Pith Number

pith:TO7IFMAX

pith:2026:TO7IFMAXTHFECEHGDFOCRFM34Z

not attested not anchored not stored refs pending

VulKey: Automated Vulnerability Repair Guided by Domain-Specific Repair Patterns

Jia Li, Michael R. Lyu, Yuxin Su, Zhuangbin Chen

A framework guides LLMs using a three-level hierarchy of security knowledge to generate more accurate vulnerability patches.

arxiv:2605.01769 v3 · 2026-05-03 · cs.CR · cs.SE

Open paper page JSON Open Graph Bundle Merged state Verified badge What is a Pith Number?

Add to your LaTeX paper

\usepackage{pith}
\pithnumber{TO7IFMAXTHFECEHGDFOCRFM34Z}

Prints a linked badge after your title and injects PDF metadata. Compiles on arXiv. Learn more · Embed verified badge

Record completeness

1 Bitcoin timestamp

2 Internet Archive

3 Author claim open · sign in to claim

4 Citations open

5 Replications open

✓ Portable graph bundle live · download bundle · merged state

The bundle contains the canonical record plus signed events. A mirror can host it anywhere and recompute the same current state with the deterministic merge algorithm.

Claims

C1strongest claim

On the real-world C/C++ dataset PrimeVul, VulKey achieves 31.5% repair accuracy, surpassing the best baseline by 7.6% and outperforming leading tools such as VulMaster and GPT-5. Moreover, VulKey demonstrates cross-language and cross-model generalizability, with state-of-the-art performance on the Java benchmark Vul4J.

C2weakest assumption

That the three-level hierarchical abstraction (CWE type, syntactic actions, semantic key elements) can be reliably matched to unseen vulnerabilities and will provide sufficient guidance for the fine-tuned LLM to produce correct, generalizable patches without overfitting to the abstracted patterns.

C3one line summary

VulKey reaches 31.5% repair accuracy on real C/C++ vulnerabilities by matching hierarchical expert patterns to guide LLM patch generation, beating prior baselines by 7.6%.

Cited by

1 paper in Pith

Signal Reshaping for GRPO in Weak-Feedback Agentic Code Repair

Receipt and verification

First computed	2026-06-30T01:16:30.426369Z
Builder	pith-number-builder-2026-05-17-v1
Signature	Pith Ed25519 (`pith-v1-2026-05`) · public key
Schema	pith-number/v1.0

Canonical hash

9bbe82b01799ca4110e6195c28959be6545a865b6716d4d9c8af635c905acd22

Aliases

arxiv: 2605.01769 · arxiv_version: 2605.01769v3 · doi: 10.48550/arxiv.2605.01769 · pith_short_12: TO7IFMAXTHFE · pith_short_16: TO7IFMAXTHFECEHG · pith_short_8: TO7IFMAX

Agent API

Resolver JSON Graph JSON Events JSON Schema Signing key

Verify this Pith Number yourself

curl -sH 'Accept: application/ld+json' https://pith.science/pith/TO7IFMAXTHFECEHGDFOCRFM34Z \
  | jq -c '.canonical_record' \
  | python3 -c "import sys,json,hashlib; b=json.dumps(json.loads(sys.stdin.read()), sort_keys=True, separators=(',',':'), ensure_ascii=False).encode(); print(hashlib.sha256(b).hexdigest())"
# expect: 9bbe82b01799ca4110e6195c28959be6545a865b6716d4d9c8af635c905acd22

Canonical record JSON

{
  "metadata": {
    "abstract_canon_sha256": "ff1fdcdaeda2d112faa8e061ad590c485aa839e2ba1dc374c5a246d584553269",
    "cross_cats_sorted": [
      "cs.SE"
    ],
    "license": "http://creativecommons.org/licenses/by/4.0/",
    "primary_cat": "cs.CR",
    "submitted_at": "2026-05-03T08:07:41Z",
    "title_canon_sha256": "9b5420b54fcdbef37be73fc34bb282380219ff8107fc39a34be47a9865433095"
  },
  "schema_version": "1.0",
  "source": {
    "id": "2605.01769",
    "kind": "arxiv",
    "version": 3
  }
}