**Abstract:** Modern language models (LMs) have become widely accepted in various contexts, particularly in programming. Instruction tuning enhances LMs' practical utility by training them to follow user instructions and human preferences. However, existing instruction tuning schemes often overlook the security of generated code, leading to significant security risks. This work introduces SafeCoder, a novel approach that addresses this gap by performing security-centric fine-tuning using a diverse and high-quality dataset. SafeCoder integrates security fine-tuning with standard instruction tuning to optimize both security and utility. Despite its simplicity, SafeCoder effectively improves security by about 30% while preserving utility across various popular LMs and datasets. Modern LMs undergo two training stages: pretraining and instruction tuning. Instruction tuning enhances LMs' practical usability by equipping them with instruction-following and user-interaction capabilities. However, existing instruction tuning schemes often fail to ensure the security of generated code, leading to insecure code generation. SafeCoder aims to address this issue by performing security-specific fine-tuning using a dataset of secure and insecure programs. It guides the LM to generate secure programs through a language modeling loss and discourages the generation of unsafe programs using an unlikelihood loss. SafeCoder combines standard instruction tuning with security fine-tuning in a single training run, achieving a balance between security and utility. SafeCoder's instruction tuning involves a standard instruction tuning dataset and a security dataset. The security dataset consists of tuples $(\mathbf{i}, \mathbf{o}^{\text{sec}}, \mathbf{o}^{\text{vul}})$, where $\mathbf{i}$ is an instruction, $\mathbf{o}^{\text{sec}}$ is a secure output, and $\mathbf{o}^{\text{vul}}$ is an unsafe output. SafeCoder fine-tunes the LM on $\mathbf{o}^{\text{sec}}$ using a masked negative log-likelihood loss and leverages a masked unlikelihood loss to penalize unsafe outputs. The two datasets are combined in a single training run, with specific loss functions applied depending on the origin of the training sample. SafeCoder's data collection pipeline is designed to extract high-quality and diverse security datasets from GitHub commits. The pipeline uses a two-step approach: heuristics to select potential vulnerability fixes and static analysis to verify them. This process results in a dataset with accurate security labels and comprehensive coverage of vulnerability types and programming languages. SafeCoder is evaluated on six state-of-the-art LMs, including coding and general-purpose models. The evaluation covers a wide range of testing scenarios, demonstrating that SafeCoder significantly improves security (by about 30%) while maintaining utility. The effectiveness of SafeCoder is further validated through ablation studies and comparisons with prior work, showing its superior performance in both security and utility. SafeCoder is effective for instruction-tuned LMs but does not handle pretrained LMs for code completion or already instruction-tuned LMs**Abstract:** Modern language models (LMs) have become widely accepted in various contexts, particularly in programming. Instruction tuning enhances LMs' practical utility by training them to follow user instructions and human preferences. However, existing instruction tuning schemes often overlook the security of generated code, leading to significant security risks. This work introduces SafeCoder, a novel approach that addresses this gap by performing security-centric fine-tuning using a diverse and high-quality dataset. SafeCoder integrates security fine-tuning with standard instruction tuning to optimize both security and utility. Despite its simplicity, SafeCoder effectively improves security by about 30% while preserving utility across various popular LMs and datasets. Modern LMs undergo two training stages: pretraining and instruction tuning. Instruction tuning enhances LMs' practical usability by equipping them with instruction-following and user-interaction capabilities. However, existing instruction tuning schemes often fail to ensure the security of generated code, leading to insecure code generation. SafeCoder aims to address this issue by performing security-specific fine-tuning using a dataset of secure and insecure programs. It guides the LM to generate secure programs through a language modeling loss and discourages the generation of unsafe programs using an unlikelihood loss. SafeCoder combines standard instruction tuning with security fine-tuning in a single training run, achieving a balance between security and utility. SafeCoder's instruction tuning involves a standard instruction tuning dataset and a security dataset. The security dataset consists of tuples $(\mathbf{i}, \mathbf{o}^{\text{sec}}, \mathbf{o}^{\text{vul}})$, where $\mathbf{i}$ is an instruction, $\mathbf{o}^{\text{sec}}$ is a secure output, and $\mathbf{o}^{\text{vul}}$ is an unsafe output. SafeCoder fine-tunes the LM on $\mathbf{o}^{\text{sec}}$ using a masked negative log-likelihood loss and leverages a masked unlikelihood loss to penalize unsafe outputs. The two datasets are combined in a single training run, with specific loss functions applied depending on the origin of the training sample. SafeCoder's data collection pipeline is designed to extract high-quality and diverse security datasets from GitHub commits. The pipeline uses a two-step approach: heuristics to select potential vulnerability fixes and static analysis to verify them. This process results in a dataset with accurate security labels and comprehensive coverage of vulnerability types and programming languages. SafeCoder is evaluated on six state-of-the-art LMs, including coding and general-purpose models. The evaluation covers a wide range of testing scenarios, demonstrating that SafeCoder significantly improves security (by about 30%) while maintaining utility. The effectiveness of SafeCoder is further validated through ablation studies and comparisons with prior work, showing its superior performance in both security and utility. SafeCoder is effective for instruction-tuned LMs but does not handle pretrained LMs for code completion or already instruction-tuned LMs