# Favia: Forensic Agent for Vulnerability-fix Identification and Analysis

arXiv: https://arxiv.org/abs/2602.12500 · HTML: https://mlsanity.com/paper/2602.12500/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 23 of its 46 references that are in the map.
- First posted on arXiv 13 Feb 2026.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 23 of 23)

- [Qwen3 Technical Report](https://mlsanity.com/paper/2505.09388/) (2025)
- [ReAct: Synergizing Reasoning and Acting in Language Models](https://mlsanity.com/paper/2210.03629/) (2022)
- [Gemma 3 Technical Report](https://mlsanity.com/paper/2503.19786/) (2025)
- [SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering](https://mlsanity.com/paper/2405.15793/) (2024)
- [gpt-oss-120b & gpt-oss-20b Model Card](https://mlsanity.com/paper/2508.10925/) (2025)
- [Qwen3 Embedding: Advancing Text Embedding and Reranking Through Foundation Models](https://mlsanity.com/paper/2506.05176/) (2025)
- [Automating Code Review Activities by Large-Scale Pre-training](https://mlsanity.com/paper/2203.09095/) (2022)
- [CC2Vec: Distributed Representations of Code Changes](https://mlsanity.com/paper/2003.05620/) (2020)
- [EPIC: An Energy-Efficient, High-Performance GPGPU Computing Research Infrastructure](https://mlsanity.com/paper/1912.05848/) (2019)
- [A Practical Approach to the Automatic Classification of Security-Relevant Commits](https://mlsanity.com/paper/1807.02458/) (2018)
- [PatchRNN: A Deep Learning-Based System for Security Patch Identification](https://mlsanity.com/paper/2108.03358/) (2021)
- [Commit2Vec: Learning Distributed Representations of Code Changes](https://mlsanity.com/paper/1911.07605/) (2019)
- [VulCurator: A Vulnerability-Fixing Commit Detector](https://mlsanity.com/paper/2209.03260/) (2022)
- [Enhancing Security Patch Identification by Capturing Structures in Commits](https://mlsanity.com/paper/2207.09022/) (2022)
- [Code Change Intention, Development Artifact and History Vulnerability: Putting Them Together for Vulnerability Fix Detection by LLM](https://mlsanity.com/paper/2501.14983/) (2025)
- [PatchNet: A Tool for Deep Patch Classification](https://mlsanity.com/paper/1903.02063/) (2019)
- [Silent Vulnerable Dependency Alert Prediction with Vulnerability Key Aspect Explanation](https://mlsanity.com/paper/2302.07445/) (2023)
- [Multi-Granularity Detector for Vulnerability Fixes](https://mlsanity.com/paper/2305.13884/) (2023)
- [VFFINDER: A Graph-based Approach for Automated Silent Vulnerability-Fix Identification](https://mlsanity.com/paper/2309.01971/) (2023)
- [PatchFinder: A Two-Phase Approach to Security Patch Tracing for Disclosed Vulnerabilities in Open-Source Software](https://mlsanity.com/paper/2407.17065/) (2024)
- [CommitShield: Tracking Vulnerability Introduction and Fix in Version Control Systems](https://mlsanity.com/paper/2501.03626/) (2025)
- [CompVPD: Iteratively Identifying Vulnerability Patches Based on Human Validation Results with a Precise Context](https://mlsanity.com/paper/2310.02530/) (2023)
- [Unraveling Log4Shell: Analyzing the Impact and Response to the Log4j Vulnerabil](https://mlsanity.com/paper/2501.17760/) (2025)

## Built on by (most cited first, 1 of 1)

- [PatchHolmes: Agentic Patch Retrieval via Listwise Selection](https://mlsanity.com/paper/2609.38807/) (2026)

## Abstract (arXiv)

Identifying vulnerability-fixing commits corresponding to disclosed CVEs is essential for secure software maintenance but remains challenging at scale, as large repositories contain millions of commits of which only a small fraction address security issues. Existing automated approaches, including traditional machine learning techniques and recent large language model (LLM)-based methods, often suffer from poor precision-recall trade-offs. Frequently evaluated on randomly sampled commits, we uncover that they are substantially underestimating real-world difficulty, where candidate commits are already security-relevant and highly similar. We propose Favia, a forensic, agent-based framework for vulnerability-fix identification that combines scalable candidate ranking with deep and iterative semantic reasoning. Favia first employs an efficient ranking stage to narrow the search space of commits. Each commit is then rigorously evaluated using a ReAct-based LLM agent. By providing the agent with a pre-commit repository as environment, along with specialized tools, the agent tries to localize vulnerable components, navigates the codebase, and establishes causal alignment between code changes and vulnerability root causes. This evidence-driven process enables robust identification of indirect, multi-file, and non-trivial fixes that elude single-pass or similarity-based methods. We evaluate Favia on CVEVC, a large-scale dataset we made that comprises over 8 million commits from 3,708 real-world repositories, and show that it consistently outperforms state-of-the-art traditional and LLM-based baselines under realistic candidate selection, achieving the strongest precision-recall trade-offs and highest F1-scores.