arXiv AI

Deleting Code Without Losing Knowledge: Regenerative Software for Python Libraries

arXiv AI
Sep 7

The History Is the Detector: Executing CVE Patch History, End-to-End

The paper introduces BUGSTONE‑E2E, a framework that converts vulnerability history into executable detection rules and validates them. It mines reusable rules from fixing commits, organizes them by CWE and language, and applies a funnel‑shaped pipeline that starts with lightweight analysis and culminates in LLM‑guided inspection, runtime verification, and patch generation. Using 19,325 high‑severity CVEs, the system identified 2,710 fixing commits, created 1,033 detection rules across 56 CWE families, and produced runtime evidence for 644 findings in 14 programs.

By Qiushi Wu, Kevin Eykholt, Youngja Park, Xiaokui Shu, Dhilung Kirat, Douglas Lee Schales, Ian Molloy
arXiv AI
Sep 7

When LLM Decompilers Recompile More and Preserve Less

The paper examines how large‑language‑model (LLM) decompilers, which produce clean, idiomatic C code, are currently evaluated mainly on recompilability and passing shipped tests. It shows that these metrics can mask significant behavioral differences: a decompiled function may recompile and pass all tests yet diverge on other inputs or lose disclosed vulnerabilities. To address this, the authors propose Decompile‑Diverge, a behavioral oracle that synthesizes drivers, fuzzes inputs, and compares the decompiled code’s behavior to the original, revealing divergences in up to 13% of cases and exposing gaps in current evaluation suites.

By Chang Liu, Edward Raff, Kristopher Micinski
arXiv AI
Sep 24

Escaping Python Dependency Hell: A Hybrid Replay-and-Repair Pipeline for Python Dependency Resolution

The paper introduces PLLM+, a hybrid pipeline for resolving Python dependency conflicts that combines deterministic steps—such as static AST inference, replaying known successful configurations from a solutions database, and live PyPI validation—with an LLM-based repair fallback. Evaluated on the HG2.9K benchmark of 2,891 failing snippets, PLLM+ successfully fixes 1,500 cases, outperforming the baseline PLLM and reducing average runtime from 368.7 to 71.8 seconds per snippet. The majority of fixes (1,495) come from replaying existing configurations, while the LLM fallback contributes only five additional solutions.

By Veronica Poweska, Ariana Oyanguren, Jessica Pourleyli, Sourena Khanzadeh, Manar Alalfi
arXiv AI
Oct 1

Trustworthy Runtime Error Healing in Real-World Repositories: A Benchmark and Guardrail

The paper introduces HealBench, a benchmark of 265 runtime errors from 18 real-world repositories, and HealGuard, a safety framework that restricts healing code to an analyzable subset of Python and applies static and dynamic taint analysis. Using these tools, the authors evaluate a dedicated healing method and three general coding agents powered by different LLM backbones, achieving a 38.11% resume rate and a 28.68% test‑pass rate, while HealGuard flags 17.4% of successful healings as potentially unsafe. The study demonstrates that current LLM agents can meaningfully repair real repository crashes, but also highlights significant safety concerns that the Guardrail framework can detect, albeit with a high false‑positive rate.

By Gou Tan, Pengfei Chen, Zhensu Sun, Jieke Shi, Junkai Chen, Ting Zhang, Weifeng Sun, Junda He, Shuai Liang, Chuanfu Zhang, Lwin Khin Shar, David Lo
arXiv AI
Sep 30

From Dead Code and Static Requirements to Working Engines: Software Revival with Coding Agents

The paper introduces ReviveBench, a benchmark designed to evaluate coding agents’ ability to revive non‑running software and reconstruct industrial engines from open specifications. It comprises two families of tasks—revival (ten tasks addressing dependency issues, missing modules, legacy builds, and GPU models) and reconstruction (thirteen tasks covering numerical, geometric, hardware, and transactional systems). The benchmark uses hidden verifiers calibrated against native environments, engineering tools, or reference implementations, and the authors report that the strongest evaluated model passes all revival tasks and most reconstruction tasks, while also uncovering verifier defects that highlight measurement error in executable verification.

By Tianyu Liu, Dingyuan Dai, Yufan Du, Zhen Yang
arXiv AI
Oct 9

MemTrace: State-Consistent Memory for Long-Horizon Coding Agents

MemTrace is a provenance‑aware memory system designed to help coding agents handle long‑horizon software evolution tasks that span multiple files and stages. It stores execution history as immutable Memory Traces linked to key artifacts (files, symbols, tests) and organizes them in a Memory Trace Graph to track execution order and dependencies. When context budgets are limited, the system keeps only compact Memory Anchors, from which the agent can reconstruct the latest execution state and retrieve only valid, relevant evidence, improving performance on three long‑horizon coding benchmarks. "whyItMatters":"By preserving consistent task state and verifying evidence validity, MemTrace enables coding agents to outperform existing baselines on long‑horizon benchmarks, achieving significant gains in pass@1, resolved rate, and milestone scores."

By Hongming Xu, Le Zhou, ZhongHe Jin, Xiang Zhang, Bo Tang, Zhiyu Li, Xuanhe Zhou, Juncheng Zhang