Technical Summary: KEAREPAIR

Problem Statement

While frontier foundation models have accelerated vulnerability discovery and reduced costs, the remediation side struggles to keep pace. Existing Automated Vulnerability Repair (AVR) approaches, particularly those based on Large Language Models (LLMs), face two fundamental limitations:

1. Unreliable Root Cause Analysis: Current methods often rely on static LLM reasoning or dynamic localization tools to identify vulnerability causes. However, LLMs suffer from hallucinations when reasoning without verified facts, and localization tools often fail to pinpoint exact fix locations, especially when the root cause and the fix location are spatially distant. Furthermore, reliance on sanitizer reports limits generalizability to memory safety issues.
2. Insufficient Utilization of Vulnerability Knowledge: While Retrieval-Augmented Generation (RAG) is used to provide historical examples, naive retrieval strategies focus on surface-level code similarity. This often retrieves examples with similar root causes but divergent repair patterns, misleading the LLM. Existing methods that attempt to match root causes often suffer from precision issues and high computational costs.

Methodology: KEAREPAIR

The authors propose KEAREPAIR, a novel Knowledge-Enhanced Agentic AVR approach. The system operates through three tightly coupled phases:

1. Vulnerability Knowledge Base Construction

Inspired by how developers understand vulnerabilities via control-flow and data-flow, KEAREPAIR constructs a dual-view knowledge base from historical vulnerability-patch pairs.

• Knowledge Extraction: Using LLMs, the system extracts five specific knowledge items from two views (Data-flow and Control-flow): Root Cause, Vulnerable Behaviors (Sensitive APIs, Taint Flow, Control Branch), and Fixing Strategies.
• Knowledge Abstraction: Concrete code elements (variable names, method invocations) are abstracted to create generalizable knowledge less bound to specific implementations.
• Storage: Knowledge is stored in vector databases (using all-MiniLM-L6-v2 for embedding and Faiss for search) to enable efficient retrieval.

2. Fact-Grounded Agentic Vulnerability Diagnosis

Instead of relying on pure LLM reasoning or external localization tools, KEAREPAIR employs a tool-augmented diagnostic agent following the ReAct paradigm.

• Specialized Tools: The agent utilizes three static analysis tools:
  • trace_data_flow: Traces taint propagation paths to verify unsafe value influences.
  • is_path_reachable: Verifies control-flow paths and branch predicates to determine if suspicious operations are executable.
  • inspect_API_usage: Analyzes syntactic usage contexts of sensitive APIs.
• Output: The agent iteratively explores the codebase to collect verified program facts, which are organized into a structured diagnostic report. This minimizes LLM hallucinations by grounding the diagnosis in concrete evidence.

3. Knowledge-Level Retrieval-Augmented Patch Generation

Based on the diagnostic report, the system generates patches through a cascading retrieval and refinement process.

• View-Specific Query Generation: The system generates semantic queries based on the verified root cause (rather than raw code) to find high-level commonalities.
• Cascading Knowledge Retrieval:
  1. Initial Retrieval: Top-10 candidates are retrieved from the dual-view knowledge bases.
  2. Hybrid Re-ranking: A hybrid re-ranker combines Code Similarity (using pre-trained CodeLlama embeddings) and Behavior Similarity (using BM25 on structured diagnostic reports) to select the most relevant exemplars.
• Patching and Validation: The repair agent synthesizes a patch using in-context learning from the retrieved exemplars and knowledge. The patch undergoes a closed-loop validation process: it is compiled, and the triggering Proof-of-Concept (PoC) and test suites are re-executed. If validation fails, the feedback is returned to the agent for iterative refinement.

Key Contributions

1. Identification of Challenges: The paper identifies and addresses the unreliability of root cause analysis and the insufficient utilization of deep vulnerability knowledge in current LLM-based AVR.
2. Novel Approach: KEAREPAIR introduces a framework that grounds patch generation in verified program facts (via static analysis tools) and multi-dimensional vulnerability knowledge (via dual-view retrieval), effectively mitigating hallucinations and improving demonstration quality.
3. Extensive Evaluation: The approach is evaluated on 55 reproducible C/C++ vulnerabilities and 173 multilingual vulnerabilities, demonstrating superior performance across various LLM backbones and vulnerability types.

Experimental Results

• Performance on C/C++: When paired with Gemini-3.1-Pro, KEAREPAIR successfully repaired 46 out of 55 vulnerabilities (83.64%). This significantly outperforms the state-of-the-art baseline PatchAgent (39/55), fixing nine unique vulnerabilities that PatchAgent could not address.
• Cost and Efficiency: The optimal configuration (Gemini-3.1-Pro) achieves a repair rate of 83.64% with an average cost of $0.30 per vulnerability and a time overhead of under 50 seconds.
• Cross-Language Generalizability: On the PATCHEVAL benchmark (Go, JavaScript, Python), KEAREPAIR achieved a success rate of 85.55% (148/173) when paired with Qwen3.5-Plus, demonstrating strong generalizability beyond C/C++.
• Ablation Studies: Removing the feedback-based iteration mechanism caused the largest performance drop (from 46 to 26 repairs), highlighting the critical role of iterative refinement. Similarly, removing the dual-view retrieval pipeline significantly degraded performance, confirming the necessity of multi-dimensional knowledge.

Significance and Claims

The paper claims that KEAREPAIR represents a significant advancement in automated vulnerability repair by shifting from "purely static reasoning" to "fact-grounded agentic reasoning." The authors argue that:

• Reliability: Grounding diagnosis in verified program facts via specialized tools is essential to overcome LLM hallucinations in complex codebases.
• Knowledge Quality: High-level, dual-view (control and data flow) knowledge retrieval is superior to surface-level code similarity for guiding patch generation.
• Practicality: The system achieves a strong cost-benefit trade-off, making it viable for real-world deployment where rapid response to vulnerabilities is critical.

The authors acknowledge limitations, including challenges with complex macros in static analysis and the difficulty of handling inter-procedural vulnerabilities that require cross-file changes, noting that their current knowledge base is function-level. They also note the potential threat of data leakage in LLM training but emphasize that controlled studies confirm the improvements are due to the system's design.