P2Patch: exploit-guided vulnerability repair

Evidence record

Original P2Patch paper describing an iterative exploiter-patcher-execution-controller loop on 101 C/C++ and Java vulnerability subjects. Reports additional working counterexamples and distinct held-out fix-closed and beyond-upstream coverage measures.

Read the original source ↗

Claim-level citations (3)

• supportsExecution-guided patching exposes repairs that only block the initial exploit: P2Patch reports additional execution-confirmed bypasses in 41 of 101 repair runs after the initial proof stopped working. Semantic distinctness was prompted, not mechanically verified, so the authors qualify that percentage as an upper bound on distinct bypasses.

  Results, loop dynamics; paragraph following the 41/101 hardening result and its semantic-distinctness qualification

• supportsExecution-guided patching exposes repairs that only block the initial exploit: The study reports held-out security coverage of 78.1% for single-pass Claude Code and 84.7% for P2Patch on 101 subjects.

  Table 2, fix-closed evaluation; independent security-oracle methodology

• supportsExecution-guided patching exposes repairs that only block the initial exploit: On the paper's beyond-upstream held-out evaluation, P2Patch raises reported coverage from 42.1% for single-pass Claude Code to 62.5%, a different metric from fix-closed coverage.

  Paper abstract, comparison of fix-closed and beyond-upstream coverage