一句话：提出 LoopRepair，利用补丁位置信息与测试失败轨迹评估，迭代生成更高质量的漏洞修复补丁。
现有基于大语言模型（LLM）的漏洞修复方法通常只关注补丁内容，忽略需要修补的位置，且迭代中缺乏候选补丁质量评估。论文提出 LoopRepair：提供“应先修补哪里”的位置信息，实现位置感知修复；并评估测试失败补丁的质量，选择最佳补丁进入下一轮迭代。质量评估从两个维度进行：是否引入新漏洞与污点语句覆盖率。作者在真实 C/C++ 漏洞修复数据集 VulnLoc+（含 40 个漏洞及其 PoV）上评估。结果表明，LoopRepair 生成 27 个合理补丁，比基线多 8 至 22 个；正确修复漏洞数比现有方法多 8 至 13 个。
The advances of large language models (LLMs) have paved the way for automated software vulnerability repair approaches, which iteratively refine the patch until it becomes plausible. Nevertheless, existing LLM-based vulnerability repair approaches face notable limitations: 1) they ignore the concern of locations that need to be patched and focus solely on the repair content. 2) they lack quality assessment for generated candidate patches in the iterative process. To tackle the two limitations, we propose LoopRepair, an LLM-based approach that provides information about where should be patched first. Furthermore, LoopRepair improves the iterative repair strategy by assessing the quality of test-failing patches and selecting the best patch for the next iteration. We introduce two dimensions to assess the quality of patches: whether they introduce new vulnerabilities and the taint statement coverage. We evaluated LoopRepair on a real-world C/C++ vulnerability repair dataset VulnLoc+, which contains 40 vulnerabilities and their Proofs-of-Vulnerability. The experimental results demonstrate that LoopRepair exhibits substantial improvements compared with the Neural Machine Translation-based, Program Analysis-based, and LLM-based state-of-the-art vulnerability repair approaches. Specifically, LoopRepair is able to generate 27 plausible patches, which is comparable to or even 8 to 22 more plausible patches than the baselines. In terms of correct patch generation, LoopRepair repairs 8 to 13 additional vulnerabilities compared with existing approaches.
@inproceedings{abs-2512-20203,
title = {Well Begun is Half Done: Location-Aware and Trace-Guided Iterative Automated Vulnerability Repair},
author = {Zhenlei Ye and Xiaobing Sun and Sicong Cao and Lili Bo and Bin Li},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3773218}
}