Elamur Research⌕
☰
home / papers / 2026 / SeCuRepair: Semantics-Aligned, Curriculum-Driven, and Reasoning-Enhanced Vulnerability Repair Framework

SeCuRepair: Semantics-Aligned, Curriculum-Driven, and Reasoning-Enhanced Vulnerability Repair Framework

Paper · 2026 · Chengran Yang, Ting Zhang, Jinfeng Jiang et al.

Summary

SeCuRepair targets automated vulnerability repair (AVR) for C/C++ functions. The authors argue that supervised fine-tuning (SFT) teaches models to copy one reference patch. Valid fixes that are written differently get penalised, so models latch onto surface cues such as variable names. Their alternative is a reinforcement learning framework with three parts:

  • Reward: an execution-free score that mixes BLEU, AST similarity and data/control-flow-graph similarity to the reference. It credits patches that are equivalent in meaning even when they differ in form.
  • Initialization: the policy is first trained on diagnosis-then-patch reasoning traces distilled from proprietary LLMs.
  • Curriculum: training starts with single-hunk fixes and only later moves to multi-hunk ones.

Evaluation uses BigVul and a new benchmark, PrimeVul_AVR. PrimeVul_AVR is split by repository, which avoids the leakage that random function-level splits allow. SeCuRepair beats state-of-the-art baselines by roughly a third in CodeBLEU, and human judges rate it comparable to GPT-4o. The work matters because the volume of disclosed vulnerabilities far exceeds what people can analyse. Most real repair datasets also lack the build setups needed for test-based rewards.

Key points

  • Motivation: NVD published 49,230 CVE records in 2025, and about 27,900 CVEs remain unanalysed. Simply renaming local variables made SFT repair models fail in 40–70% of cases.
  • Leakage evidence: switching from random to cross-repository splits lowered baseline CodeBLEU by 21.49–29.70% (relative). Exact match fell by 87.88–89.86%.
  • Main results: CodeBLEU gains over baselines were 37.21% on BigVul and 33.58% on PrimeVul_AVR. Training a Qwen-2.5-7B SFT model with reasoning traces added 6.94% CodeBLEU over patch-only SFT.
  • Robustness and CWE analysis:
    • Under variable-name perturbation, VulMaster lost 14.75% CodeBLEU, while SeCuRepair lost only 3.39%.
    • On SQL Injection (CWE-89), the score rose from 0.201 (SFT baseline) to 0.430.
  • Limitations:
    • The reward still depends on comparison with a reference patch.
    • Only C/C++ was tested.
    • The reasoning data was distilled from closed models such as GPT-5-mini; the distilled datasets are released.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓National University of SingaporeSingapore · Singapore180 works · 34,304 citations🎓Monash UniversityMelbourne · Australia60 works · 54,866 citations🎓Singapore Management UniversitySingapore · Singapore27 works · 2,382 citations🎓Aalto UniversityEspoo · Finland13 works · 648 citations

 Fields, topics and concepts

📚 Shelves 6The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksArts and Humanities · 16,039 worksLanguage and Linguistics · 15,891 worksInformation Systems · 1,437 worksSoftware · 92 works

🧭 Topics 1Research subjects and languages the work is about.Reasoning · 1,426 works

Cite

Cite as Chengran Yang, Ting Zhang, Jinfeng Jiang, Xin Zhou, Haoye Tian, Mingzhe Du, Jieke Shi, Junkai Chen, Yikun Li, Eng Lieh Ouh, Lwin Khin Shar and David Lo. 2026. SeCuRepair: Semantics-Aligned, Curriculum-Driven, and Reasoning-Enhanced Vulnerability Repair Framework. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.1481

@inproceedings{yang2026securepair,
  title = {{SeCuRepair: Semantics-Aligned, Curriculum-Driven, and Reasoning-Enhanced Vulnerability Repair Framework}},
  author = {Chengran Yang, Ting Zhang, Jinfeng Jiang, Xin Zhou, Haoye Tian, Mingzhe Du, Jieke Shi, Junkai Chen, Yikun Li, Eng Lieh Ouh, Lwin Khin Shar and David Lo},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.1481},
  url = {https://doi.org/10.18653/v1/2026.acl-long.1481}
}

References

39 references, 6 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. NVD dashboard. https://nvd.nist.gov/general/ nvd-dashboard. Accessed: 2025-09-07. ↗
  2. Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, and 1 others. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774.
  3. Tushar Aggarwal, Swayam Singh, Abhijeet Awasthi, Aditya Kanade, and Nagarajan Natarajan. 2025. Nextcoder: Robust adaptation of code lms to diverse code edits. In Forty-second International Conference on Machine Learning. find
  4. Jinze Bai, Shuai Bai, Yunfei Chu, Zeyu Cui, Kai Dang, Xiaodong Deng, Yang Fan, Wenbin Ge, Yu Han, Fei Huang, and 1 others. 2023. Qwen technical report. arXiv preprint arXiv:2309.16609.
  5. Yoshua Bengio, Jérôme Louradour, Ronan Collobert, and Jason Weston. 2009. Curriculum learning. In Proceedings of the 26th Annual International Conference on Machine Learning.
  6. ByteDance Seed. verl: Volcano engine reinforcement learning for LLMs. https://verl.readthedocs.io/en/latest/index.html. Accessed: 2025-09-07. ↗
  7. Zimin Chen, Steve Kommrusch, and Martin Monperrus. 2022. Neural transfer learning for repairing security vulnerabilities in c code. IEEE Transactions on Software Engineering, 49(1):147–165. 32116 9 find
  8. Yangruibo Ding, Yanjun Fu, Omniyyah Ibrahim, Chawin Sitawarin, Xinyun Chen, Basel Alomair, David Wagner, Baishakhi Ray, and Yizheng Chen. 2024. Vulnerability detection with code language models: How far are we? arXiv preprint arXiv: 2403.18624. — [arXiv:2403.18624](https://arxiv.org/abs/2403.18624) find
  9. Qingao Dong, Yuanzhang Lin, Hailong Sun, and Xiang Gao. 2025. Enhancing automated vulnerability repair through dependency embedding and pattern store. 2025 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER), pages 193–204. find
  10. Sujan Dutta, Sayantan Mahinder, Raviteja Anantha, and Bortik Bandyopadhyay. 2024. Applying rlaif for code generation with api-usage in lightweight llms. arXiv preprint arXiv:2406.20060. find
  11. Jiahao Fan, Yi Li, Shaohua Wang, and Tien N Nguyen. 2020. Ac/c++ code vulnerability dataset with code changes and cve summaries. In Proceedings of the 17th international conference on mining software repositories, pages 508–512. find
  12. Nicole Forsgren, Bas Alberts, Kevin Backhouse, Grey Baker, Greg Cecarelli, Derek Jedamski, Scot Kelly, and Clair Sullivan. 2021. 2020 state of the Octoverse: Securing the world’s software. arXiv preprint arXiv:2110.10246. — [arXiv:2110.10246](https://arxiv.org/abs/2110.10246) find
  13. Xiang Gao, Bo Wang, Gregory J Duck, Ruyi Ji, Yingfei Xiong, and Abhik Roychoudhury. 2021. Beyond tests: Program vulnerability repair via crash constraint extraction. ACM Transactions on Software Engineering and Methodology (TOSEM), 30(2):1– 27. find
  14. Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, and 1 others. 2025. Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning. arXiv preprint arXiv:2501.12948.
  15. Hugging Face. Transformers: State-of-the-art machine learning for PyTorch, TensorFlow, and JAX. https://huggingface.co/docs/transformers/ en/index. Accessed: 2025-09-07. ↗
  16. Binyuan Hui, Jian Yang, Zeyu Cui, Jiaxi Yang, Dayiheng Liu, Lei Zhang, Tianyu Liu, Jiajun Zhang, Bowen Yu, Keming Lu, and 1 others. 2024. Qwen2. 5-coder technical report. arXiv preprint arXiv:2409.12186. — Qwen2.5-Coder Technical Report
  17. Kaiyao Ke. 2025. Niodebugger: A novel approach to repair non-idempotent-outcome tests with llm-based agent. In 2025 IEEE/ACM 47th International Conference on Software Engineering (ICSE), pages 762– 762. IEEE Computer Society. find
  18. Zhiqiang Lin, Xuxian Jiang, Dongyan Xu, Bing Mao, and Li Xie. 2007. Autopag: towards automated software patch generation with source code root cause identification and repair. In Proceedings of the 2nd ACM symposium on Information, computer and communications security, pages 329–340. find
  19. Parvez Mahbub, Ohiduzzaman Shuvo, and Mohammad Masudur Rahman. 2023. Explaining software bugs leveraging code structures in neural machine translation. In 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE), pages 640–652. IEEE. find
  20. MITRE. CWE-476: NULL pointer dereference. https://cwe.mitre.org/data/definitions/476.html. Accessed: 2025-12-09. ↗
  21. MITRE. 2024. 2024 CWE top 25 most dangerous software weaknesses. https://cwe.mitre.org/ top25/archive/2024/2024_cwe_top25.html. Accessed: 2025-09-07. ↗
  22. NIST National Vulnerability Database. CVE-2021-29513. https://nvd.nist.gov/vuln/detail/ CVE-2021-29513. Accessed: 2025-12-09. ↗
  23. Md Mahbubur Rahman, Ira Ceka, Chengzhi Mao, Saikat Chakraborty, Baishakhi Ray, and Wei Le. 2024. Towards causal deep learning for vulnerability detection. In Proceedings of the 46th IEEE/ACM International Conference on Software Engineering, ICSE 2024, Lisbon, Portugal, April 14-20, 2024, pages 153:1… find
  24. Oussama Ben Sghaier, Rosalia Tufano, Gabriele Bavota, and Houari Sahraoui. 2025. Leveraging reward models for guiding code review comment generation. arXiv preprint arXiv:2506.04464. — [arXiv:2506.04464](https://arxiv.org/abs/2506.04464) find
  25. Zhihong Shao, Peiyi Wang, Qihao Zhu, Runxin Xu, Junxiao Song, Xiao Bi, Haowei Zhang, Mingchuan Zhang, YK Li, Yang Wu, and 1 others. 2024. Deepseekmath: Pushing the limits of mathematical reasoning in open language models. arXiv preprint arXiv:2402.03300.
  26. Nino Shervashidze, Pascal Schweitzer, Erik Jan Van Leeuwen, Kurt Mehlhorn, and Karsten M Borgwardt. 2011. Weisfeiler-lehman graph kernels. Journal of Machine Learning Research, 12(9). find
  27. Wannita Takerngsaksiri, Jirat Pasuksmit, Patanamon Thongtanunam, Chakkrit Tantithamthavorn, Ruix-iong Zhang, Fan Jiang, Jing Li, Evan Cook, Kun Chen, and Ming Wu. 2025. Human-in-the-loop software development agents. In 2025 IEEE/ACM 47th International Conference on Software Engineering: Software Eng… find
  28. Yue Wang, Weishi Wang, Shafiq Joty, and Steven CH Hoi. 2021. Codet5: Identifier-aware unified pre-trained encoder-decoder models for code understanding and generation. arXiv preprint arXiv:2109.00859. 32117 10 find
  29. Yuxiang Wei, Olivier Duchenne, Jade Copet, Quentin Carbonneaux, Lingming Zhang, Daniel Fried, Gabriel Synnaeve, Rishabh Singh, and Sida I Wang. 2025. Swe-rl: Advancing llm reasoning via reinforcement learning on open software evolution. arXiv preprint arXiv:2502.18449. find
  30. Martin Weyssow, Chengran Yang, Junkai Chen, Ratnadira Widyasari, Ting Zhang, Huihui Huang, Huu Hung Nguyen, Yan Naing Tun, Tan Bui, Yikun Li, and 1 others. 2025. R2vul: Learning to reason about software vulnerabilities with reinforcement learning and structured reasoning distillation. arXiv preprint… — [arXiv:2504.04699](https://arxiv.org/abs/2504.04699) find
  31. Robert F Woolson. 2007. Wilcoxon signed-rank test. Wiley encyclopedia of clinical trials, pages 1–3. find
  32. Chengran Yang, Hong Jin Kang, Jieke Shi, and David Lo. 2024. Acecode: A reinforcement learning framework for aligning code efficiency and correctness in code language models. arXiv preprint arXiv:2412.17264. — [arXiv:2412.17264](https://arxiv.org/abs/2412.17264) find
  33. Zhou Yang, Jieke Shi, Junda He, and David Lo. 2022. Natural attack for pre-trained models of code. In Proceedings of the 44th International Conference on Software Engineering, pages 1482–1493. find
  34. Jian Zhang, Shangqing Liu, Xu Wang, Tianlin Li, and Yang Liu. 2023. Learning to locate and describe vulnerabilities. In 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE), pages 332–344. IEEE. find
  35. Jian Zhang, Xu Wang, Hongyu Zhang, Hailong Sun, and Xudong Liu. 2020a. Retrieval-based neural source code summarization. In Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering, pages 1385–1397. find
  36. Jian Zhang, Xu Wang, Hongyu Zhang, Hailong Sun, Yanjun Pu, and Xudong Liu. 2020b. Learning to handle exceptions. In Proceedings of the 35th IEEE/ACM International Conference on Automated Software Engineering, pages 29–41. find
  37. Ting Zhang, Chengran Yang, Yindu Su, Martin Weyssow, Hung Nguyen, Tan Bui, Hong Jin Kang, Yikun Li, Eng Lieh Ouh, Lwin Khin Shar, and 1 others. 2025. Benchmarking large language models for multi-language software vulnerability detection. arXiv preprint arXiv:2503.01449. — [arXiv:2503.01449](https://arxiv.org/abs/2503.01449) find
  38. Yuntong Zhang, Xiang Gao, Gregory J Duck, and Abhik Roychoudhury. 2022. Program vulnerability repair via inductive inference. In Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis, pages 691–702. find
  39. Xin Zhou, Kisub Kim, Bowen Xu, DongGyun Han, and David Lo. 2024. Out of sight, out of mind: Better automatic vulnerability repair by broadening input ranges and sources. In Proceedings of the IEEE/ACM 46th International Conference on Software Engineering, pages 1–13. find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/yang-2026-securepair-semantics-aligned-curriculum-driven/