DeepAVR repairs 92.3% of vulnerabilities via multi-agent analysis
The claim
DeepAVR generates correct patches for 92.3% of vulnerabilities in the VulnLoc dataset
Published as: “DeepAVR: Deep Analysis via Multi-Agent Collaboration for Automated Vulnerability Repair”
So what
Higher-quality automated patches can reduce manual remediation effort and service downtime, making AVR more viable for production software.
The five-minute version
DEEPAVR fixes 36 out of 39 real-world vulnerabilities (92.3% correct patches), outperforming five prior AVR systems. It also generates correct patches for 22 of 25 unseen vulnerabilities (88% success) and produces 25 plausible patches versus 24 by the strongest baseline. The evidence comes from two benchmark suites (VulnLoc and SAN2VULN) with manual correctness assessment, showing higher patch quality at modest additional token cost.
What they found 1
- DEEPAVR achieved 36 correct patches out of 39 vulnerabilities (92.3% success)
“DEEPAVR achieved 36 valid repairs (92.3%).”
What’s new here 4
- Failure-aware role decomposition with structured feedback routing among specialized agents
- Patch-conditioned re-localization that uses intermediate patch failures as diagnostic probes
- Root-cause-oriented patch review to filter out symptom-level fixes
- A multi-agent orchestration framework built on LLMs that iteratively refines fault hypotheses
Artifacts & methods 10
- DEEPAVRsystem
- Fault Localization Agentprimitive
- Patch Generation Agentprimitive
- Compile Validation Agentprimitive
- Security Validation Agentprimitive
- Functionality Validation Agentprimitive
- Patch Review Agentprimitive
- VulnLoc benchmarkdataset
- SAN2VULN benchmarkdataset
- Token usage and runtime measurementevaluation