Reproduce “RAVEN: Agentic RAG for Automated Vulnerability Repair” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Varun Gadey, Zijie Liu, Alexandra Dmitrienko
RAVEN, developed by the University of Duisburg-Essen, introduces an agentic Retrieval-Augmented Generation (RAG) framework for automated software vulnerability repair. This framework achieved an 86.75% repair success rate across 10 diverse Java Common Weakness Enumerations (CWEs) and demonstrated effective generalization on unseen vulnerabilities in C programs, all while operating locally with open-source LLMs at an average repair time of 7-8 minutes per vulnerability.
Key insights
- Integrating multi-faceted retrieval of historical fixes with repository-level context reasoning via an autonomous Curator Agent is crucial for effectively addressing complex, cross-file vulnerabilities.
- Iterative patch refinement, guided by a dedicated Patch Reviewer and static analysis tools, significantly enhances patch correctness and helps control the probabilistic output of LLMs.
- Open-source, locally deployable LLMs can achieve competitive automated vulnerability repair performance, providing a cost-effective and practical alternative to proprietary cloud-based solutions.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.