{"id":"https://openalex.org/W7225646473","doi":"https://doi.org/10.3390/jcp6060198","title":"A Controlled Experimental Methodology for Evaluating LLM-Based Vulnerability Repair Using Cascaded Program Analysis Context","display_name":"A Controlled Experimental Methodology for Evaluating LLM-Based Vulnerability Repair Using Cascaded Program Analysis Context","publication_year":2026,"publication_date":"2026-11-09","ids":{"openalex":"https://openalex.org/W7225646473","doi":"https://doi.org/10.3390/jcp6060198"},"language":"en","primary_location":{"id":"doi:10.3390/jcp6060198","doi":"https://doi.org/10.3390/jcp6060198","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp6060198","pdf_url":null,"source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","norway-1","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.3390/jcp6060198","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5072167024","display_name":"M. Rohini","orcid":"https://orcid.org/0000-0002-0354-7082","observed_orcids":["https://orcid.org/0000-0002-0354-7082"]},"institutions":[{"id":"https://openalex.org/I4210154636","display_name":"Technology Information, Forecasting and Assessment Council","ror":"https://ror.org/04d81ed36","country_code":"IN","type":"government","lineage":["https://openalex.org/I2799351866","https://openalex.org/I4210098748","https://openalex.org/I4210134808","https://openalex.org/I4210154636"]},{"id":"https://openalex.org/I81556334","display_name":"Amrita Vishwa Vidyapeetham","ror":"https://ror.org/03am10p12","country_code":"IN","type":"education","lineage":["https://openalex.org/I81556334"]}],"countries":["IN"],"is_corresponding":true,"raw_author_name":"Rohini Murugesan","raw_affiliation_strings":["TIFAC-CORE in Cyber Security, Amrita School of Engineering, Amrita Vishwa Vidyapeetham, Coimbatore 641112, India"],"raw_orcid":"https://orcid.org/0000-0002-0354-7082","affiliations":[{"raw_affiliation_string":"TIFAC-CORE in Cyber Security, Amrita School of Engineering, Amrita Vishwa Vidyapeetham, Coimbatore 641112, India","institution_ids":["https://openalex.org/I4210154636","https://openalex.org/I81556334"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5161334746","display_name":"Sanjai Kommina Chandrasekaran Kirubaa","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4210154636","display_name":"Technology Information, Forecasting and Assessment Council","ror":"https://ror.org/04d81ed36","country_code":"IN","type":"government","lineage":["https://openalex.org/I2799351866","https://openalex.org/I4210098748","https://openalex.org/I4210134808","https://openalex.org/I4210154636"]},{"id":"https://openalex.org/I81556334","display_name":"Amrita Vishwa Vidyapeetham","ror":"https://ror.org/03am10p12","country_code":"IN","type":"education","lineage":["https://openalex.org/I81556334"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Sanjai Kommina Chandrasekaran Kirubaa","raw_affiliation_strings":["TIFAC-CORE in Cyber Security, Amrita School of Engineering, Amrita Vishwa Vidyapeetham, Coimbatore 641112, India"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"TIFAC-CORE in Cyber Security, Amrita School of Engineering, Amrita Vishwa Vidyapeetham, Coimbatore 641112, India","institution_ids":["https://openalex.org/I4210154636","https://openalex.org/I81556334"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5161330106","display_name":"Ashwin Kathirvel","orcid":"https://orcid.org/0009-0008-5309-5249","observed_orcids":["https://orcid.org/0009-0008-5309-5249"]},"institutions":[{"id":"https://openalex.org/I4210154636","display_name":"Technology Information, Forecasting and Assessment Council","ror":"https://ror.org/04d81ed36","country_code":"IN","type":"government","lineage":["https://openalex.org/I2799351866","https://openalex.org/I4210098748","https://openalex.org/I4210134808","https://openalex.org/I4210154636"]},{"id":"https://openalex.org/I81556334","display_name":"Amrita Vishwa Vidyapeetham","ror":"https://ror.org/03am10p12","country_code":"IN","type":"education","lineage":["https://openalex.org/I81556334"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Ashwin Kathirvel","raw_affiliation_strings":["TIFAC-CORE in Cyber Security, Amrita School of Engineering, Amrita Vishwa Vidyapeetham, Coimbatore 641112, India"],"raw_orcid":"https://orcid.org/0009-0008-5309-5249","affiliations":[{"raw_affiliation_string":"TIFAC-CORE in Cyber Security, Amrita School of Engineering, Amrita Vishwa Vidyapeetham, Coimbatore 641112, India","institution_ids":["https://openalex.org/I4210154636","https://openalex.org/I81556334"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5130376159","display_name":"Rishab Nair","orcid":"https://orcid.org/0009-0000-5755-9794","observed_orcids":["https://orcid.org/0009-0000-5755-9794"]},"institutions":[{"id":"https://openalex.org/I4210154636","display_name":"Technology Information, Forecasting and Assessment Council","ror":"https://ror.org/04d81ed36","country_code":"IN","type":"government","lineage":["https://openalex.org/I2799351866","https://openalex.org/I4210098748","https://openalex.org/I4210134808","https://openalex.org/I4210154636"]},{"id":"https://openalex.org/I81556334","display_name":"Amrita Vishwa Vidyapeetham","ror":"https://ror.org/03am10p12","country_code":"IN","type":"education","lineage":["https://openalex.org/I81556334"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Rishab Nair","raw_affiliation_strings":["TIFAC-CORE in Cyber Security, Amrita School of Engineering, Amrita Vishwa Vidyapeetham, Coimbatore 641112, India"],"raw_orcid":"https://orcid.org/0009-0000-5755-9794","affiliations":[{"raw_affiliation_string":"TIFAC-CORE in Cyber Security, Amrita School of Engineering, Amrita Vishwa Vidyapeetham, Coimbatore 641112, India","institution_ids":["https://openalex.org/I4210154636","https://openalex.org/I81556334"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5049460909","display_name":"Anand R. Nair","orcid":"https://orcid.org/0000-0003-1598-616X","observed_orcids":["https://orcid.org/0000-0003-1598-616X"]},"institutions":[{"id":"https://openalex.org/I4210154636","display_name":"Technology Information, Forecasting and Assessment Council","ror":"https://ror.org/04d81ed36","country_code":"IN","type":"government","lineage":["https://openalex.org/I2799351866","https://openalex.org/I4210098748","https://openalex.org/I4210134808","https://openalex.org/I4210154636"]},{"id":"https://openalex.org/I81556334","display_name":"Amrita Vishwa Vidyapeetham","ror":"https://ror.org/03am10p12","country_code":"IN","type":"education","lineage":["https://openalex.org/I81556334"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Anand R. Nair","raw_affiliation_strings":["TIFAC-CORE in Cyber Security, Amrita School of Engineering, Amrita Vishwa Vidyapeetham, Coimbatore 641112, India"],"raw_orcid":"https://orcid.org/0000-0003-1598-616X","affiliations":[{"raw_affiliation_string":"TIFAC-CORE in Cyber Security, Amrita School of Engineering, Amrita Vishwa Vidyapeetham, Coimbatore 641112, India","institution_ids":["https://openalex.org/I4210154636","https://openalex.org/I81556334"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5023107679","display_name":"Sumit Gautam","orcid":"https://orcid.org/0000-0003-1153-5345","observed_orcids":["https://orcid.org/0000-0003-1153-5345"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sumit Kumar Gautam","raw_affiliation_strings":["LG Soft India, Bengaluru 560103, India"],"raw_orcid":"https://orcid.org/0000-0003-1153-5345","affiliations":[{"raw_affiliation_string":"LG Soft India, Bengaluru 560103, India","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5161350749","display_name":"Vibhanshu Dhote","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Vibhanshu Dhote","raw_affiliation_strings":["LG Soft India, Bengaluru 560103, India"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"LG Soft India, Bengaluru 560103, India","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5011090929","display_name":"Madathil Sethumadhavan","orcid":"https://orcid.org/0000-0001-5476-5461","observed_orcids":["https://orcid.org/0000-0001-5476-5461"]},"institutions":[{"id":"https://openalex.org/I4210154636","display_name":"Technology Information, Forecasting and Assessment Council","ror":"https://ror.org/04d81ed36","country_code":"IN","type":"government","lineage":["https://openalex.org/I2799351866","https://openalex.org/I4210098748","https://openalex.org/I4210134808","https://openalex.org/I4210154636"]},{"id":"https://openalex.org/I81556334","display_name":"Amrita Vishwa Vidyapeetham","ror":"https://ror.org/03am10p12","country_code":"IN","type":"education","lineage":["https://openalex.org/I81556334"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"M. Sethumadhavan","raw_affiliation_strings":["TIFAC-CORE in Cyber Security, Amrita School of Engineering, Amrita Vishwa Vidyapeetham, Coimbatore 641112, India"],"raw_orcid":"https://orcid.org/0000-0001-5476-5461","affiliations":[{"raw_affiliation_string":"TIFAC-CORE in Cyber Security, Amrita School of Engineering, Amrita Vishwa Vidyapeetham, Coimbatore 641112, India","institution_ids":["https://openalex.org/I4210154636","https://openalex.org/I81556334"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5072167024"],"corresponding_institution_ids":["https://openalex.org/I4210154636","https://openalex.org/I81556334"],"apc_list":{"value":1000,"currency":"CHF","value_usd":1207},"apc_paid":{"value":1000,"currency":"CHF","value_usd":1207},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"6","issue":"6","first_page":"198","last_page":"198"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.75,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.75,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.2079000025987625,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.022700000554323196,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/static-application-security-testing","display_name":"static application security testing","score":0.6740000247955322},{"id":"https://openalex.org/keywords/control-flow-graph","display_name":"control flow graph","score":0.640999972820282},{"id":"https://openalex.org/keywords/hybrid-static-dynamic-analysis","display_name":"hybrid static-dynamic analysis","score":0.5759999752044678},{"id":"https://openalex.org/keywords/c-c-vulnerabilities","display_name":"C/C++ vulnerabilities","score":0.6959999799728394},{"id":"https://openalex.org/keywords/dynamic-application-security-testing","display_name":"dynamic application security testing","score":0.5910000205039978},{"id":"https://openalex.org/keywords/program-slicing","display_name":"program slicing","score":0.35199999809265137}],"concepts":[{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.7049000263214111},{"id":"https://openalex.org/C91071405","wikidata":"https://www.wikidata.org/wiki/Q1413145","display_name":"Program slicing","level":3,"score":0.669700026512146},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6340000033378601},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.6182000041007996},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.5403000116348267},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.5040000081062317},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.5019000172615051},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.4296000003814697},{"id":"https://openalex.org/C151552104","wikidata":"https://www.wikidata.org/wiki/Q7705809","display_name":"Test suite","level":4,"score":0.415800005197525},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.4016999900341034},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3610000014305115},{"id":"https://openalex.org/C2779530757","wikidata":"https://www.wikidata.org/wiki/Q1207505","display_name":"Quality (philosophy)","level":2,"score":0.3562999963760376},{"id":"https://openalex.org/C200601418","wikidata":"https://www.wikidata.org/wiki/Q2193887","display_name":"Reliability engineering","level":1,"score":0.3513000011444092},{"id":"https://openalex.org/C2780586970","wikidata":"https://www.wikidata.org/wiki/Q1357284","display_name":"Popularity","level":2,"score":0.3447999954223633},{"id":"https://openalex.org/C160191386","wikidata":"https://www.wikidata.org/wiki/Q868299","display_name":"Control flow","level":2,"score":0.3262999951839447},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.3246999979019165},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3093999922275543},{"id":"https://openalex.org/C128942645","wikidata":"https://www.wikidata.org/wiki/Q1568346","display_name":"Test case","level":3,"score":0.3021000027656555},{"id":"https://openalex.org/C176217482","wikidata":"https://www.wikidata.org/wiki/Q860554","display_name":"Metric (unit)","level":2,"score":0.29820001125335693},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.28700000047683716},{"id":"https://openalex.org/C79581498","wikidata":"https://www.wikidata.org/wiki/Q1367530","display_name":"Suite","level":2,"score":0.2854999899864197},{"id":"https://openalex.org/C92446256","wikidata":"https://www.wikidata.org/wiki/Q3306762","display_name":"Data validation","level":2,"score":0.2824999988079071},{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.2802000045776367},{"id":"https://openalex.org/C53942775","wikidata":"https://www.wikidata.org/wiki/Q1211721","display_name":"Code coverage","level":3,"score":0.27900001406669617},{"id":"https://openalex.org/C2779639559","wikidata":"https://www.wikidata.org/wiki/Q7661178","display_name":"Symbolic execution","level":3,"score":0.2687999904155731},{"id":"https://openalex.org/C98183937","wikidata":"https://www.wikidata.org/wiki/Q2112188","display_name":"Program analysis","level":2,"score":0.2653999924659729},{"id":"https://openalex.org/C118530786","wikidata":"https://www.wikidata.org/wiki/Q1134732","display_name":"Instrumentation (computer programming)","level":2,"score":0.26339998841285706},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.26179999113082886},{"id":"https://openalex.org/C2776190703","wikidata":"https://www.wikidata.org/wiki/Q488148","display_name":"Slicing","level":2,"score":0.2547999918460846}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.3390/jcp6060198","doi":"https://doi.org/10.3390/jcp6060198","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp6060198","pdf_url":null,"source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","norway-1","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.3390/jcp6060198","doi":"https://doi.org/10.3390/jcp6060198","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp6060198","pdf_url":null,"source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","norway-1","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7223941817","https://openalex.org/W4400484609","https://openalex.org/W7144144694","https://openalex.org/W7214122302","https://openalex.org/W4417413585","https://openalex.org/W7221500842","https://openalex.org/W4417169356","https://openalex.org/W7213306442","https://openalex.org/W7155596103","https://openalex.org/W7165977192"],"abstract_inverted_index":{"Large":[0],"language":[1],"models":[2],"(LLMs)":[3],"have":[4],"gained":[5],"popularity":[6],"in":[7,18,567],"automatic":[8],"code":[9,59,70,89,194,198,204,426],"vulnerability":[10,155,356,596,622],"fixing":[11],"tasks.":[12],"However,":[13,99],"the":[14,24,29,96,104,146,169,232,242,253,266,272,308,315,320,359,365,369,377,381,387,404,417,424,444,453,470,475,479,485,514,522,528,536,556,589,592],"effectiveness":[15],"of":[16,28,55,107,123,148,214,226,358,407,474,491,493,497,591],"LLMs":[17,84],"this":[19,539,606],"setting":[20,607],"relies":[21],"heavily":[22],"on":[23,95,153,384,403],"quality":[25,127],"and":[26,119,179,210,217,265,301,314,335,345,398,433,447,577,598,608],"structure":[27],"input":[30],"context.":[31,185],"Prior":[32],"work":[33],"has":[34,79],"shown":[35,81],"that":[36,110,241,372,410,469,483,513],"LLM":[37,131,268],"repair":[38,126,170,289,347,420,458,574],"accuracy":[39],"improves":[40],"when":[41,58,173],"guided":[42],"with":[43,47,72,90,199,205,307,423,436,572,579],"static":[44,62,174],"analysis":[45,63,181],"output,":[46],"one":[48],"system":[49],"reporting":[50],"fixes":[51],"for":[52,128,443,518,559],"over":[53,380],"80%":[54],"reported":[56],"vulnerabilities":[57,544],"slicing":[60],"from":[61,87,223,231,354,391],"is":[64,269],"used.":[65],"More":[66],"recently,":[67],"pairing":[68],"CPG-derived":[69,206,218,425],"slices":[71],"Static":[73],"Application":[74,341],"Security":[75,342],"Testing":[76,343],"(SAST)":[77],"findings":[78,216,334,344,581,584],"been":[80],"to":[82,144,245,252,274,349,393,413,452,461,541,612,619],"help":[83],"distinguish":[85],"vulnerable":[86,228],"non-vulnerable":[88],"F1":[91],"scores":[92],"above":[93],"99%":[94],"Juliet":[97,233],"benchmark.":[98],"it":[100],"remains":[101],"unclear":[102],"whether":[103],"same":[105,267,405,537],"kind":[106],"richer":[108,150],"context":[109,124,152,164,188,284,374,451,562],"benefits":[111],"detection":[112],"also":[113],"translates":[114],"into":[115],"better":[116],"fix":[117,246],"generation":[118],"how":[120],"different":[121],"combinations":[122],"affect":[125],"a":[129,133,140,158,212,224,261,276,327,511,533,553],"fixed":[130],"under":[132],"defined":[134],"experimental":[135,142,367,599],"setting.":[136],"This":[137],"paper":[138],"presents":[139],"controlled":[141],"methodology":[143,281],"examine":[145],"effect":[147],"progressively":[149],"program\u2013analysis":[151],"LLM-based":[154],"repair.":[156],"Using":[157],"cascaded":[159],"evaluation":[160,263],"strategy":[161],"across":[162,319],"four":[163,187],"levels":[165,189],"(L0\u2013L3),":[166],"we":[167],"evaluate":[168],"outcomes":[171],"obtained":[172],"analysis,":[175],"graph-derived":[176],"data-flow":[177],"information,":[178],"hybrid":[180],"are":[182,250,258,400,609],"provided":[183],"as":[184,260],"The":[186,255,280,583],"are:":[190],"(L0)":[191],"raw":[192],"source":[193,197,203],"only,":[195],"(L1)":[196,375],"SAST":[200,215,333,373,437,462],"findings,":[201],"(L2)":[202],"data":[207,219],"flow":[208,220],"paths,":[209],"(L3)":[211],"combination":[213],"paths.":[221],"Starting":[222],"pool":[225,406],"100":[227,256],"C/C++":[229],"programs":[230],"test":[234],"suite":[235],"covering":[236],"nine":[237],"CWE":[238],"categories,":[239],"cases":[240,257,409,571],"model":[243,278,446],"fails":[244],"at":[247,311],"each":[248,283,312,519],"level":[249,285,313],"escalated":[251],"next.":[254],"used":[259,270],"bounded":[262],"sample,":[264],"throughout":[271],"experiment":[273,325],"maintain":[275],"consistent":[277],"configuration.":[279,600],"evaluates":[282],"using":[286],"mutually":[287],"exclusive":[288],"outcome":[290],"metrics:":[291],"Correct":[292],"Fix":[293,303,317,389],"Rate":[294,299,304,310,318,390],"(CFR),":[295],"Plausible":[296],"but":[297],"Incorrect":[298],"(PIR),":[300],"Invalid":[302],"(IFR),":[305],"along":[306],"Recovery":[309],"Cumulative":[316,388],"cascade.":[321],"A":[322,548],"separate":[323],"validation":[324,467],"applies":[326],"three-level":[328],"cascade":[329,471,486],"(L0;":[330],"L1":[331,415],"adding":[332,339,449],"application":[336],"context;":[337],"L2":[338],"Dynamic":[340],"vulnerability-specific":[346,573],"guidance)":[348],"53":[350,476,494],"PHP":[351],"files":[352,477],"drawn":[353],"18":[355,542],"modules":[357],"Damn":[360],"Vulnerable":[361],"Web":[362],"Application.":[363],"Within":[364],"evaluated":[366,401,445,593],"setting,":[368],"results":[370],"show":[371],"gives":[376],"largest":[378],"improvement":[379],"no-context":[382],"baseline":[383],"Juliet,":[385],"raising":[386],"54%":[392],"90%.":[394],"When":[395],"L1,":[396],"L2,":[397],"L3":[399],"directly":[402,618],"46":[408],"L0":[411],"failed":[412],"fix,":[414],"achieves":[416],"highest":[418],"observed":[419],"performance,":[421],"compared":[422],"slice":[427],"approach":[428],"alone":[429,576],"(L2,":[430],"83%":[431],"cumulative)":[432],"CPG":[434,450],"combined":[435],"(L3,":[438],"86%":[439],"cumulative),":[440],"indicating":[441],"that,":[442],"cases,":[448,597],"prompt":[454],"did":[455,500],"not":[456,501,610],"improve":[457],"performance":[459],"relative":[460],"alone.":[463,582],"On":[464],"DVWA,":[465],"independent":[466],"establishes":[468],"repairs":[472],"39":[473],"(73.6%);":[478],"scanner-based":[480],"automated":[481],"classification":[482],"drove":[484],"returned":[487],"an":[488],"upper":[489],"bound":[490],"52":[492],"(98.1%),":[495],"thirteen":[496],"whose":[498],"labels":[499],"survive":[502],"manual":[503],"review,":[504],"exploit":[505],"replay,":[506],"behavioral":[507],"smoke":[508],"testing,":[509],"or":[510,616,624],"check":[512],"target":[515,535],"weakness":[516,523],"recorded":[517],"file":[520],"matched":[521],"its":[524],"module":[525,534,558],"exhibits.":[526],"Because":[527],"three":[529],"security-level":[530],"variants":[531],"within":[532,552,588,605],"weakness,":[538],"corresponds":[540],"distinct":[543],"rather":[545],"than":[546],"53.":[547],"preliminary":[549],"three-case":[550],"comparison":[551],"single":[554],"module,":[555],"only":[557],"which":[560],"both":[561],"types":[563],"could":[564],"be":[565,586],"supplied":[566],"isolation,":[568],"repaired":[569],"two":[570],"guidance":[575],"none":[578],"runtime":[580],"should":[585],"interpreted":[587],"scope":[590],"LLM,":[594],"selected":[595],"They":[601],"provide":[602],"empirical":[603],"observations":[604],"intended":[611],"establish":[613],"model-independent":[614],"conclusions":[615],"generalize":[617],"all":[620],"LLMs,":[621],"datasets,":[623],"real-world":[625],"software":[626],"projects.":[627]},"counts_by_year":[],"updated_date":"2026-11-11T12:16:26.678958","created_date":"2026-11-10T00:00:00"}