ExploreRepair improves automated vulnerability repair success under limited information
The claim
The authors claim their framework achieves higher repair success rates than prior methods when vulnerability details are incomplete
Published as: “ExploreRepair: Evidence-Specialized Agents for Vulnerability Repair under Information Constraints”
So what
The approach shows that specialized evidence gathering and hierarchical aggregation can substantially improve automated vulnerability repair when PoV tests are unavailable.
The five-minute version
EXPLOREREPAIR repairs 71.6% of PatchEval vulnerabilities with DeepSeek-V4.1-Flash, beating the prior EvoRepair baseline by 25.4 percentage points. The paper evaluates on 169 PatchEval and 35 VulnLoc+ bugs, showing consistent gains across models and languages, with low overfitting rates. Evidence comes from public benchmark experiments comparing against several baselines.
What they found 1
- EXPLOREREPAIR achieves 71.6% repair success on PatchEval with DeepSeek-V4.1-Flash, exceeding EvoRepair by 25.4 points.
“On PatchEval, EXPLOREREPAIR achieves repair success rates of 39.6% and 71.6% with GPT5.6-Luna and DeepSeek-V4.1-Flash, respectively, exceeding EvoRepair, a vulnerability repair approach, by 16.0 and 25.4 percentage points.”
What undercuts it the paper’s own results
- The final Aggregator only adds 0.6 and 2.4 percentage points over the stronger separate aggregators, indicating modest benefit from the reconciliation step.
Stated limits 2
- First, EXPLOREREPAIR’s results depend on the underlying LLM. While EXPLOREREPAIR outperforms the baselines for the two models used in our experiments, the strongest exploration agent differs between them. As such, the experimental results are likely to vary with other models, prompts, or sampling seeds. We ran the experiments three times at a sampling temperature of 1, with repair counts varying by at most one across runs.
- Second, some baselines were designed to use vulnerability reports or PoVs. Removing these artifacts transforms the setting for which the baseline approaches were designed. We preserved their original code where possible, and thoroughly assessed the implementation details. During this process, we identified an evaluation flaw in IntentFix’s replication package, which has been confirmed by its authors.
What’s new here 3
- Uses three evidence-specialized exploration agents that gather structural, semantic, and PoV evidence separately.
- Hierarchical aggregation with separate Lesson and Patch aggregators before a final reconciler.
- Achieves high repair success without any vulnerability metadata or PoV tests.
Artifacts & methods 9
- EXPLOREREPAIRsystem
- Code Knowledge Graph agentprimitive
- Intent agentprimitive
- PoV generation agentprimitive
- Lesson Aggregatorsystem
- Patch Aggregatorsystem
- Final Aggregatorsystem
- PatchEvaldataset
- VulnLoc+dataset