一句话:提出 InferFix,结合静态分析器与检索增强的微调 LLM,实现安全与性能缺陷的端到端自动修复。
软件缺陷修复成本高昂,现有基于大语言模型的程序修复多依赖少样本或指令提示,且主要学习公共仓库中未分类 bug 的通用修复模式。本文提出 InferFix,将静态分析器 Infer 与检索增强的 LLM 修复框架结合:检索器通过对比学习搜索语义等价的 bug 与修复,生成器为 12B Codex Cushman,在监督 bug-fix 数据上微调,并以 bug 类型标注和相似修复增强提示。作者构建了在数千 Java/C# 仓库变更历史上运行 Infer 得到的数据集。评估显示,C# top-1 准确率 65.6%、Java 76.8%,优于强 LLM 基线,并已集成到 Microsoft CI 流水线。
Software development life cycle is profoundly influenced by bugs; their introduction, identification, and eventual resolution account for a significant portion of software development cost. This has motivated software engineering researchers and practitioners to propose different approaches for automating the identification and repair of software defects. Large Language Models (LLMs) have been adapted to the program repair task through few-shot demonstration learning and instruction prompting, treating this as an infilling task. However, these models have only focused on learning general bug-fixing patterns for uncategorized bugs mined from public repositories. In this paper, we propose : a transformer-based program repair framework paired with a state-of-the-art static analyzer to fix critical security and performance bugs. combines a Retriever – transformer encoder model pretrained via contrastive learning objective, which aims at searching for semantically equivalent bugs and corresponding fixes; and a Generator – an LLM (12 billion parameter Codex Cushman model) finetuned on supervised bug-fix data with prompts augmented via adding bug type annotations and semantically similar fixes retrieved from an external non-parametric memory. To train and evaluate our approach, we curated , a novel, metadata-rich dataset of bugs extracted by executing the Infer static analyzer on the change histories of thousands of Java and C# repositories. Our evaluation demonstrates that outperforms strong LLM baselines, with a top-1 accuracy of 65.6% for generating fixes in C# and 76.8% in Java. We discuss the deployment of alongside Infer at Microsoft which offers an end-to-end solution for detection, classification, and localization of bugs, as well as fixing and validation of candidate patches, integrated in the continuous integration (CI) pipeline to automate the software development workflow.
DOI 原文 · arXiv · PDF(开放获取) · DBLP
@inproceedings{abs-2303-07263,
title = {InferFix: End-to-End Program Repair with LLMs},
author = {Matthew Jin and Syed Shahriar and Michele Tufano and Xin Shi and Shuai Lu and Neel Sundaresan and Alexey Svyatkovskiy},
booktitle = {FSE},
year = {2023},
doi = {10.1145/3611643.3613892}
}