一句话：提出 MUSSEL 框架，通过多阶段训练与自奖励反馈提升 LLM 对软件漏洞的一次性修复准确率。
大型语言模型在漏洞修复中展现出潜力，但现有方法精度不足，往往需要多次尝试才能生成正确补丁。本文提出 MUSSEL（多样本自奖励反馈）框架，旨在实现一次性漏洞修复。该方法采用多阶段训练：首先利用领域特定数据进行监督微调，使模型获得漏洞修复的基础知识；随后通过自奖励反馈学习，迭代利用正确与错误的补丁来优化生成能力；同时设计了新的提示模板以更好对齐推理阶段。实验表明，MUSSEL 在一次性查询中持续优于现有最优方案，即使使用较小的 beam size 也保持高效且 GPU 内存需求低，并在多种 CWE 类型上均有效，具有显著安全意义。
In recent years, large language models (LLMs) have emerged as powerful tools to assist developers in various coding tasks, including the challenging domain of vulnerability repair. While these models have demonstrated significant potential in generating patches for software vulnerabilities, current approaches often suffer from limitations in precision, requiring multiple attempts to produce accurate fixes. In this paper, we propose MUSSEL (Multi-Sample Self-Reward Feedback), a novel framework designed to address the issue of one-shot vulnerability patching. Inspired by insights from human learning mechanisms, our approach aims to enhance the efficiency and accuracy of LLMs in generating precise patches for software vulnerabilities. We introduce a multi-stage training process, beginning with supervised fine-tuning using domain-specific data to impart foundational knowledge in vulnerability repair to the LLM. Subsequently, we employ self-reward feedback learning to refine the model’s patch generation capabilities, leveraging correct and incorrect patches iteratively to improve performance. We also introduce a novel prompt design tailored to better align with the capabilities of LLMs during inference. Our results demonstrate that MUSSEL consistently outperforms state-of-the-art solutions in one-shot queries. Notably, even with a small beam size, MUSSEL exhibits remarkable efficiency, requiring minimal GPU memory resources. Furthermore, MUSSEL’s effectiveness across diverse CWEs underscores its significant security implications.
DOI 原文 ·
@inproceedings{paperbot9361,
title = {Hit The Bullseye On The First Shot: Improving LLMs Using Multi-Sample Self-Reward Feedback for Vulnerability Repair},
author = {Rui Jiao and Yue Zhang and Jinku Li and Jianfeng Ma},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00071}
}