Elamur Research⌕
☰
home / papers / 2026 / SynthFix: Adaptive Neuro-Symbolic Code Vulnerability Repair

SynthFix: Adaptive Neuro-Symbolic Code Vulnerability Repair

Paper · 2026 · Yifan Zhang, Jieyu Li, Kexin Pei et al.

Summary

LLM-based code repair often produces patches that look plausible but break program semantics or leave the security flaw in place. SynthFix addresses this for vulnerability repair by combining two fine-tuning regimes. Supervised Fine-Tuning (SFT) on bug-fix pairs is cheap but mostly learns surface patterns. Reward Fine-Tuning (RFT, e.g. PPO) can learn from task feedback but is slow and needs many samples. SynthFix adds a lightweight neural Router Model that inspects compiler-derived batch features (AST complexity, CFG depth, code length) and sends each training batch to either SFT or RFT. In the RFT branch, generated patches receive a dense symbolic reward that combines three checks: AST-based well-formedness, CFG-based preservation of program logic, and Semgrep security analysis. On FixJS (JavaScript) and CodeFlaws (C), across four code models, SynthFix outperforms SFT-only and RFT-only baselines. It achieves relative gains of up to 18% on CodeBLEU/CrystalBLEU and 32% on Exact Match, and it trains more efficiently. The work shows that choosing a training strategy per batch, grounded in compiler feedback, can make neural repair more reliable at manageable cost.

Key points

  • Benchmarks: FixJS (JavaScript) and CodeFlaws (C).
  • Models: CodeGen-220M, CodeT5-350M, CodeLLaMA-7B and StarCoder2-7B, each compared against SFT-only and RFT-only baselines.
  • Reward design: the reward is a weighted sum of r_AST, r_CFG and r_Semgrep. A router outputs a binary decision (0 = SFT, 1 = RFT) for each batch.
  • Results: gains reach up to 18% relative on CodeBLEU/CrystalBLEU and 32% on Exact Match. Ablations credit the adaptive routing, which is compared against a fixed-ratio hybrid, as the main source of improvement.
  • Availability and limitations: code and data are released on GitHub under the MIT License. The router relies only on static features, and the evaluation uses academic benchmarks rather than industrial codebases.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓University of ChicagoChicago · United States52 works · 50,893 citations🎓Vanderbilt UniversityNashville · United States15 works · 1,413 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksInformation Systems · 1,730 worksSoftware · 119 works

Cite

Cite as Yifan Zhang, Jieyu Li, Kexin Pei, Yu Huang and Kevin Leach. 2026. SynthFix: Adaptive Neuro-Symbolic Code Vulnerability Repair. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.findings-acl.1339

@inproceedings{zhang2026synthfix,
  title = {{SynthFix: Adaptive Neuro-Symbolic Code Vulnerability Repair}},
  author = {Yifan Zhang, Jieyu Li, Kexin Pei, Yu Huang and Kevin Leach},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.1339},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.1339}
}

References

54 references, 9 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Miltiadis Allamanis, Earl T Barr, Premkumar Devanbu, and Charles Sutton. 2018. A survey of machine learning for big code and naturalness. ACM Computing Surveys (CSUR), 51(4):1–37.
  2. Miltiadis Allamanis, Henry Jackson-Flux, and Marc Brockschmidt. 2021. Self-supervised bug detection and repair. Advances in Neural Information Processing Systems, 34:27865–27876. find
  3. Aakash Bansal, Chia-Yi Su, Zachary Karas, Yifan Zhang, Yu Huang, Toby Jia-Jun Li, and Collin McMillan. 2023. Modeling programmer attention as scanpath prediction. In 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE), pages 1732–1736. IEEE. find
  4. Berkay Berabi, Jingxuan He, Veselin Raychev, and Martin Vechev. 2021. Tfix: Learning to fix coding errors with a text-to-text transformer. In International Conference on Machine Learning, pages 780–791. PMLR. find
  5. Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde De Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, and 1 others. 2021. Evaluating large language models trained on code. arXiv preprint arXiv:2107.03374.
  6. Steve Christey, J Kenderdine, J Mazella, and B Miles. 2013. Common weakness enumeration. Mitre Corporation. find
  7. Viktor Csuvik and László Vidács. 2022. Fixjs: A dataset of bug-fixing javascript commits. In Proceedings of the 19th International Conference on Mining Software Repositories, pages 712–716. find
  8. David de Fitero-Dominguez, Eva Garcia-Lopez, Antonio Garcia-Cabot, and Jose-Javier Martinez-Herraiz. 2024. Enhanced automated code vulnerability repair using large language models. Engineering Applications of Artificial Intelligence, 138:109291. find
  9. Guanting Dong, Hongyi Yuan, Keming Lu, Chengpeng Li, Mingfeng Xue, Dayiheng Liu, Wei Wang, Zheng Yuan, Chang Zhou, and Jingren Zhou. 2023. How abilities in large language models are affected by supervised fine-tuning data composition. arXiv preprint arXiv:2310.05492.
  10. Aryaz Eghbali and Michael Pradel. 2022. Crystalbleu: precisely and efficiently measuring the similarity of code. In Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering, pages 1–12. find
  11. Zihan Fang, Yifan Zhang, Yueke Zhang, Kevin Leach, and Yu Huang. 2025. Dpo-f+: Aligning code repair feedback with developers’ preferences. arXiv preprint arXiv:2511.01043. — [arXiv:2511.01043](https://arxiv.org/abs/2511.01043) find
  12. Zhangyin Feng, Daya Guo, Duyu Tang, Nan Duan, Xiaocheng Feng, Ming Gong, Linjun Shou, Bing Qin, Ting Liu, Daxin Jiang, and 1 others. 2020. Codebert: A pre-trained model for programming and natural languages. arXiv preprint arXiv:2002.08155.
  13. Michael Fu, Chakkrit Tantithamthavorn, Trung Le, Van Nguyen, and Dinh Phung. 2022. Vulrepair: a t5-based automated software vulnerability repair. In Proceedings of the 30th ACM joint european software engineering conference and symposium on the foundations of software engineering, pages 935–947. find
  14. Leo Gao, John Schulman, and Jacob Hilton. 2023. Scaling laws for reward model overoptimization. In International Conference on Machine Learning, pages 10835–10866. PMLR.
  15. Rahul Gupta, Aditya Kanade, and Shirish Shevade. 2019. Neural attribution for semantic bug-localization in student programs. Advances in Neural Information Processing Systems, 32. find
  16. Andrew Habib and Michael Pradel. 2019. Neural bug finding: A study of opportunities and challenges. arXiv preprint arXiv:1906.00307. — [arXiv:1906.00307](https://arxiv.org/abs/1906.00307) find
  17. Shirley Anugrah Hayati, Raphael Olivier, Pravalika Avvaru, Pengcheng Yin, Anthony Tomasic, and Graham Neubig. 2018. Retrieval-based neural code generation. arXiv preprint arXiv:1808.10025. find
  18. Kai Huang, Xiangxin Meng, Jian Zhang, Yang Liu, Wenjie Wang, Shuhao Li, and Yuqing Zhang. 2023. An empirical study on fine-tuning large language models of code for automated program repair. In 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE), pages 1162– 1174. IEEE… find
  19. Jiliang Li, Yifan Zhang, Zachary Karas, Collin McMillan, Kevin Leach, and Yu Huang. 2024. Do machines and humans focus on similar code? exploring explainability of large language models in code summarization. In Proceedings of the 32nd IEEE/ACM International Conference on Program Comprehension, page… find
  20. Yi Li, Shaohua Wang, Tien N Nguyen, and Son Van Nguyen. 2019. Improving bug detection via context-based code representation learning and attention-based neural networks. Proceedings of the ACM on Programming Languages, 3(OOPSLA):1– 30. find
  21. Hongliang Liang, Yuxing Yang, Lu Sun, and Lin Jiang. 2019. Jsac: A novel framework to detect malicious javascript via cnns over ast and cfg. In 2019 International Joint Conference on Neural Networks (IJCNN), pages 1–8. IEEE. find
  22. Nafis Tanveer Islam and Peyman Najafirad. 2024. Code security vulnerability repair using reinforcement learning with large language models. arXiv preprint arXiv:2401.07031. — [arXiv:2401.07031](https://arxiv.org/abs/2401.07031) find
  23. Anton Lozhkov, Raymond Li, Loubna Ben Allal, Federico Cassano, Joel Lamy-Poirier, Nouamane Tazi, Ao Tang, Dmytro Pykhtar, Jiawei Liu, Yuxiang Wei, and 1 others. 2024. Starcoder 2 and the stack v2: The next generation. arXiv preprint arXiv:2402.19173. find
  24. Jiajun Jiang, Yingfei Xiong, Hongyu Zhang, Qing Gao, and Xiangqun Chen. 2018. Shaping program repair space with existing patches and similar code. In Proceedings of the 27th ACM SIGSOFT international symposium on software testing and analysis, pages 298–309. find
  25. Avijit Mandal, Devina Mohan, Raoul Jetley, Sreeja Nair, and Meenakshi D’Souza. 2018. A generic static analysis framework for domain-specific languages. In 2018 IEEE 23rd International Conference on Emerging Technologies and Factory Automation (ETFA), volume 1, pages 27–34. IEEE. find
  26. Nan Jiang, Kevin Liu, Thibaud Lutellier, and Lin Tan. 2023. Impact of code language models on automated program repair. In 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE), pages 1430–1442. IEEE. find
  27. Erik Nijkamp, Bo Pang, Hiroaki Hayashi, Lifu Tu, Huan Wang, Yingbo Zhou, Silvio Savarese, and Caiming Xiong. 2022. Codegen: An open large language model for code with multi-turn program synthesis. arXiv preprint arXiv:2203.13474. find
  28. William Klieber, Ruben Martins, Ryan Steele, Matt Churilla, Mike McCall, and David Svoboda. 2021. Automated code repair to ensure spatial memory safety. In 2021 IEEE/ACM International Workshop on Automated Program Repair (APR), pages 23–30. IEEE. find
  29. Bonan Kou, Shengmai Chen, Zhijie Wang, Lei Ma, and Tianyi Zhang. 2024. Do large language models pay similar attention like human programmers when generating code? Proceedings of the ACM on Software Engineering, 1(FSE):2261–2284. find
  30. Ummay Kulsum, Haotian Zhu, Bowen Xu, and Marcelo d’Amorim. 2024. A case study of llm for automated vulnerability repair: Assessing impact of reasoning and patch validation feedback. In Proceedings of the 1st ACM International Conference on AI-Powered Software, pages 103–111. find
  31. Hung Le, Yue Wang, Akhilesh Deepak Gotmare, Silvio Savarese, and Steven Chu Hong Hoi. 2022. Coderl: Mastering code generation through pretrained models and deep reinforcement learning. Advances in Neural Information Processing Systems, 35:21314–21328.
  32. Shankara Pailoor, Yuepeng Wang, and Işıl Dillig. 2024. Semantic code refactoring for abstract data types. Proceedings of the ACM on Programming Languages, 8(POPL):816–847. find
  33. Emilio Parisotto, Abdel-rahman Mohamed, Rishabh Singh, Lihong Li, Dengyong Zhou, and Pushmeet Kohli. 2016. Neuro-symbolic program synthesis. arXiv preprint arXiv:1611.01855.
  34. Shuo Ren, Daya Guo, Shuai Lu, Long Zhou, Shujie Liu, Duyu Tang, Neel Sundaresan, Ming Zhou, Ambrosio Blanco, and Shuai Ma. 2020. Codebleu: a method for automatic evaluation of code synthesis. arXiv preprint arXiv:2009.10297. find
  35. Cedric Richter, Jan Haltermann, Marie-Christine Jakobs, Felix Pauck, Stefan Schott, and Heike Wehrheim. 2022. Are neural bug detectors comparable to software developers on variable misuse bugs? In Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering, pages 1–12… find
  36. Baptiste Roziere, Jonas Gehring, Fabian Gloeckle, Sten Sootla, Itai Gat, Xiaoqing Ellen Tan, Yossi Adi, Jingyu Liu, Romain Sauvestre, Tal Remez, and 1 others. 2023. Code llama: Open foundation models for code. arXiv preprint arXiv:2308.12950.
  37. John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. 2017. Proximal policy optimization algorithms. arXiv preprint arXiv:1707.06347. find
  38. Zhidong Shen and Si Chen. 2020. A survey of automatic software vulnerability detection, program repair, and defect prediction techniques. Security and Communication Networks, 2020(1):8858010. find
  39. Ensheng Shi, Yanlin Wang, Hongyu Zhang, Lun Du, Shi Han, Dongmei Zhang, and Hongbin Sun. 2023. Towards efficient fine-tuning of pre-trained code models: An experimental study and beyond. In Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis, pages 39–51. find
  40. Ke Shi, Yang Lu, Jingfei Chang, and Zhen Wei. 2020. Pathpair2vec: An ast path pair-based code representation method for defect prediction. Journal of Computer Languages, 59:100979. find
  41. Parshin Shojaee, Aneesh Jain, Sindhu Tipirneni, and Chandan K Reddy. 2023. Execution-based code generation using deep reinforcement learning. arXiv preprint arXiv:2301.13816. find
  42. Shin Hwei Tan, Jooyong Yi, Sergey Mechtaev, Abhik Roychoudhury, and 1 others. 2017. Codeflaws: a programming competition benchmark for evaluating automated program repair tools. In 2017 IEEE/ACM 39th International Conference on Software Engineering Companion (ICSE-C), pages 180–182. IEEE. find
  43. Xin Wang, Yasheng Wang, Fei Mi, Pingyi Zhou, Yao Wan, Xiao Liu, Li Li, Hao Wu, Jin Liu, and Xin Jiang. 2021a. Syncobert: Syntax-guided multi-modal contrastive pre-training for code representation. arXiv preprint arXiv:2108.04556. find
  44. Yue Wang, Weishi Wang, Shafiq Joty, and Steven CH Hoi. 2021b. Codet5: Identifier-aware unified pre-trained encoder-decoder models for code understanding and generation. arXiv preprint arXiv:2109.00859. find
  45. Bingting Wu, Bin Liang, and Xiaofang Zhang. 2022. Turn tree into graph: Automatic code review via simplified ast driven graph convolutional network. Knowledge-Based Systems, 252:109450. find
  46. Kai Yang, Jian Tao, Jiafei Lyu, Chunjiang Ge, Jiaxin Chen, Weihan Shen, Xiaolong Zhu, and Xiu Li. 2024. Using human feedback to fine-tune diffusion models without any reward model. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8941–8951. find
  47. Pengcheng Yin and Graham Neubig. 2017. A syntactic neural model for general-purpose code generation. arXiv preprint arXiv:1704.01696.
  48. Yifan Zhang. 2022. Leveraging artificial intelligence on binary code comprehension. In Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering, pages 1–3. find
  49. Yifan Zhang, Chen Huang, Kevin Cao, Yueke Zhang, Scott Thomas Andersen, Huajie Shao, Kevin Leach, and Yu Huang. 2022a. Pre-training representations of binary code using contrastive learning. arXiv preprint arXiv:2210.05102. — [arXiv:2210.05102](https://arxiv.org/abs/2210.05102) find
  50. Yifan Zhang, Chen Huang, Zachary Karas, Thuy Dung Nguyen, Kevin Leach, and Yu Huang. 2025a. Enhancing code llm training with programmer attention. In Proceedings of the 33rd ACM International Conference on the Foundations of Software Engineering, pages 616–620. find
  51. Yifan Zhang and Kevin Leach. 2025. Leveraging human insights for enhanced llm-based code repair. In Proceedings of the 33rd ACM International Conference on the Foundations of Software Engineering, pages 1536–1537. find
  52. Yifan Zhang, Junwen Yang, Haoyu Dong, Qingchen Wang, Huajie Shao, Kevin Leach, and Yu Huang. 2022b. Astro: An ast-assisted approach for generalizable neural clone detection. arXiv preprint arXiv:2208.08067. — [arXiv:2208.08067](https://arxiv.org/abs/2208.08067) find
  53. Yueke Zhang, Yifan Zhang, Kevin Leach, and Yu Huang. 2025b. Codegrad: Integrating multi-step verification with gradient-based llm refinement. arXiv preprint arXiv:2508.10059. — [arXiv:2508.10059](https://arxiv.org/abs/2508.10059) find
  54. Noah Ziems and Shaoen Wu. 2021. Security vulnerability detection using deep learning natural language processing. In IEEE INFOCOM 2021-IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS), pages 1–6. IEEE. find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/zhang-2026-synthfix-adaptive-neuro-symbolic-code/