用分层记忆增强智能体，让修复漏洞更可靠且可复用。
MemRepair: Hierarchical Memory for Agentic Repository-Level Vulnerability Repair
- 引入历史修复、安全模式和优化轨迹三类记忆，支持迭代修复。
- 在三个基准上分别达到58.0%、58.2%和30.58%的修复成功率。
- 适合需要长期学习与复用修复经验的自动化漏洞修复场景。
现代软件生态中披露的漏洞数量快速增长，亟需可在仓库级可靠运行的自动化修复技术。尽管基于大语言模型（LLM）的智能体在自动化漏洞修复（AVR）中展现潜力，但现有系统大多将修复视为单一生成步骤，缺乏持久机制来重用先前修复或从失败验证中学习，限制了其在复杂多文件任务中的表现。我们提出MemRepair，一种带记忆增强的智能体框架，将漏洞修复建模为迭代式、经验驱动的过程。MemRepair结合历史修复、安全模式和优化轨迹三类互补记忆层，并采用动态反馈驱动的优化循环。该设计使智能体能够检索仓库特定的修复惯例，应用可复用的安全防御策略，并利用以往‘失败到成功’的修复路径，基于运行时证据修正语义无效的补丁。我们在三个代表性仓库级漏洞修复基准上评估：SEC-Bench、PatchEval（Python、Go、JavaScript）以及Multi-SWE-bench的C++子集。MemRepair分别取得58.0%、58.2%和30.58%的最优修复率，优于OpenHands、SWE-agent等通用智能体及InfCode-C++等专用工具，同时保持合理的修复成本。结果表明，持久的分层修复记忆能显著提升智能体在多种语言和仓库环境下的可靠性。
原文摘要 · Abstract (English)
Modern software ecosystems face a rapidly growing number of disclosed vulnerabilities, increasing the need for automated repair techniques that can operate reliably at repository scale. Although Large Language Model (LLM)-based agents have recently shown promise for automated vulnerability repair (AVR), most existing systems still treat repair as a single generation step over the currently visible code context. As a result, they lack a persistent mechanism for reusing prior fixes or learning from failed validation attempts, which limits their effectiveness on complex, multi-file repair tasks. We present MemRepair, a memory-augmented agentic framework that formulates vulnerability repair as an iterative, experience-driven process. MemRepair combines three complementary memory layers, i.e., History-Fix, Security-Pattern, and Refinement-Trajectory memories, with a dynamic feedback-driven refinement loop. This design allows the agent to retrieve repository-specific repair conventions, apply reusable security defenses, and exploit prior "failure-to-success" trajectories to revise semantically invalid patches based on runtime evidence. We evaluate MemRepair on three representative repository-level vulnerability repair benchmarks: SEC-Bench, PatchEval (Python, Go, JavaScript), and the C++ subset of Multi-SWE-bench. MemRepair achieves state-of-the-art resolution rates of 58.0%, 58.2%, and 30.58%, respectively, outperforming strong general-purpose agents such as OpenHands and SWE-agent, as well as the specialized AVR tool InfCode-C++, while maintaining competitive repair cost. These results show that persistent, hierarchical repair memory can substantially improve the reliability of agentic vulnerability repair across diverse languages and repository settings.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。