Code LLMs exhibit remarkable capabilities in automated code generation, but the generated code often suffers from low computational efficiency. Existing solutions have two limitations: (1) direct fine-tuning lacks transferability across model scales; (2) The efficiency optimization method for iterative generation-evaluation loops incurs high overhead. We propose CoEffi, which adopts inference-side intervention that directly operates on the decoding process without modifying base model parameters, enabling real-time efficiency improvement across different model scales while avoiding iterative reevaluation. CoEffi uses a small efficiency expert model for proposal and the base model to evaluate its acceptability, additionally introducing a region-aware dynamic acceptance threshold mechanism that maintains a sliding window to record historical acceptance rates and adjusts the dynamic threshold accordingly. We extensively evaluate CoEffi on four mainstream code LLM families and three efficiency benchmarks. Compared with vanilla instruction-tuned models, CoEffi improves average Beyond@1 by 9.12%–38.62% across the evaluated model families. It also improves Pass@1 on Mercury and ENAMEL, while EffiBench exhibits model-dependent correctness gains and regressions. A family specific trained expert can be reused across compatible base model scales within the same model family.

Large Language Models (LLMs) demonstrate strong generalization capabilities but remain vulnerable to jailbreak attacks that induce restricted text or malicious code generation.Recent structured jailbreaks embed adversarial intent into code-like templates and have demonstrated promising effectiveness.However, existing approaches typically operate within a fixed template design and a single programming language, without considering language diversity or adaptive template evolution, thereby limiting the exploration of cross-language jailbreak behaviors.In this paper, we present MultiCodeAttack, a structured jailbreak framework that systematically explores and optimizes multi-language code templates.MultiCodeAttack maintains a diverse template library across programming languages, dynamically selects languages with higher attack effectiveness via a multi-armed bandit strategy, and evolves templates through semantic-preserving mutation guided by response-aware signals.Extensive experiments on 8 LLMs show that MultiCodeAttack outperforms existing jailbreak baselines, achieving 28.23%–832.59% higher harmful text generation.On malicious code generation across 11 LLMs, MultiCodeAttack produces up to 136.22% more malicious outputs than the baseline methods.Our code is available at https://anonymous.4open.science/r/MultiCodeAttack/.

Large Language Models (LLMs) for code generation can replicate insecure patterns from their training data. To mitigate this, a common strategy for security hardening is to fine-tune models using supervision derived from the final transformer layer. However, this design may suffer from a final-layer bottleneck: vulnerability-discriminative cues can be distributed across layers and become less detectable near the output representations optimized for next-token prediction. To diagnose this issue, we perform layer-wise linear probing. We observe that vulnerability-related signals are most detectable in a band of intermediate-to-upper layers yet attenuate toward the final layers. Motivated by this observation, we introduce DeepGuard, a framework that leverages distributed security-relevant cues by aggregating representations from multiple upper layers via an attention-based module. The aggregated signal powers a dedicated security analyzer within a multi-objective training objective that balances security enhancement and functional correctness, and further supports a lightweight inference-time steering strategy. Extensive experiments across five code LLMs demonstrate that DeepGuard improves the secure-and-correct generation rate by an average of 11.9% over strong baselines such as SVEN. It also preserves functional correctness while exhibiting generalization to held-out vulnerability types.