New #EMNLP main paper with my student Hao Yan @Haaao_Y : Code security is a prevalent concern with current LLMs, while existing mitigations mostly treat the LLM as a blackbox. In our inspection, these mitigation approaches often present a security-correctness tradeoff --- they improve code security by removing its function, which makes the code more secure but also less useful. In this work, we mechanistically interpret how an LLM encodes safety vs. vulnerability in code generation and propose DuoSteer, a double-activation steering approach for mitigating code vulnerability while addressing the security-correctness tradeoff. Following the principle of actionable interpretability, we evaluate DuoSteer against practical mitigation approaches (SFT and hint prompting, a strong baseline by us as well) and found that DuoSteer gave better joint performance on code security and correctness. Our contrastive pair dataset, CODESEC-PAIRS, derived from Llama3.1-8B-Instruct and Qwen-2.5-Coder-7B-Instruct, is also released: huggingface.co/datasets/haaa… More coming along this line to make interpretability grounded and useful in the application of code generation! Paper: arxiv.org/pdf/2608.30025 (And our earlier hint prompting paper just accepted to ACM TOSEM: arxiv.org/pdf/2506.23034)