Hmaizah, Nibras and Ghanim, Roaa (2026) CONFIDENCE-DRIVEN GRAPH-OF-THOUGHT RETRIEVAL-AUGMENTED AGENTS FOR VERIFIABLE VULNERABILITY PATCH GENERATION IN MULTI-LANGUAGE LEGACY CODEBASES. Kyzylorda Scholarly Review, 3 (4). ISSN 3007-4681

Text Kyzylorda+Scholarly+Review+(KSR)_Nibras+Hmaizah,Roaa+Ghanim_Confidence-Driven+Graph-of-Thought.pdf Download (887kB)

Abstract

It is much more difficult to automatically repair security vulnerabilities in legacy software that is multi-language, than it is to detect them, for an automated patch that successfully compiles does not necessarily improve the security, functionality, or lack of intrusiveness of the software. Most current large language-model (LLM) repair systems are prone to producing grammatically correct but unverified patches, lacking evidence of what edits it has made, and giving inaccurate confidence estimates, and are rarely tested across languages under leakage control. We introduce UC-GoT-RAG, a framework consisting of an agentic architecture, vulnerability-aware hybrid retrieval, an evidence-linked Graph-of-Thought (GoT) reasoning representation, specialised analysis/generation/verification agents, and a patch-specific uncertainty-decomposition and calibration mechanism governing selective acceptance, abstention, or human escalation. Each patch is put through a rigorous staged verification process including application, build, functional and regression testing, neutralising the exploit or proof of vulnerability, security testing, and static analysis, ensuring correctness is executable, not textual. On a leakage-controlled five-language corpus collected from public commits which fixed CVE bugs, UC-GoT-RAG achieves a Verifiable Correct Patch Rate of 46.9%, which is 9.7 points higher than the best controlled baseline, and also drops the Expected Calibration Error from 0.164 to 0.041, reducing incorrect-patch acceptance at a fixed coverage by half. The most significant gains in retrieval and graph reasoning are in rare CWE families and high-legacy-burden projects. The benchmark split, prompts and configurations are released along with the patch validation harness for reproduction.

Item Type:	Article
Uncontrolled Keywords:	Automated vulnerability repair, large language models, retrieval-augmented generation, graph-of-thought reasoning, uncertainty calibration, selective prediction, legacy software, software security
Subjects:	H Social Sciences
Depositing User:	admin eprints
Date Deposited:	04 Nov 2026 09:26
Last Modified:	04 Nov 2026 09:26
URI:	http://eprints.umsida.ac.id/id/eprint/17465

Actions (login required)

View Item