arxivcs.SEcs.AIcs.CR2026-07-13
AutoTrace: From Patches to Triggers via Agentic Interprocedural Exploration
Arastoo Zibaeirad, Marco Vieira, Thomas Zimmermann
Given a vulnerability-fixing commit, trigger localization asks which specific statement turns the vulnerable program state into a concrete unsafe operation. This question is harder than binary vulnerability detection because the answer demands interprocedural, causal reasoning: i…