AutoFix: A Verification-Driven Framework for Automated Program Repair and Security Patching of Python Code

Abstract: Automated program repair (APR) tools still frequently struggle to generate reliable code. Often, they produce patches that fail to compile, reference undefined names, or trick the system into passing tests simply by deleting core functionality. Furthermore, most of the existing research in security repair is heavily focused on C/C++. In this paper, we review twenty studies covering neural, LLM-based, and vulnerability repair, pinpointing six recurring gaps in the field: uncompilable output, execution-blind training, test-suite overfitting, narrow security coverage, assuming fault locations in advance, and evaluation leakage. To address these limitations, we introduce AutoFix, a verification-driven framework built specifically for Python. AutoFix tracks down and localizes faults by combining AST analysis, tracebacks, and Ochiai ranking. It then maps the underlying weaknesses to their respective CWE categories and uses a LoRA-tuned transformer to generate a ranked list of candidate patches. Before any patch is accepted, it must survive four rigorous sandboxed checks: syntax, compilation, standard tests, and property-based testing. The outcomes of this verification process are then fed back into the system as a graded reward to further fine-tune the model. This paper outlines the framework's overall design, architecture, and evaluation plan, with the actual implementation results set aside for future work.

Keywords: Automated program repair, vulnerability patching, large language models, LoRA fine-tuning, CWE, fault localization, patch verification