REVIEW 4 cited by
APPATCH: Automated Adaptive Prompting Large Language Models for Real-World Software Vulnerability Patching
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
Signed reviews
read the original abstract
Timely and effective vulnerability patching is essential for cybersecurity defense, for which various approaches have been proposed yet still struggle to generate valid and correct patches for real-world vulnerabilities. In this paper, we leverage the power and merits of pre-trained language language models (LLMs) to enable automated vulnerability patching using no test input/exploit evidence and without model training/fine-tuning. To elicit LLMs to effectively reason about vulnerable code behaviors, which is essential for quality patch generation, we introduce vulnerability semantics reasoning and adaptive prompting on LLMs and instantiate the methodology as APPATCH, an automated LLM-based patching system. Our evaluation of APPATCH on 97 zero-day vulnerabilities and 20 existing vulnerabilities demonstrates its superior performance to both existing prompting methods and state-of-the-art non-LLM-based techniques (by up to 28.33% in F1 and 182.26% in recall over the best baseline). Through APPATCH, we demonstrate what helps for LLM-based patching and how, as well as discussing what still lacks and why.
Forward citations
Cited by 4 Pith papers
-
SLICEMATE: Accurate and Scalable Static Program Slicing via LLM-Powered Agents
SliceMate, an LLM multi-agent pipeline with synthesis, verification, and refinement agents, reports large gains over existing slicing tools on a new manually annotated Java and Python benchmark, SliceBench.
-
Guiding AI to Fix Its Own Flaws: An Empirical Study on LLM-Driven Secure Code Generation
Across two Python security benchmarks, all eight LLMs produced vulnerable code at rates from 9.8% to 42.1%, and self-generated hints plus explained feedback reduced vulnerabilities mainly for the strongest models.
-
Eradicating the Unseen: Detecting, Exploiting, and Remediating a Path Traversal Vulnerability across GitHub
A single vulnerable Node.js path traversal pattern was found in 1,756 GitHub projects, most rated critical, and the authors' automated pipeline produced patches, disclosures, and evidence that LLMs have learned the pattern.
-
From Texts to Shields: Convergence of Large Language Models and Cybersecurity
A workshop report outlining how large language models and agentic AI can be applied to cybersecurity, together with open challenges and a proposed research roadmap.
Discussion (0). Continue with ORCID to comment.