VeriPort: Automated patch backporting and verification at scale

The paper proposes an end-to-end agent system, VeriPort, that can automatically backport patches corresponding to vulnerability advisories to every affected version of a software package, and build an evidence chain for each patch confirming that it both blocks vulnerability exploitation and preserves intended behavior. Among the 128 backporting tasks in BackportBench, VeriPort solved 95.3%, 22.7 percentage points higher than the current best solution, Claude Code. The authors deployed the system on 169 high-severity and critical CVEs, generating more than 5000 verified backported patches. The system also found, in 92 security advisories, 2100 versions incorrectly reported as affected and 127 previously unidentified affected versions, of which 23 advisories have been corrected upstream, removing 387 versions and adding 81.