P2Patch: Exploit-Guided Vulnerability Repair
P2Patch forces LLM vulnerability repairs to block new same-bug exploits found by an adversarial agent.
P2Patch is a generative adversarial repair system in which an exploitation agent builds a proof of vulnerability, a patching agent fixes the program, and the exploiter then seeks a distinct exploit of the same vulnerability. Successful exploits become permanent repair requirements and are kept separate from held-out evaluation oracles. Across 101 C/C++ and Java CVE subjects, a distinct confirmed exploit appeared in 41% of runs after the original construction-time PoV was already blocked. Against single-pass repair with Claude Code, held-out fix-closed coverage rose from 78.1% to 84.7% and beyond-upstream coverage from 42.1% to 62.5%.
- Exploitation and patching agents iterate until new same-bug exploits fail.
- Distinct exploits surfaced in 41% of runs after the first PoV was blocked.
- Held-out fix-closed coverage rose from 78.1% to 84.7%.
- Beyond-upstream coverage rose from 42.1% to 62.5% versus Claude Code.
- Evaluated on 101 C/C++ and Java CVE subjects.
- Products
- Claude Code
From the original article
1 min read at arxiv.orgLarge language models are increasingly deployed as autonomous agents for automated program repair, patching software vulnerabilities through multi-step reasoning and tool use. Yet these systems typically validate a patch against the same evidence used to construct it -- a static alert, sanitizer trace, published exploit, or test suite.
By Mohsen Iranmanesh · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.