Root-Cause-Driven Automated Vulnerability Repair
Fuente:
arXiv
Gespeichert in:
| Hauptverfasser: | , , , , , , , , , , , , , , , |
|---|---|
| Format: | Preprint |
| Veröffentlicht: |
2026
|
| Schlagworte: | |
| Online-Zugang: | |
| Tags: |
Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
|
| _version_ | 1866910192757637120 |
|---|---|
| author | Wang, Hulin Basque, Zion Leonahenahe Hu, Jie Bajaj, Ati Priya Liu, Yibo Zhu, Samuel Kobakhia, Giorgi Chapre, Nikhil Rosenberg, Will Mishra, Siddharth Gabani, Aditya Maheshbhai Schloegel, Moritz Doupé, Adam Shoshitaishvili, Yan Wang, Ruoyu Bao, Tiffany |
| author_facet | Wang, Hulin Basque, Zion Leonahenahe Hu, Jie Bajaj, Ati Priya Liu, Yibo Zhu, Samuel Kobakhia, Giorgi Chapre, Nikhil Rosenberg, Will Mishra, Siddharth Gabani, Aditya Maheshbhai Schloegel, Moritz Doupé, Adam Shoshitaishvili, Yan Wang, Ruoyu Bao, Tiffany |
| contents | Recent LLM-based systems have made automated vulnerability repair increasingly practical, but two challenges remain. First, without strong signals about where a bug originates, repair agents drift toward shallow edits that silence the observed failure while leaving the underlying defect unresolved. Second, finding the root cause for bugs is hard: even developers familiar with the codebase frequently produce fixes that address symptoms rather than the root cause, and LLM-based agents, operating with noisier context and less program understanding, are no exception. We present Kumushi, a root-cause-driven patching agent that addresses both challenges by combining diversified dynamic fault localization with evidence-weighted ranking to focus the LLM on the code most relevant to the defect. To rigorously measure whether Kumushi produces genuinely better patches, we also introduce a two-tier patch quality metric that pairs automated oracle validation with structured expert assessment of patches. Evaluated on 178 C/C++ vulnerabilities, Kumushi substantially outperforms prior specialized repair agents under automated evaluation while matching a frontier commercial coding agent. Expert assessment then reveals differences that oracles cannot: Kumushi produces more root-cause fixes and fewer superficial patches, and is preferred in the majority of decisive pairwise comparisons. Together, these results demonstrate that progress in automated vulnerability repair requires not only stronger patching systems, but also richer evaluation methods capable of distinguishing genuine fixes from oracle-passing ones. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2605_04251 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Root-Cause-Driven Automated Vulnerability Repair Wang, Hulin Basque, Zion Leonahenahe Hu, Jie Bajaj, Ati Priya Liu, Yibo Zhu, Samuel Kobakhia, Giorgi Chapre, Nikhil Rosenberg, Will Mishra, Siddharth Gabani, Aditya Maheshbhai Schloegel, Moritz Doupé, Adam Shoshitaishvili, Yan Wang, Ruoyu Bao, Tiffany Cryptography and Security Software Engineering Recent LLM-based systems have made automated vulnerability repair increasingly practical, but two challenges remain. First, without strong signals about where a bug originates, repair agents drift toward shallow edits that silence the observed failure while leaving the underlying defect unresolved. Second, finding the root cause for bugs is hard: even developers familiar with the codebase frequently produce fixes that address symptoms rather than the root cause, and LLM-based agents, operating with noisier context and less program understanding, are no exception. We present Kumushi, a root-cause-driven patching agent that addresses both challenges by combining diversified dynamic fault localization with evidence-weighted ranking to focus the LLM on the code most relevant to the defect. To rigorously measure whether Kumushi produces genuinely better patches, we also introduce a two-tier patch quality metric that pairs automated oracle validation with structured expert assessment of patches. Evaluated on 178 C/C++ vulnerabilities, Kumushi substantially outperforms prior specialized repair agents under automated evaluation while matching a frontier commercial coding agent. Expert assessment then reveals differences that oracles cannot: Kumushi produces more root-cause fixes and fewer superficial patches, and is preferred in the majority of decisive pairwise comparisons. Together, these results demonstrate that progress in automated vulnerability repair requires not only stronger patching systems, but also richer evaluation methods capable of distinguishing genuine fixes from oracle-passing ones. |
| title | Root-Cause-Driven Automated Vulnerability Repair |
| topic | Cryptography and Security Software Engineering |
| url | https://arxiv.org/abs/2605.04251 |