DeepAVR multi-agent system repairs 92.3% of VulnLoc flaws
Original title: DeepAVR: Deep Analysis via Multi-Agent Collaboration for Automated Vulnerability Repair
Specialized agents re-localize from failed patches and reject symptom-only fixes on real C/C++ bugs.
DeepAVR is a multi-agent automated vulnerability repair framework that turns intermediate repair results into structured diagnostic feedback. Roles cover fault localization, patch generation, compile, security, and functionality validation, and patch review, with patch-conditioned re-localization aimed at root causes far from the crash site. On the VulnLoc C/C++ dataset it produces correct patches for 92.3% of vulnerabilities and, the authors say, generalizes to unseen SAN2VULN cases.
Unconfirmed: The paper does not state how many VulnLoc or SAN2VULN cases were evaluated.
- Correct patches cover 92.3% of VulnLoc vulnerabilities.
- Patch review looks for symptom-level and incomplete repairs.
- SAN2VULN results are described as strong generalization to unseen flaws.
- The method targets root causes distant from or masked at the crash site.
From the original article
1 min read at arxiv.orgAutomated Vulnerability Repair (AVR) has emerged as a critical defense against software security flaws, aiming to triage and fix bugs autonomously. Early LLM-based approaches focused on patch generation under the assumption of perfect fault localization, while recent end-to-end methods attempt to repair vulnerabilities directly from sanitizer logs.
By Woorim Han · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.