ExploreRepair agents patch vulnerabilities without full bug details
Original title: ExploreRepair: Evidence-Specialized Agents for Vulnerability Repair under Information Constraints
On PatchEval it scores 39.6% with GPT-5.6-Luna and 71.6% with DeepSeek-V4.1-Flash, above EvoRepair by 16.0 and 25.4 points.
ExploreRepair uses three agents that each explore a different reading of a vulnerability when classification or a proof-of-vulnerability test is missing. A Lesson Aggregator and a Patch Aggregator independently draft repairs, and a final aggregator reconciles them without benchmark feedback. On VulnLoc+ the same models reach 51.4% and 62.9%, exceeding a LoopRepair variant without PoV tests by 20.0 and 17.1 percentage points.
Unconfirmed: Success rates are the authors' benchmark comparisons, not an independent evaluation.
- Three agents explore separate dimensions before a repair is chosen.
- The final aggregator does not receive benchmark feedback.
- VulnLoc+ rates are 51.4% for GPT-5.6-Luna and 62.9% for DeepSeek-V4.1-Flash.
- Those VulnLoc+ gains over LoopRepair without PoV tests are 20.0 and 17.1 points.
- AI models
- GPT-5.6-LunaDeepSeek-V4.1-Flash
From the original article
1 min read at arxiv.orgAutomated vulnerability repair must often operate with incomplete vulnerability information: developers may lack an accurate vulnerability classification or a provided proof-of-vulnerability (PoV) test, yet still need to produce a repair. Without detailed information, a key challenge is to explore multiple plausible interpretations of the vulnerability before committing to a repair.
By Duc Manh Tran · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.