SYNTHFIX: A Hybrid Neural-Compiler Framework for Code Vulnerability Repair

Abstract

Addressing code vulnerabilities is crucial for software security and reliability. We present SYNTHFIX, an innovative framework for automated code repair that combines Supervised Fine-Tuning (SFT) with Proximal Policy Optimization (PPO) in an iterative training regime. Inspired by optimization strategies from statistical algorithms, SYNTHFIX balances the rapid pattern recognition of SFT with the adaptive learning of PPO. By incorporating compiler insights, such as Abstract Syntax Trees(AST), Control Flow Graphs (CFG), and ESLint, SYNTHFIX enhances training dynamics, improving scalability and adaptability. Evaluation on the FixJS dataset with over 30k JavaScript code pairs, demonstrates that SYNTHFIX outperforms existing methods, achieving up to 7.78% improvement in CodeBLEU over SFT and 7.33% over PPO on the CodeT5 and CodeGen models. SYNTHFIX further shows substantial gains in Exact Match, achieving up to 2.16x improvement. This innovative training architecture outperforms traditional models and shows potential for advancing other software engineering tasks throughfeedback adjustments.