MemRepair: Hierarchical Memory for Agentic Repository-Level Vulnerability Repair

• URL: http://arxiv.org/abs/2605.17444v1
• Date: Sun, 17 May 2026 13:29:46 GMT
• Title: MemRepair: Hierarchical Memory for Agentic Repository-Level Vulnerability Repair
• Abstract summary: Modern software ecosystems face a rapidly growing number of disclosed vulnerabilities.<n>Most existing systems treat vulnerability repair as a single generation step over the currently visible code context.<n>We present MemRepair, a memoryaugmented agentic framework that formulates vulnerability repair as an iterative, experience-driven process.
• Score: 10.709112246848058
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Modern software ecosystems face a rapidly growing number of disclosed vulnerabilities, increasing the need for automated repair techniques that can operate reliably at repository scale. Although Large Language Model (LLM)-based agents have recently shown promise for automated vulnerability repair (AVR), most existing systems still treat repair as a single generation step over the currently visible code context. As a result, they lack a persistent mechanism for reusing prior fixes or learning from failed validation attempts, which limits their effectiveness on complex, multi-file repair tasks. We present MemRepair, a memory-augmented agentic framework that formulates vulnerability repair as an iterative, experience-driven process. MemRepair combines three complementary memory layers, i.e., History-Fix, Security-Pattern, and Refinement-Trajectory memories, with a dynamic feedback-driven refinement loop. This design allows the agent to retrieve repository-specific repair conventions, apply reusable security defenses, and exploit prior "failure-to-success" trajectories to revise semantically invalid patches based on runtime evidence. We evaluate MemRepair on three representative repository-level vulnerability repair benchmarks: SEC-Bench, PatchEval (Python, Go, JavaScript), and the C++ subset of Multi-SWE-bench. MemRepair achieves state-of-the-art resolution rates of 58.0%, 58.2%, and 30.58%, respectively, outperforming strong general-purpose agents such as OpenHands and SWE-agent, as well as the specialized AVR tool InfCode-C++, while maintaining competitive repair cost. These results show that persistent, hierarchical repair memory can substantially improve the reliability of agentic vulnerability repair across diverse languages and repository settings.

Related papers

• Vulnerability Localization Benchmark: Measuring Agentic Security Analysis at Repository Scale [54.83971397981572]
  Language-model agents increasingly operate over complete software repositories.<n> cybersecurity evaluations measure whether they can detect, reproduce, or repair vulnerabilities rather than whether they can locate the relevant code.<n>We study vulnerability localization: given a weakness class and an unfamiliar repository, identify the implementation files associated with that weakness.
  arXiv  Detail & Related papers  (2026-09-14T17:44:51Z)
• AgenticRepair: Multi-Faceted Program Context Engineering for Agentic Vulnerability Repair [3.793192864512799]
  Vulnerability repair demands richer program context than general bug repair.<n>We present AgenticRepair, an agentic vulnerability repair framework that addresses the gaps through multi-faceted program context engineering.
  arXiv  Detail & Related papers  (2026-07-31T13:42:51Z)
• Causal-AgentIR: Self-Evolving Causal Memory for Adaptive Image Restoration Agents [54.85451496831771]
  Causal-AgentIR is a hierarchical multi-agent framework with self-evolving causal memory for collective image restoration intelligence.<n>It organizes degradation patterns, image regions, restoration tools, actions, quality changes, and user preferences into a structured causal memory graph.<n>This graph supports graph-based retrieval and multi-hop causal reasoning, enabling agents to infer how specific restoration operations or tool sequences affect restoration quality under different degradation conditions.
  arXiv  Detail & Related papers  (2026-07-23T09:59:44Z)
• PhoenixRepair: Rethinking Repair Strategy Exploration in Software Agents [62.36339598951133]
  We present PhoenixRepair, a multi-agent framework that explores multiple candidate edit locations and generates better patches.<n>PhoenixRepair achieves the largest relative improvement of 7.8% over SWE-agent under DeepSeek-V3.1, and attains the highest resolved rate of 76.0% Pass@1 under MiniMax-M2.5.
  arXiv  Detail & Related papers  (2026-07-21T08:49:30Z)
• DepRepair: LLM-Based Source-Code Repair for Dependency Breaking Changes [26.444574129479463]
  DepRepair is a single-call LLM approach that grounds repair in structured upstream evidence through three components.<n>It attains the highest executable pass rate on each backbone, achieving 89.5% with GPT-5.5 and 82.1% with Claude Opus 4.6.
  arXiv  Detail & Related papers  (2026-07-20T13:58:13Z)
• Knowledge-Enhanced Agentic Vulnerability Repair [20.715227299482947]
  KeaRepair is a novel agentic approach that grounds patch generation in verified program facts and high-level vulnerability knowledge.<n>It significantly outperforms existing approaches on 55 C/C++ vulnerabilities.<n>When paired with Gemini-3.1-Pro, KeaRepair successfully repairs 46 vulnerabilities, achieving a repair rate of 83.64%.
  arXiv  Detail & Related papers  (2026-07-01T11:42:25Z)
• RAVEN: Agentic RAG for Automated Vulnerability Repair [48.8954115363348]
  We propose RAVEN, a scalable, efficient and autonomous framework for automated vulnerability repair.<n>RAVEN integrates an agentic retrieval-augmented generation (RAG) pipeline with controlled iterative repair in a unified framework.<n>RAVEN achieves an overall repair success rate of 83.13%, outperforming all existing state-of-the-art repair frameworks.
  arXiv  Detail & Related papers  (2026-06-21T19:18:06Z)
• ContraFix: Agentic Vulnerability Repair via Differential Runtime Evidence and Skill Reuse [10.503895811137095]
  Large language model (LLM) agents are increasingly used for automated vulnerability repair.<n>Recent empirical results show that these agents still struggle with real-world vulnerabilities.<n>We present ContraFix, an agentic framework that couples runtime evidence with reusable repair skills.
  arXiv  Detail & Related papers  (2026-05-17T13:48:25Z)
• EvidenT: An Evidence-Preserving Framework for Iterative System-Level Package Repair [26.445772656438752]
  We propose EvidenT, an evidence-preserving repair framework that decouples evidence management from tool execution.<n>We evaluate EvidenT on 219 real-world RISC-V package build failures.<n>Preliminary experiments achieve success rates of 41.77% on aarch64 and 46.99% on x86_64, demonstrating robustness across diverse hardware ecosystems.
  arXiv  Detail & Related papers  (2026-05-09T02:29:57Z)
• ARES: Adaptive Red-Teaming and End-to-End Repair of Policy-Reward System [70.10833169681239]
  Reinforcement Learning from Human Feedback (RLHF) is central to aligning Large Language Models (LLMs)<n>It introduces a critical vulnerability: an imperfect Reward Model (RM) can become a single point of failure when it fails to penalize unsafe behaviors.<n>We present ARES, a framework that systematically discovers and mitigates such dual vulnerabilities.
  arXiv  Detail & Related papers  (2026-04-20T19:54:47Z)
• QiMeng-PRepair: Precise Code Repair via Edit-Aware Reward Optimization [50.722636027998]
  Large Language Models (LLMs) achieve strong program repair performance but often suffer from over-editing.<n>We propose PRepair, a framework that mitigates over-editing and improves repair accuracy.
  arXiv  Detail & Related papers  (2026-04-07T14:56:38Z)
• FailureMem: A Failure-Aware Multimodal Framework for Autonomous Software Repair [45.42550492783294]
  Multimodal Automated Program Repair (MAPR) extends traditional program repair by requiring models to jointly reason over source code, textual issue descriptions, and visual artifacts such as GUI screenshots.<n>We propose FailureMem, a multimodal repair framework that integrates three key mechanisms: a hybrid workflow-agent architecture that balances structured localization with flexible reasoning, active perception tools that enable region-level visual grounding, and a Failure Memory Bank that converts past repair attempts into reusable guidance.
  arXiv  Detail & Related papers  (2026-03-18T15:24:22Z)
• RepoRepair: Leveraging Code Documentation for Repository-Level Automated Program Repair [30.23781155493087]
  We propose RepoRepair, a novel documentation-enhanced approach for repository-level fault localization and program repair.<n>Our core insight is to leverage LLMs to generate hierarchical code documentation (from functions to files) for code repositories.<n>RepoRepair first employs a text-based LLM to generate file/function-level code documentation for repositories, which serves as auxiliary knowledge to guide fault localization.
  arXiv  Detail & Related papers  (2026-03-01T11:06:24Z)
• RealSec-bench: A Benchmark for Evaluating Secure Code Generation in Real-World Repositories [58.32028251925354]
  Large Language Models (LLMs) have demonstrated remarkable capabilities in code generation, but their proficiency in producing secure code remains a critical, under-explored area.<n>We introduce RealSec-bench, a new benchmark for secure code generation meticulously constructed from real-world, high-risk Java repositories.
  arXiv  Detail & Related papers  (2026-01-30T08:29:01Z)
• Semantics-Aligned, Curriculum-Driven, and Reasoning-Enhanced Vulnerability Repair Framework [15.17681731375364]
  SeCuRepair is a semantics-aligned, curriculum-driven, and reasoning-enhanced framework for vulnerability repair.<n>At its core, SeCuRepair adopts a reason-then-edit paradigm, requiring the model to articulate why and how a vulnerability should be fixed.<n>SeCuRepair also moves beyond traditional supervised fine-tuning and employs semantics-aware reinforcement learning.
  arXiv  Detail & Related papers  (2025-10-01T15:09:27Z)
• RelRepair: Enhancing Automated Program Repair by Retrieving Relevant Code [11.74568238259256]
  RelRepair retrieves relevant project-specific code to enhance automated program repair.<n>We evaluate RelRepair on two widely studied datasets, Defects4J V1.2 and ManySStuBs4J.
  arXiv  Detail & Related papers  (2025-09-20T14:07:28Z)
• ReF Decompile: Relabeling and Function Call Enhanced Decompile [50.86228893636785]
  The goal of decompilation is to convert compiled low-level code (e.g., assembly code) back into high-level programming languages.<n>This task supports various reverse engineering applications, such as vulnerability identification, malware analysis, and legacy software migration.
  arXiv  Detail & Related papers  (2025-02-17T12:38:57Z)
• RAP-Gen: Retrieval-Augmented Patch Generation with CodeT5 for Automatic Program Repair [75.40584530380589]
  We propose a novel Retrieval-Augmented Patch Generation framework (RAP-Gen) RAP-Gen explicitly leveraging relevant fix patterns retrieved from a list of previous bug-fix pairs. We evaluate RAP-Gen on three benchmarks in two programming languages, including the TFix benchmark in JavaScript, and Code Refinement and Defects4J benchmarks in Java.
  arXiv  Detail & Related papers  (2023-09-12T08:52:56Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.