Examining Zero-Shot Vulnerability Repair with Large Language Models

P. Gage, “A New Algorithm for Data Compression,” C Users Journal , vol. 12, no. 2, pp. 23–38, Feb. 1994, place: USA Publisher: R & D Publications, Inc

1994

Earlier work this paper cites.

A. Zeller and R. Hildebrandt, “Simplifying and Isolating Failure-Inducing Input,” IEEE Trans. Softw. Eng. , vol. 28, no. 2, pp. 183–200, Feb. 2002, publisher: IEEE Press. [Online]. Available: https://doi.org/10.1109/32.988498

2002

Earlier work this paper cites.

J.-D. Choi and A. Zeller, “Isolating Failure-Inducing Thread Schedules,” in Proceedings of the 2002 ACM SIGSOFT International Symposium on Software Testing and Analysis , ser. ISSTA ’02. New York, NY, USA: Association for Computing Machinery, 2002, pp. 210–220, event-place: Roma, Italy. [Online]. Available: https://doi.org/10.1145/566172.566211

2002

Earlier work this paper cites.

T. B. Brown, B. Mann, N. Ryder, M. Subbiah, J. Kaplan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sastry, A. Askell, S. Agarwal, A. Herbert-Voss, G. Krueger, T. Henighan, R. Child, A. Ramesh, D. M. Ziegler, J. Wu, C. Winter, C. Hesse, M. Chen, E. Sigler, M. Litwin, S. Gray, B. Chess, J. Clark, C. Berner, S. McCandlish, A. Radford, I. Sutskever, and D. Amodei, “Language Models are Few-Shot Learners,” arXiv:2005.14165 [cs] , Jul. 2020, arXiv: 2005.14165. [Online]. Available: http://arxiv.org/abs/2005.14165

Original

2005

Earlier work this paper cites.

C. Yagemann, M. Pruett, S. P. Chung, K. Bittick, B. Saltaformaggio, and W. Lee, “ARCUS: Symbolic Root Cause Analysis of Exploits in Production Systems,” in 30th USENIX Security Symposium (USENIX Security 21) . USENIX Association, Aug. 2021, pp. 1989–2006. [Online]. Available: https://www.usenix.org/conference/usenixsecurity21/presentation/yagemann

2006

Earlier work this paper cites.

R. Mihalcea, H. Liu, and H. Lieberman, “NLP (Natural Language Processing) for NLP (Natural Language Programming),” in Computational Linguistics and Intelligent Text Processing , A. Gelbukh, Ed. Springer Berlin Heidelberg, 2006, pp. 319–330

2006

Earlier work this paper cites.

L. Tan, D. Yuan, G. Krishna, and Y. Zhou, “/*icomment: bugs or bad comments?*/,” ACM SIGOPS Operating Systems Review , vol. 41, no. 6, pp. 145–158, Oct. 2007. [Online]. Available: https://dl.acm.org/doi/10.1145/1323293.1294276

2007

Earlier work this paper cites.

D. Jeffrey, M. Feng, N. Gupta, and R. Gupta, “BugFix: A learning-based tool to assist developers in fixing bugs,” in 2009 IEEE 17th International Conference on Program Comprehension . Vancouver, BC, Canada: IEEE, May 2009, pp. 70–79. [Online]. Available: http://ieeexplore.ieee.org/document/5090029/

2009

Earlier work this paper cites.

B. Hartmann, D. MacDougall, J. Brandt, and S. R. Klemmer, “What would other programmers do: suggesting solutions to error messages,” in Proceedings of the 28th international conference on Human factors in computing systems - CHI ’10 . Atlanta, Georgia, USA: ACM Press, 2010, p. 1019. [Online]. Available: http://portal.acm.org/citation.cfm?doid=1753326.1753478

2010

Earlier work this paper cites.

K. Serebryany, D. Bruening, A. Potapenko, and D. Vyukov, “AddressSanitizer: A Fast Address Sanity Checker,” in 2012 USENIX Annual Technical Conference (USENIX ATC 12) . Boston, MA: USENIX Association, Jun. 2012, pp. 309–318. [Online]. Available: https://www.usenix.org/conference/atc12/technical-sessions/presentation/serebryany

2012

Earlier work this paper cites.

C. Le Goues, T. Nguyen, S. Forrest, and W. Weimer, “GenProg: A Generic Method for Automatic Software Repair,” IEEE Transactions on Software Engineering , vol. 38, no. 1, pp. 54–72, Jan. 2012. [Online]. Available: http://ieeexplore.ieee.org/document/6035728/

2012

Earlier work this paper cites.

R. Drechsler, I. G. Harris, and R. Wille, “Generating formal system models from natural language descriptions,” in IEEE Int. High Level Design Validation and Test Workshop (HLDVT) , 2012, pp. 164–165

2012

Earlier work this paper cites.

D. Steidl, B. Hummel, and E. Juergens, “Quality analysis of source code comments,” in 2013 21st International Conference on Program Comprehension (ICPC) , May 2013, pp. 83–92, iSSN: 1092-8138

2013

Earlier work this paper cites.

S. K. Sahoo, J. Criswell, C. Geigle, and V. Adve, “Using Likely Invariants for Automated Software Fault Localization,” in Proceedings of the Eighteenth International Conference on Architectural Support for Programming Languages and Operating Systems , ser. ASPLOS ’13. New York, NY, USA: Association for Computing Machinery, 2013, pp. 139–152, event-place: Houston, Texas, USA. [Online]. Available: https://doi.org/10.1145/2451116.2451131

2013

Earlier work this paper cites.

M. Polacek, “GCC Undefined Behavior Sanitizer - ubsan,” Oct. 2014. [Online]. Available: https://developers.redhat.com/blog/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan

2014

Earlier work this paper cites.

B. Kasikci, B. Schubert, C. Pereira, G. Pokam, and G. Candea, “Failure Sketching: A Technique for Automated Root Cause Diagnosis of in-Production Failures,” in Proceedings of the 25th Symposium on Operating Systems Principles , ser. SOSP ’15. New York, NY, USA: Association for Computing Machinery, 2015, pp. 344–360, event-place: Monterey, California. [Online]. Available: https://doi.org/10.1145/2815400.2815412

2015

Cited alongside, same era.

Z. Qi, F. Long, S. Achour, and M. Rinard, “An analysis of patch plausibility and correctness for generate-and-validate patch generation systems,” in Proceedings of the 2015 International Symposium on Software Testing and Analysis . Baltimore MD USA: ACM, Jul. 2015, pp. 24–36. [Online]. Available: https://dl.acm.org/doi/10.1145/2771783.2771791

2015

Cited alongside, same era.

L. Pascarella and A. Bacchelli, “Classifying Code Comments in Java Open-Source Software Systems,” in 2017 IEEE/ACM 14th International Conference on Mining Software Repositories (MSR) . Buenos Aires, Argentina: IEEE, May 2017, pp. 227–237. [Online]. Available: http://ieeexplore.ieee.org/document/7962372/

2017

M. Chen, J. Tworek, H. Jun, Q. Yuan, H. P. d. O. Pinto, J. Kaplan, H. Edwards, Y. Burda, N. Joseph, G. Brockman, A. Ray, R. Puri, G. Krueger, M. Petrov, H. Khlaaf, G. Sastry, P. Mishkin, B. Chan, S. Gray, N. Ryder, M. Pavlov, A. Power, L. Kaiser, M. Bavarian, C. Winter, P. Tillet, F. P. Such, D. Cummings, M. Plappert, F. Chantzis, E. Barnes, A. Herbert-Voss, W. H. Guss, A. Nichol, A. Paino, N. Tezak, J. Tang, I. Babuschkin, S. Balaji, S. Jain, W. Saunders, C. Hesse, A. N. Carr, J. Leike, J. Achiam, V. Misra, E. Morikawa, A. Radford, M. Knight, M. Brundage, M. Murati, K. Mayer, P. Welinder, B. McGrew, D. Amodei, S. McCandlish, I. Sutskever, and W. Zaremba, “Evaluating Large Language Models Trained on Code,” arXiv:2107.03374 [cs] , Jul. 2021, arXiv: 2107.03374. [Online]. Available: http://arxiv.org/abs/2107.03374

Original

2021

Closest in time.

OpenAI, “OpenAI Codex,” Aug. 2021. [Online]. Available: https://openai.com/blog/openai-codex/

2021

Closest in time.

O. Lieber, O. Sharir, B. Lentz, and Y. Shoham, “Jurassic-1: Technical Details and Evaluation,” AI21 Labs, Tech. Rep., Aug. 2021. [Online]. Available: https://uploads-ssl.webflow.com/60fd4503684b466578c0d307/61138924626a6981ee09caf6_jurassic_tech_paper.pdf

2021

Closest in time.

H. Pearce, B. Ahmad, B. Tan, B. Dolan-Gavitt, and R. Karri, “An Empirical Cybersecurity Evaluation of GitHub Copilot’s Code Contributions,” arXiv:2108.09293 [cs] , Aug. 2021, arXiv: 2108.09293. [Online]. Available: http://arxiv.org/abs/2108.09293