💻 computer science

AgenticSZZ: Temporal Knowledge Graph-Guided Agentic Bug-Inducing Commit Identification

AgenticSZZ is a novel approach that leverages Temporal Knowledge Graphs and LLM agents to overcome the limitations of traditional git blame-based methods by reframing Bug-Inducing Commit identification as a graph search problem, thereby significantly improving detection accuracy through expanded historical context and causal reasoning.

Original authors: Yu Shi, Hao Li, Bram Adams, Ahmed E. Hassan

Published 2026-05-12

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Yu Shi, Hao Li, Bram Adams, Ahmed E. Hassan

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Detective's New Map: How AgenticSZZ Finds Software Bugs

Imagine you are a detective trying to solve a mystery: Who broke the code? In the world of software, a "bug" is a mistake that causes a program to crash or act strangely. To fix it, you need to find the exact moment in history when a developer accidentally introduced that mistake. This moment is called the Bug-Inducing Commit (BIC).

For decades, detectives have used a standard tool called SZZ (named after its creators). Think of SZZ as a magnifying glass that looks at the "crime scene" (the code fix) and asks, "Who touched this specific line of code last?" It uses a command called git blame to point a finger at the most recent person who changed that line.

The Problem:
The authors of this paper discovered a major flaw in this old method. They looked at over 2,000 real-world bug fixes and found that 40% of the time, the magnifying glass points to the wrong person.

Why?

The Red Herring: Sometimes the person who touched the line last just changed the font color or added a space (a "cosmetic change"). The real bug was introduced by someone else months ago, but the old SZZ tool can't see past the last person.
The Missing Clue: Sometimes, the fix didn't touch any old lines at all; it just added new lines. In this case, the magnifying glass has nothing to look at, and the tool gives up entirely.

The Solution: AgenticSZZ

The authors, Yu Shi and his team from Queen's University, built a new system called AgenticSZZ. Instead of just looking at one line of code, they built a Time-Traveling Map (a Temporal Knowledge Graph) and hired a Super-Detective AI (an LLM Agent) to navigate it.

Here is how it works, using simple analogies:

1. Building the Map (The Temporal Knowledge Graph)

Imagine the history of a software project not as a straight line of text, but as a giant, 3D spiderweb.

The Nodes: Every time a developer saves their work (a "commit"), it's a dot on the web.
The Threads: The web connects these dots in two ways:
- Time: Who came before whom?
- Structure: Who changed the same files or functions?
The Expansion: Unlike the old method that only looks at the immediate neighborhood, AgenticSZZ expands the map. It traces the web backward from the fix and backward from the "last person who touched the line." This ensures the map includes the "Red Herrings" and the "Missing Clues" that the old tool ignored.

2. The Super-Detective (The LLM Agent)

Now that they have the map, they need someone smart enough to read it. They didn't just ask a computer to scan the list; they hired an AI Agent equipped with special tools.

Think of this Agent as a detective with a toolkit:

The List Maker: "Show me the top suspects."
The Time Traveler: "Let me walk backward along the web to see who else touched this file."
The Fact Checker: "Read the commit message and the code changes to see if this person actually broke the logic."
The Logic Brain: "Does this change make sense as the cause of the bug?"

The Agent doesn't just guess. It explores the map, checks the evidence, and reasons through the history to find the real culprit, even if that person is far back in the timeline or on a different branch of the project.

The Results: A Better Detective

The team tested this new system on three massive datasets (Linux kernel, Apache projects, and GitHub repositories). Here is what they found:

Success Rate: AgenticSZZ found the correct bug-inducing commit 16% to 34% more often than the best existing methods.
Solving the Unsolvable: It successfully solved cases that were previously impossible, such as when the fix added new code (the "Blameless" cases) or when the bug was introduced by a commit that happened after the last person touched the line but before the fix.
The "Sweet Spot" of AI: The authors tested different AI models to be the detective. They found that the AI needs to be "smart enough" to do the job. Smaller, cheaper AI models tended to give up too quickly or skip the important steps, failing to find the bug. Only the larger, more capable models could successfully navigate the complex web of history.

The Takeaway

The paper argues that finding software bugs isn't just about ranking a list of suspects (the old way); it's about searching a complex web of history (the new way).

By combining a Time-Traveling Map (which expands the search space) with a Reasoning AI Agent (which intelligently filters the suspects), AgenticSZZ solves a problem that has stumped software detectives for 20 years. It proves that to find the root cause of a bug, you sometimes have to look far beyond the person who last touched the code.

Technical Summary: AgenticSZZ

Problem Statement

Identifying the Bug-Inducing Commit (BIC) is a foundational task in software maintenance, enabling defect prediction, automated program repair, and historical bug analysis. The dominant approach for two decades has been the SZZ algorithm and its variants, which rely on git blame to trace deleted or modified lines in a Bug-Fixing Commit (BFC) back to the commit that last touched them.

However, this approach suffers from fundamental limitations regarding recall. A preliminary study of 2,102 validated bug-fixing commits by the authors reveals that git blame alone is insufficient for nearly half of all cases:

28% of BICs require traversing commit history beyond the direct blame results (either as ancestors of blame commits or ancestors of the BFC).
14% of cases are "blameless," where the BFC contains only added lines with no deleted/modified lines to blame, rendering standard SZZ inapplicable.
Even within the 57% of cases where BICs appear in blame results, identifying the correct BIC among multiple candidates remains challenging due to high complexity in some projects.

Existing improvements to SZZ have focused on filtering heuristics, refactoring detection, or ranking blame candidates using deep learning and LLMs, but they remain constrained by the search space defined strictly by git blame.

Methodology: AgenticSZZ

The authors propose AgenticSZZ, the first approach to apply Temporal Knowledge Graphs (TKGs) to software evolution analysis. The core insight is reframing BIC identification from a ranking problem over a static list of blame candidates to a graph search problem over the temporal commit history.

The methodology operates in two distinct phases:

1. Temporal Knowledge Graph (TKG) Construction

The system constructs a graph that encodes commits as nodes with temporal ordering and structural connections (shared files and functions). The search space is expanded beyond direct blame results through two traversal directions:

Blame Ancestor Traversal: Starting from blame commits, the system walks backward through file history to find earlier commits that may have introduced the bug logic.
BFC Ancestor Traversal: Starting from the BFC, the system walks backward toward the blame commits to identify intermediate commits that may have transformed correct code into buggy code.
Context Expansion: To handle "blameless" cases and improve seed quality, the system applies a fallback strategy, blaming context lines (2 lines before and after) surrounding added code.

The graph schema includes:

Nodes: Commits (labeled as BFC, blame, blame_ancestor, or bfc_ancestor), Files, and Functions.
Edges: PRECEDES (temporal ordering), MODIFIES_FILE, MODIFIES_FUNCTION, and DEFINED_IN.

2. Agentic BIC Search

An LLM agent navigates the constructed TKG using four specialized tools to reason about causal relationships:

Candidate Enumeration (list_candidates): Retrieves top- $K$ candidates ranked by a fitness score (prioritizing blame > blame_ancestor > bfc_ancestor).
Structural Traversal (traverse_graph): Follows edges to discover commits modifying the same code entities.
Property Query (query_node): Inspects commit metadata (messages, timestamps, overlaps).
Causal Analysis (read_node_content): Reads code diffs to verify if a candidate's changes causally relate to the bug fix.

The agent iteratively investigates candidates, potentially overriding initial rankings based on semantic reasoning and causal verification, until a decision is reached or a step limit is exhausted.

Key Contributions

Preliminary Study (RQ0): A systematic characterization of BIC locations relative to blame commits, quantifying that 28% of cases require history traversal and 14% are blameless, establishing the necessity for expanded search strategies.
AgenticSZZ Framework: The first application of TKGs to software evolution analysis, reframing BIC identification as a graph search problem. This enables the identification of BICs outside the traditional blame-defined candidate set.
Comprehensive Evaluation: A rigorous evaluation on three datasets (Linux, Apache, GitHub) comparing AgenticSZZ against seven SZZ variants and the state-of-the-art LLM4SZZ.
LLM Sensitivity Analysis: An investigation into how different open-weight LLMs affect performance, identifying a capability threshold for effective TKG navigation.

Results

Evaluation on 2,102 validated BFC-BIC pairs demonstrates that AgenticSZZ achieves state-of-the-art performance:

Performance: AgenticSZZ achieves F1-scores ranging from 0.47 to 0.79 across datasets. It outperforms the previous state-of-the-art (LLM4SZZ) by 16.0% to 34.2% in F1-score.
Statistical Significance: Improvements are statistically significant (McNemar's test, $p < 0.001$ ) on three of four dataset splits. Even the worst-performing run of AgenticSZZ outperforms the best run of LLM4SZZ.
Ablation Study:
- Both the TKG and the LLM agent are mutually essential; TKG-only introduces noise without intelligent filtering, while Agent-only is bounded by the limited blame search space.
- The combination of TKG traversal and context expansion unlocks the "Ancestor" category, yielding a net gain of 60 true positives across datasets compared to LLM4SZZ.
- Context expansion trades roughly 48 "Blame" true positives for 106 additional "Ancestor" true positives, resulting in a net positive gain on most datasets.
LLM Sensitivity: Only models with 37B+ active parameters (DeepSeek-V3.2 and DeepSeek-V4-Pro) consistently outperform the simple Blame-fallback baseline. Smaller models fail to perform sufficient multi-step verification (skipping query_node and read_node_content calls), effectively reducing to a less reliable heuristic.
Architectural Amplification: A controlled comparison using DeepSeek-V4-Pro shows that the TKG architecture amplifies the benefits of stronger LLMs. The performance gap between AgenticSZZ and LLM4SZZ widens from 18.8% (with V3.2) to 32.0% (with V4-Pro), whereas LLM4SZZ's gains plateau due to its blame-bounded search space.

Significance and Claims

The paper claims that AgenticSZZ opens a new research direction for temporal and causal reasoning in software evolution analysis. By transforming BIC identification into a graph search problem, the approach overcomes the inherent recall limitations of git blame-based methods.

The authors emphasize that the improvement is driven by the TKG-guided paradigm rather than merely the choice of a more capable LLM. The TKG provides a structured reasoning space that allows stronger models to navigate complex commit histories effectively, whereas approaches confined to linear blame lists face a performance ceiling regardless of the underlying LLM's capability. The work suggests that future advancements in BIC identification will depend on integrating structured search spaces with agentic reasoning, provided the LLM possesses sufficient capability to perform multi-step verification.