Two Views, One Fix: Multi-Modal Learning for Automated Vulnerability Repair

Supplementary material for the paper "Two Views, One Fix: Multi-Modal Learning for Automated Vulnerability Repair" Abstract Many vulnerabilities require edits in non-contiguous code regions that are connected by control- and data-flow dependencies. Token sequences represent these dependencies poorly. In a comparison of 24 source-level approaches, those that use code structure serialize it into tokens, use it to guide attention, or use it to select prompt content. None passes the graph itself to the repair model. We present GraphT5, a graph-augmented Transformer for Automated Vulnerability Repair. GraphT5 reads two views of a vulnerable function: its source code and a Vulnerability Dependence Graph (VDG), a slice of the Code Property Graph (CPG) that keeps the dependencies relevant to repair. A CodeT5-initialized text encoder and a VDG encoder feed a decoder with gated dual cross-attention. We evaluate GraphT5 on 2,411 C/C++ test samples from three datasets. It outperforms VulMaster by an average relative 17.1% in EM, 19.6% in BLEU-4, and 8.1% in CodeBLEU, and exceeds zero-shot GPT-4o and Gemini 2.5 Pro in static similarity on two datasets. Under dynamic validation, GraphT5 produces plausible patches for 12 of 81 Vul4C vulnerabilities, tied with the best baseline, and test-passing patches for 15 of 35 Vul4J cases, the third-highest reported total.