My coauthors and I will be presenting the paper "Graph-Augmented Retrieval and Explainable Consequence Planning for Vulnerability Repair" at the IEEE International Conference on Big Data (BigData'26) in December. Below is a preview of the abstract:

Automated vulnerability repair (AVR) increasingly relies on large language models (LLMs) to generate patches, yet successful repair requires more than recognizing vulnerable code or retrieving semantically similar examples. A correct patch must determine how a transformation should alter the security-relevant control and data flows of the target program. Existing LLM-based approaches often leave this planning decision to the model, limiting both reliability and transparency. We present GRAFT (Graph-Retrieval-Augmented Fix Transformation), an AVR framework organized around three tiers of explainable graph-based repair intelligence: structural retrieval, consequence-aware planning, and security-effect validation. GRAFT reconstructs cross-files security flows that preserve data- and control-flow dependencies across function and file boundaries, and mines historical vulnerable-to-developer-fixed cases as transformations of those flows. Structural retrieval identifies relevant historical repair evidence, while a consequence-aware planner evaluates candidate transformations for target applicability and ranks them by their predicted security effects rather than code similarity alone. The resulting plan specifies the required security invariant and repair locus without prescribing a single source-code implementation. An LLM realizes the selected plan under bounded refinement, while multi-gated graph-based validation independently checks flow protection, residual bypasses, newly introduced unsafe flows, and counterfactual attribution. We evaluate GRAFT on real-world CVEs from three datasets (MoreFixes, PatchEval, and GHSA) across Go, Java, and JavaScript, covering four taint-style vulnerability families. GRAFT achieves a 53.3% secure-repair rate on MoreFixes, outperforming the strongest learning-based baseline CodeGen by 7.5 percentage points and VulRepair and VulMaster by 14.1 and 20.8 percentage points, respectively, while costing 6–39× less per task than agentic baselines.