SynthFix: Adaptive Neuro-Symbolic Code Vulnerability Repair

1. Problem Statement

Large Language Models (LLMs) have shown promise in automated code repair but face significant limitations in security-critical contexts:

• Semantic Gap: LLMs primarily learn syntactic patterns and textual plausibility from open-source corpora. They often fail to grasp the strict semantic and structural constraints required for fixing security vulnerabilities.
• Failure Modes: Models may generate patches that look correct syntactically but remain functionally flawed, fail to eliminate the vulnerability, or introduce new bugs.
• Training Paradigm Limitations:
  • Supervised Fine-Tuning (SFT): Effective for learning common syntactic repair patterns but struggles with complex semantic reasoning not explicitly present in training data.
  • Reward Fine-Tuning (RFT): Uses reinforcement learning (e.g., PPO) with dynamic feedback (e.g., passing security checks) to refine solutions. However, RFT is notoriously sample-inefficient, computationally expensive, and suffers from slow convergence.

The core challenge is bridging the gap between the efficiency of SFT and the deep reasoning capabilities of RFT without incurring prohibitive computational costs.

2. Methodology: SYNTHFIX Framework

SYNTHFIX is a hybrid neuro-symbolic framework designed to unify code synthesis with compiler-informed symbolic feedback. It employs an adaptive training strategy that dynamically routes code samples to the most appropriate learning path.

Key Components

1. Symbolic Reward Model (for RFT):
   Instead of sparse binary rewards (pass/fail), SYNTHFIX constructs a dense, composite reward signal ($r(\hat{y})$) derived from symbolic analysis tools. The reward is a weighted sum of three components:

   • Syntactic Correctness ($r_{AST}$): Validates the Abstract Syntax Tree (AST) to ensure well-formed code.
   • Logical Fidelity ($r_{CFG}$): Uses Control Flow Graphs (CFG) to verify that the patch preserves the intended program logic.
   • Assessed Security ($r_{Semgrep}$): Leverages static analysis tools (Semgrep) to directly verify if the specific vulnerability has been eliminated.

2. Neural Router Model:
   A lightweight classifier that acts as an adaptive scheduler. For every incoming batch of code, it analyzes compiler-derived features (e.g., AST complexity, CFG depth, code length) to predict the optimal training strategy:

   • Route to SFT: For syntactically straightforward repairs, utilizing the efficient SFT pipeline.
   • Route to RFT: For semantically complex vulnerabilities requiring iterative refinement and deep reasoning.

3. Repair Agent:
   The core transformer-based model ($\theta$) that is progressively updated. It receives either standard supervised loss (if routed to SFT) or a reward-based loss calculated via the symbolic reward model (if routed to RFT).

Training Algorithm

The training pipeline (Algorithm 1) iterates through batches:

1. Extract features from the code batch.
2. The Router Model predicts a binary decision ($0$ for SFT, $1$ for RFT).
3. If SFT: Compute standard supervised loss and update parameters.
4. If RFT: Generate candidate patches, compute the composite symbolic reward, calculate RFT loss, and update parameters.

3. Key Contributions

• Hybrid Neuro-Symbolic Framework: SYNTHFIX is the first framework to adaptively combine SFT and RFT using a neural router, mirroring how developers alternate between pattern application and tool-based debugging.
• Dense Symbolic Reward: The introduction of a multi-faceted reward function combining AST, CFG, and static analysis (Semgrep) provides granular feedback that guides the model toward structurally sound and semantically secure fixes.
• Adaptive Scheduling: The Router Model optimizes the trade-off between learning efficiency and repair quality by dynamically allocating computational resources based on code complexity.
• Comprehensive Evaluation: Extensive experiments across multiple model architectures (CodeT5, CodeGen, CodeLLaMA, StarCoder2) and languages (JavaScript, C).

4. Experimental Results

The framework was evaluated on FixJS (JavaScript) and CodeFlaws (C) benchmarks.

• Performance Gains:
  • SYNTHFIX achieved up to 18% relative improvement in CodeBLEU/CrystalBLEU and 32% in Exact Match compared to strong SFT and RFT baselines.
  • It consistently outperformed both "SFT-only" and "RFT-only" approaches across all tested models.
• Adaptive Routing Efficacy:
  • The router-enabled SYNTHFIX significantly outperformed a non-adaptive, fixed-ratio hybrid baseline, confirming that dynamic scheduling is superior to static mixing.
  • Efficiency: The adaptive model converged faster and reached higher peak accuracy, particularly in later training epochs.
• Generalization:
  • Performance gains were consistent across diverse vulnerability types (CWE categories) and code functionalities (e.g., Async Operations, I/O & Data).
  • SYNTHFIX demonstrated robustness in handling complex scenarios like Cross-Site Scripting (CWE-79) and logical errors.
• Ablation Study:
  • Removing any single component of the reward model (AST, CFG, or Semgrep) degraded performance.
  • Critical Finding: Excluding the Semgrep signal caused the most significant drop, highlighting that direct semantic feedback on security correctness is the strongest driver of repair capability.

5. Significance and Future Work

• Paradigm Shift: SYNTHFIX demonstrates that program repair is not a monolithic task; different vulnerabilities require different learning strategies. The adaptive approach effectively acts as a "learned curriculum scheduler."
• Neuro-Symbolic Synergy: The results validate that grounding LLMs in formal, verifiable logic (via compilers and static analysis) is essential for reliable code generation, especially in security contexts.
• Future Directions:
  • Incorporating dynamic execution traces to capture runtime behavior for routing.
  • Scaling to industrial-grade codebases with complex dependencies.
  • Extending cross-lingual transfer to languages like Python.

Conclusion: SYNTHFIX represents a significant step forward in automated vulnerability repair by moving beyond purely neural approaches to a hybrid system that leverages the efficiency of pattern matching and the rigor of symbolic reasoning, resulting in more accurate, secure, and efficient code fixes.