一句话：提出 LLMPort，通过任务分解与自我纠正实现跨文件安全补丁移植，在 Java/C 补丁上优于现有方法。
安全补丁移植旨在将某一软件版本的补丁适配到另一版本，对维护软件安全至关重要。现有方法多依赖预定义规则，泛化性与可移植性受限，且难以处理跨多个文件、修改大量代码行的复杂补丁，这在 Java 应用中尤为常见。作者提出 LLMPort：将复杂移植任务分解为以原子代码单元为单位的子任务；为每个子任务抽取最小相关代码上下文，并结合任务特定领域知识构造提示；再通过渐进式自我纠正自动评估生成补丁的正确性，定位并修复错误子任务。在 1,992 个唯一补丁文件对的 Java 数据集上，LLMPort 成功移植 91.92% 的补丁；在 C 语言补丁上也优于 TSBPORT 和 FixMorph，并发现五个因补丁不完整导致的 0-day 漏洞，生成的新补丁被开发者合并到官方分支。
Security patch porting aims to adapt patches developed for one software version so they can be used in another version. This approach is crucial for maintaining the security of software systems over time. However, existing works often rely on predefined rules to understand patches, limiting their generalizability and portability. Additionally, they are ineffective when porting complex patches that involve numerous modified code lines across multiple files, which is common in real-world software, especially Java applications.To overcome these obstacles, we propose a novel patch porting framework, called LLMPort. First, LLMPort breaks down the complex patch porting task into distinct subtasks, each containing an atomic code unit from the original patch. This enhances the LLMs’ focus. Second, for each subtask, LLMPort extracts the minimal patch-related code context and constructs a prompt with task-specific domain knowledge to guide the LLM in porting the patch code to the target version. Third, LLMPort implements a progressive self-correction system to automatically assess the correctness of the generated patch, and identify and correct error subtasks based on LLMs’ self-correction capabilities.We evaluate LLMPort for porting Java language patches on a large-scale dataset, including 1,992 unique patch file pairs, and it successfully ports 91.92% of them. To assess the portability of LLMPort, we also evaluate its capability to port C language patches. The results show that it outperforms state-of-the-art approaches, including TSBPORT and FixMorph. LLMPort also discovers five 0-day vulnerabilities due to incomplete patches and the developers received and merged the new patches generated by LLMPort into the official code branches.
DOI 原文 ·
@inproceedings{paperbot9511,
title = {LLMPort: Cross-file Patch Porting via Task Decomposition and Self-correction},
author = {Bofei Chen and Lei Zhang and Peng Deng and Nan Wang and Haoyu Xu and Mingda Guo and Yuan Zhang and Min Yang},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00236}
}