Sign InOpen Brain
arXivPaperNeeds Review

Metrics Failure in LLM-Based Code Vulnerability Repair: An Empirical Study and a Change-Aware Screen

Compile rate can reward broken security patches and mostly reflect harness artifacts. Vulnerability-repair agents need change-aware screening followed by execution-grounded evaluation.

arXiv · Sep 22, 2026
Open Source Open MarkdownOpen JSON
Source Summary

Across **203 vulnerable functions**, about **64% of compile failures** were not attributed to the model. A compiler-standard flag changed compile rates by 1.8–2.7× on identical patches, and compiler feedback increased compiling outputs while introducing non-repairs.

Practical Implication

Do not use compilation as the main reward or acceptance gate for vulnerability-fixing agents. Screen whether a patch made a relevant edit, then require execution-grounded security checks; diff_F1 can cheaply reject no-ops before deeper evaluation.

Agent-Ready Context
Across **203 vulnerable functions**, about **64% of compile failures** were not attributed to the model. A compiler-standard flag changed compile rates by 1.8–2.7× on identical patches, and compiler feedback increased compiling outputs while introducing non-repairs.

Do not use compilation as the main reward or acceptance gate for vulnerability-fixing agents. Screen whether a patch made a relevant edit, then require execution-grounded security checks; diff_F1 can cheaply reject no-ops before deeper evaluation.

Whole-function CodeBLEU also failed because an unchanged vulnerable function beat every model. **diff_F1 gives zero credit to a no-op**, but misses some deletion-based gaming and is explicitly not a repair-quality metric.
Connected Context · Feed7 Judgment

This identifies compilation and whole-function similarity as actively misleading rewards for vulnerability repair, not merely incomplete metrics. It separates harness-caused failures from model failures and proposes diff_F1 only as a cheap no-op screen before execution-grounded security evaluation, explicitly limiting it from being treated as a quality score.

When LLM Decompilers Recompile More and Preserve LessThe decompiler findings independently show that compilability can rise while semantic and security-relevant behavior worsens, reinforcing the need for execution-based acceptance.SWE-Gate: Passing Functional Tests Is Not Enough for Software Engineering AgentsSWE-Gate shows that functional tests miss review-derived constraints; this study makes the analogous security case that compilation must be separated from actual repair correctness.Teaching AI to Find Real Vulnerabilities — David Brumley, BugcrowdIts call for deterministic exploit oracles supplies the kind of execution-grounded security evidence needed after diff_F1 rejects obvious no-ops.Vulnerability Localization Benchmark: Measuring Agentic Security Analysis at Repository ScaleVLoc Bench evaluates finding the vulnerable location, while this work evaluates whether the subsequent edit is relevant and securely effective, forming distinct gates in a repair pipeline.
Context Map
benchmarkcodingsecurity#agent-evals#benchmark-integrity#agent-reliability
Uncertainty
Whole-function CodeBLEU also failed because an unchanged vulnerable function beat every model. **diff_F1 gives zero credit to a no-op**, but misses some deletion-based gaming and is explicitly not a repair-quality metric.