APPATCH: Automated Adaptive Prompting Large Language Models for Real-World Software Vulnerability Patching

Yu Nong, Haoran Yang, Long Cheng, Hongxin Hu, Haipeng Cai

Software vulnerabilities pose an incessant and critical threat to digital security, with their volume and sophistication growing rapidly. Timely and effective patching is paramount, yet manual approaches are costly, slow, and struggle to keep pace with newly discovered flaws, especially zero-day vulnerabilities. While automated patching solutions exist, they often suffer from significant limitations: traditional code analysis methods typically require exploit evidence or compilable code, which may not be available, and deep learning (DL) based approaches lack generalizability due to insufficient training data. Large Language Models (LLMs) have emerged as powerful tools for code-related tasks, showing promise in vulnerability patching, but prior LLM-based methods often fall short on real-world vulnerabilities due to a lack of guided reasoning, context limitations, and susceptibility to hallucination.

AI review

Solid systems paper that actually addresses the real problems with LLM-based patching instead of just throwing GPT at code and calling it research. The semantics-aware scoping and adaptive prompting aren't revolutionary ideas, but the combination works and the evaluation on zero-days is genuinely useful. Not a breakthrough, but real engineering that moves the needle.