P2Patch: Exploit-Guided Vulnerability Repair

Key points

• Large language models are increasingly deployed as autonomous agents for automated program repair, patching software vulnerabilities through multi-step reasoning and tool use.1
• Yet these systems typically validate a patch against the same evidence used to construct it -- a static alert, sanitizer trace, published exploit, or test suite.1
• Starting from a normalized vulnerability finding, an exploitation agent constructs a reproducing proof of vulnerability (PoV), a patching agent repairs the program, and the exploitation agent then attacks the patched program for a distinct same-vulnerability exploit.1
• Across 101 C/C++ and Java CVE subjects, this adversarial loop surfaces a distinct confirmed exploit in 41% of runs after the patch has already blocked its original construction-time PoV.1

Sources (1)

• [1]P2Patch: Exploit-Guided Vulnerability Repair
  arXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 14, 02:19 PM

  We present P2Patch, a generative adversarial repair system that treats each patch as a new attack target.

  Large language models are increasingly deployed as autonomous agents for automated program repair, patching software vulnerabilities through multi-step reasoning and tool use.

Extractive summary: sentences quoted from the sources.