Abstract:The automated program repair field has attracted substantial interest over the years, but despite significant research efforts, creating a system that works well for complex semantic bugs such as security vulnerabilities has proven difficult. A promising direction to solve this challenge is by leveraging large language models (LLMs), which are increasingly used to solve various programming tasks. In this paper, we investigate the effectiveness of LLMs for solving code-repair task. We show that the task is difficult as it requires the model to learn long-range code relationships, a task that inherently relies on extensive amounts of training data. At the same time, creating a large, clean dataset for complex program bugs and their corresponding fixes is non-trivial. We propose a technique to address these challenges with a new approach for querying and fine-tuning LLMs. The idea is to use program analysis to limit the LLM's attention mechanism on the portions of code needed to perform the fix, drastically reducing the amount of required training data. Concretely, for training and inference, rather than feeding the entire program to the LLM, we reduce its code to a much shorter snippet that contains the reported defect together with the necessary context - and use that instead. Our evaluation shows that this code reduction approach substantially improves available models such as GPT-4 using few-shot learning, as well as fine-tuning models. To train and evaluate our system, we created a comprehensive code fixing dataset by extensively labeling 156 bug patterns (including 40 security rules), requiring complex interprocedural dataflow to discover. Our best system with Mixtral-8x7B can remove more than 80% of the reported defects while exactly matching the human fix in between 10 and 50% of cases, outperforming baselines based on GPT-3.5 and GPT-4, or based on window-based models like TFix.

Automated Repair of AI Code with Large Language Models and Formal Verification

VeRe: Verification Guided Synthesis for Repairing Deep Neural Networks.

A New Era in Software Security: Towards Self-Healing Software via Large Language Models and Formal Verification

DeepCode AI Fix: Fixing Security Vulnerabilities with Large Language Models

Enhanced Automated Code Vulnerability Repair using Large Language Models

Is Your AI-Generated Code Really Safe? Evaluating Large Language Models on Secure Code Generation with CodeSecEval

Code Security Vulnerability Repair Using Reinforcement Learning with Large Language Models

Assured Automatic Programming via Large Language Models

On Hardware Security Bug Code Fixes By Prompting Large Language Models

LLM-Powered Code Vulnerability Repair with Reinforcement Learning and Semantic Reward

CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completion

RePair: Automated Program Repair with Process-based Feedback

How secure is AI-generated Code: A Large-Scale Comparison of Large Language Models

Automatic Programming: Large Language Models and Beyond

Investigating large language models capabilities for automatic code repair in Python

Neural Network Repair with Reachability Analysis

Fixing Hardware Security Bugs with Large Language Models

SAFE: Advancing Large Language Models in Leveraging Semantic and Syntactic Relationships for Software Vulnerability Detection

Semantic Code Repair using Neuro-Symbolic Transformation Networks

How Well Do Large Language Models Serve as End-to-End Secure Code Producers?

Repairing Security Vulnerabilities Using Pre-trained Programming Language Models