Semantics-Aligned, Curriculum-Driven, and Reasoning-Enhanced Vulnerability Repair Framework Article Swipe

MAKE IMPACT

Chengran Yang , Ting Zhang , Jingchi Jiang , Xin Zhou , Haoye Tian , Jieke Shi , Junkai Chen , Yikun Li , Eng Lieh Ouh , Lwin Khin Shar , David Lo · YOU? · · 2025 · Open Access · · DOI: https://doi.org/10.48550/arxiv.2510.01002

Current learning-based Automated Vulnerability Repair (AVR) approaches, while promising, often fail to generalize effectively in real-world scenarios. Our diagnostic analysis reveals three fundamental weaknesses in state-of-the-art AVR approaches: (1) limited cross-repository generalization, with performance drops on unseen codebases; (2) inability to capture long-range dependencies, causing a performance degradation on complex, multi-hunk repairs; and (3) over-reliance on superficial lexical patterns, leading to significant performance drops on vulnerabilities with minor syntactic variations like variable renaming. To address these limitations, we propose SeCuRepair, a semantics-aligned, curriculum-driven, and reasoning-enhanced framework for vulnerability repair. At its core, SeCuRepair adopts a reason-then-edit paradigm, requiring the model to articulate why and how a vulnerability should be fixed before generating the patch. This explicit reasoning enforces a genuine understanding of repair logic rather than superficial memorization of lexical patterns. SeCuRepair also moves beyond traditional supervised fine-tuning and employs semantics-aware reinforcement learning, rewarding patches for their syntactic and semantic alignment with the oracle patch rather than mere token overlap. Complementing this, a difficulty-aware curriculum progressively trains the model, starting with simple fixes and advancing to complex, multi-hunk coordinated edits. We evaluate SeCuRepair on strict, repository-level splits of BigVul and newly crafted PrimeVul_AVR datasets. SeCuRepair significantly outperforms all baselines, surpassing the best-performing baselines by 34.52% on BigVul and 31.52% on PrimeVul\textsubscript{AVR} in terms of CodeBLEU, respectively. Comprehensive ablation studies further confirm that each component of our framework contributes to its final performance.

Type

preprint

Language

en

Landing Page

http://arxiv.org/abs/2510.01002

PDF

https://arxiv.org/pdf/2510.01002

OA Status

green

OpenAlex ID

https://openalex.org/W4414810190

Raw OpenAlex JSON

OpenAlex ID

https://openalex.org/W4414810190

Canonical identifier for this work in OpenAlex

DOI

https://doi.org/10.48550/arxiv.2510.01002

Digital Object Identifier

Title

Semantics-Aligned, Curriculum-Driven, and Reasoning-Enhanced Vulnerability Repair Framework

Work title

Type

preprint

OpenAlex work type

Language

en

Primary language

Publication year

2025

Year of publication

Publication date

2025-10-01

Full publication date if available

Authors

Chengran Yang, Ting Zhang, Jingchi Jiang, Xin Zhou, Haoye Tian, Jieke Shi, Junkai Chen, Yikun Li, Eng Lieh Ouh, Lwin Khin Shar, David Lo

List of authors in order

Landing page

https://arxiv.org/abs/2510.01002

Publisher landing page

PDF URL

https://arxiv.org/pdf/2510.01002

Direct link to full text PDF

Open access

Yes

Whether a free full text is available

OA status

green

Open access status per OpenAlex

OA URL

https://arxiv.org/pdf/2510.01002

Direct OA link when available

Cited by

0

Total citation count in OpenAlex

Full payload