Recoleta
GitHub
Source note

MemRepair: Hierarchical Memory for Agentic Repository-Level Vulnerability Repair

Authors
Simiao Liu, Li Zhang, Fang Liu, Xiaoli Lian, Yang Liu, Yinghao Zhu
Source
arXiv
Published
Collection
Software Intelligence
Automated Vulnerability RepairCode AgentsRepository Level RepairMemory Augmented AgentsSoftware Engineering AI
Open arXivMarkdown source

Summary

MemRepair is an agentic system for repository-level vulnerability repair that adds persistent repair memory to LLM-based code agents. It claims higher repair rates on SEC-Bench, PatchEval, and Multi-SWE-bench C++ while keeping per-task cost close to general coding agents.

Problem

  • Repository-level vulnerability repair often needs cross-file reasoning, runtime validation, and fixes that preserve existing behavior.
  • Current LLM agents often generate a patch from the visible context only, so they repeat failed fixes and miss project-specific repair conventions.
  • This matters because manual vulnerability repair is slow and expensive, and incorrect automated patches can remove code, hide crashes, or introduce regressions.

Approach

  • MemRepair uses three memory layers: History-Fix Memory for past fixes from the same or similar projects, Security-Pattern Memory for reusable defense patterns, and Refinement-Trajectory Memory for failed patch to successful patch correction paths.
  • Retrieval first prefers same project, same CWE, and same language; if too few examples are found, it searches other projects with the same CWE and language.
  • The repair loop has a Locator, Patcher, and Verifier. The Verifier runs vulnerability and regression tests, then either accepts the patch, asks for a new patch, or asks the Locator to find a better code location.
  • Iter_grep parses repository structure and ranks likely code locations using stack traces, sanitizer reports, symbol uses, and distance to the crash site.
  • Failed attempts are compressed into compact logs, and successful repair sessions update the memory used by later tasks.

Results

  • On SEC-Bench, MemRepair with DeepSeek-v3.2 resolved 58.00% of tasks, compared with OpenHands* with DeepSeek-v3.2 at 38.50%, OpenHands with Claude-3.7 at 34.00%, SWE-agent with Claude-3.7 at 31.50%, and Aider with Claude-3.7 at 23.50%.
  • On SEC-Bench, MemRepair cost $0.26 per task, compared with OpenHands* at $0.18, OpenHands Claude-3.7 at $0.61, SWE-agent at $1.29, and Aider at $0.44.
  • On SEC-Bench, MemRepair reached 60.00% correct localization. SWE-agent had higher localization at 67.50%, but lower repair success at 31.50%.
  • On PatchEval across Python, Go, and JavaScript, MemRepair resolved 58.2% of tasks. The excerpt says this is more than 20 percentage points above the prior best agents, but it does not provide the full per-baseline table.
  • On Multi-SWE-bench C++, MemRepair with DeepSeek-v3.2 resolved 30.58% of tasks, compared with InfCode-C++ with GPT-5 at 25.60%, MOpenHands with Claude-3.7 at 14.70%, MSWE-agent with Claude-3.7 at 11.60%, and MAgentless with Claude-3.7 at 3.90%.
  • With the same DeepSeek-v3 backend on Multi-SWE-bench C++, MemRepair resolved 15.08% of tasks, compared with InfCode-C++ at 13.20%.

Link