchors from the codebase. These anchors represent security-critical elements (functions, patterns, invariants) and are formalized into a specification set $\Phi$ $Φ$ .
- Function-level: Identifies validation, sanitization, and authentication functions via regex and AST parsing.
- Pattern-level: Matches defensive logic patterns (e.g., parameterized queries, specific exception handling).
- Invariant-level: Enforces global rules (e.g., "all SQL queries must be parameterized").
ImplementerAgent: Generates candidate code ( $P'$ ) to satisfy the refinement task while adhering to the hard constraints defined by the semantic anchors.
GatekeeperAgent: Performs a four-layer gated verification on each candidate before acceptance:
- Correctness: Ensures the code passes the test suite.
- Safety Monotonicity: Verifies that the vulnerability count (via SAST) does not increase ( $\Delta V \le 0$ ).
- Diff Budget: Limits the scale of changes to prevent massive, risky refactors.
- Anchor Integrity: Ensures no hard-level semantic anchors (e.g., critical validation functions) have been removed or altered.
AssimilatorAgent: Analyzes rejected candidates to extract structured lessons (counterexamples). It updates a failure knowledge base to guide future generations, preventing the recurrence of specific structural errors.

Theoretical Guarantee

The framework enforces Safety Monotonicity, defined as $V(P_{i+1}) \le V(P_i)$ for all iterations $i$ , where $V$ is the vulnerability count. By setting the tolerance threshold $\delta_{max} = 0$ , the system guarantees that no iteration introduces new SAST-detectable vulnerabilities or removes anchored security elements.

3. Key Contributions

Empirical Validation of the Paradox: Through controlled experiments on 96 iteration chains using GPT-4o, the authors reveal that 43.7% of chains exhibit more vulnerabilities than the baseline after ten iterations. Cross-model and cross-language experiments confirm this phenomenon is prevalent, not isolated to a single model.
Identification of SAST Blind Spots: The paper documents specific "latent" degradation cases (e.g., deleting input validation functions, swallowing exceptions, bypassing permission checks) that pass SAST checks but compromise security.
The SCAFFOLD-CEGIS Framework: A novel architecture that integrates semantic anchoring, multi-layer gating, and failure assimilation to enforce security monotonicity.
Quantitative Improvement: The framework reduces the latent security degradation rate (measured by LLM semantic review) from 20.8% (in unprotected baselines) to 2.1%, while achieving 100% safety monotonicity.

4. Experimental Results

The authors evaluated the framework across three research questions (RQs) using 24 programming tasks in Python and Java, covering six security scenarios (SQL injection, input handling, authentication, etc.).

RQ1 (External Validity): Experiments across GPT-5-Nano, Claude Sonnet 4.5, and DeepSeek-V3 confirmed that iterative refinement degrades security across different models and languages. Notably, static analysis (SAST) metrics often showed low degradation rates (e.g., 4.2%–10.5%), while LLM-based semantic review revealed much higher reliability and latent security degradation (42.5%–52.5%), highlighting the gap in detection coverage.
RQ2 (Defense Comparison): Compared against six baselines (including Prompt-based Security, Self-Refine, Post-hoc SAST, and Hybrid Guard), SCAFFOLD-CEGIS was the only method to achieve both 0% SAST degradation rate and 2.1% latent security degradation rate.
- Key Finding: Post-hoc SAST alone resulted in a higher latent degradation rate (20.8%) than the unprotected baseline (12.5%), confirming the "pseudo-security" risk.
RQ3 (Ablation Study):
- Gated Verification was identified as the primary driver for achieving 100% safety monotonicity.
- Semantic Anchoring was essential for extending coverage beyond SAST rules to catch structural deletions.
- Failure Assimilation significantly improved the Task Completion Rate (TCR) from ~66% (without assimilation) to 77.14%, demonstrating that learning from failures allows the system to maintain code evolution capabilities even under strict security constraints.

5. Significance and Claims

The paper claims that LLM-driven iterative code refinement entails an inherent risk of security degradation that is not mitigated by current standard practices like soft prompting or SAST gating.

The significance of the work lies in:

Shifting the Paradigm: Moving from "generate-detect" loops to "generate-verify-constrain" loops where security constraints are explicit and hard-enforced.
Addressing Structural Blind Spots: Demonstrating that security is not just about preventing new vulnerabilities but also about preserving existing defensive structures, which requires semantic understanding beyond pattern matching.
Practical Engineering: Providing a framework that achieves 100% safety monotonicity without completely halting code evolution, offering a viable path for secure AI-assisted development.

The authors maintain a modest tone regarding limitations, acknowledging that their results are based on single-file modules and specific languages (Python/Java). They note that scalability to industrial codebases, the noise inherent in LLM-based semantic review, and the computational cost of the verification layers are areas requiring further study. They do not claim to solve all security problems but rather to provide a mechanism to prevent the degradation of existing security guarantees during iterative refinement.