SFU lab · design lead · Ongoing
CVerify
Agentic CVE reproduction, checked against both the vulnerable and the patched build.
- LLM agents
- Security
- Reproducibility
Overview
Reproducing a CVE is easy to fake: an exploit that "fired" proves little on its own. CVerify reconstructs the vulnerable and patched versions from source as separate container images and accepts an exploit only if it succeeds on the first and fails on the second.
Contributions and results
- Designed the pipeline and its post-patch differential oracle.
- Built and maintained by a team in the SFU lab.