一句话：系统考察不同输入信息类型对 LLM 漏洞修复性能的影响，并给出输入选择与组织方式的实用指南。
本文关注 LLM 自动化漏洞修复中一个被忽视的问题：究竟应当向模型提供哪些输入信息。作者首先调研了 26 篇近期工作，将所用输入归纳为若干类别，包括易受攻击的代码片段、漏洞行标记、CVE/CWE 标识与描述，以及补丁上下文等附加元数据。随后在多种 LLM 架构与数据集上开展大量实验，逐一分析这些输入单独使用以及组合使用时对修复准确率的影响。结果显示，并非所有输入类型都带来正向收益：部分信息会引入噪声或冗余，反而削弱模型生成有效补丁的能力。基于上述分析，论文提出了选择与组织输入信息的实践准则，以优化基于 LLM 的漏洞修复流程。
Software vulnerabilities pose significant security risks, and timely repair is essential for mitigating potential exploits. Large Language Models (LLMs) have shown promise in automating vulnerability repair, but their effectiveness heavily depends on the input information provided. This paper systematically investigates the impact of different input types on LLM-based vulnerability repair performance. We surveyed 26 recent studies to categorize the input information used, including vulnerable code snippets, vulnerable line markers, CVE/CWE identifiers and descriptions, and additional metadata such as patch context. Through extensive experiments, we analyzed how these inputs, individually and in combination, influence the accuracy of vulnerability repair across various LLM architectures and datasets. Our findings reveal that not all input types contribute positively to repair performance; some may introduce noise or redundancy that hinders the model’s ability to generate effective patches. Based on our analysis, we provide practical guidelines for selecting and structuring input information to optimize LLM-based vulnerability repair.