Laboni Sarker

Automatically generated security patches can stop the crash and pass existing tests while quietly changing what the program does. DeepDiff treats the original vulnerable program as the behavioral reference and compares observable behavior on inputs that do not trigger the crash, returning the differing input as concrete evidence. On 385 candidate patches drawn from CyberGym, this regression-freedom check raised recall for functionally divergent patches from 6% under non-differential execution to 64%, at the cost of flagging 18% of developer patches as divergent.

Automatically generated security patches can stop the crash and pass existing tests while quietly changing what the program does. DeepDiff treats the original vulnerable program as the behavioral reference and compares observable behavior on inputs that do not trigger the crash, returning the differing input as concrete evidence. On 385 candidate patches drawn from CyberGym, this regression-freedom check raised recall for functionally divergent patches from 6% under non-differential execution to 64%, at the cost of flagging 18% of developer patches as divergent.