[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-327337-105":3,"detail-sidebar-cat-0-en-105":81,"doc-detail-327337-en":130},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","mastermind-strategy-grounded-learning-for-repository-scale-vulnerability-reproduction","Mastermind - Strategy-grounded Learning for Repository-Scale Vulnerability Reproduction","","Repository-level vulnerability reproduction is treated as a hard software engineering problem requiring codebase inspection, input-grammar inference, proof-of-concept (PoC) construction, and crash verification after patching. The work argues that learning should target reusable strategies rather than full action trajectories. It introduces Mastermind, a dual-loop framework with a trainable planner and a task-local experience loop. Trained and evaluated on CyberGym, the approach achieves strong pass rates with multiple frozen LLM executors.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/document/","Document",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/document/research-report/","Research & Report",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/document/mastermind-strategy-grounded-learning-for-repository-scale-vulnerability-reproduction/327337/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/mastermind-strategy-grounded-learning-for-repository-scale-vulnerability-reproduction/327337.png","ImageObject",300,407,{"name":42,"@type":43},"Emma Wilson","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-31","2026-09-21",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",10,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"What problem does Mastermind address in repository-scale vulnerability reproduction?","Question",{"text":63,"@type":64},"Mastermind targets the difficulty of reproducing vulnerabilities across an entire repository, where an agent must locate vulnerable paths, infer input formats, build PoCs, and confirm crashes disappear on patched builds.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"Why does the paper focus on learning strategies instead of action trajectories?",{"text":68,"@type":64},"The paper claims strategies are compact, concrete, and stable enough to optimize and reuse across attempts, whereas trajectories are longer and less transferable.",{"name":70,"@type":61,"acceptedAnswer":71},"How is Mastermind evaluated and what results are reported?",{"text":72,"@type":64},"Evaluation on CyberGym uses 260 training and 200 held-out tasks. With GPT-5.5 as a frozen executor, Mastermind reports an 84.5% pass rate, outperforming several baselines and improving other executors as well.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},327337,1790707195,{"code":4,"msg":82,"data":83},"success",[84,88,92,96,101,106,111,115,120,123,126],{"id":22,"doc_module":4,"doc_module_name":25,"category_name":85,"show_sort_weight":86,"slug":87},"Story & Novel",90,"story-novel",{"id":26,"doc_module":4,"doc_module_name":25,"category_name":89,"show_sort_weight":90,"slug":91},"Literature",80,"literature",{"id":33,"doc_module":4,"doc_module_name":25,"category_name":93,"show_sort_weight":94,"slug":95},"Exam",70,"exam",{"id":97,"doc_module":4,"doc_module_name":25,"category_name":98,"show_sort_weight":99,"slug":100},5,"Comic",60,"comic",{"id":102,"doc_module":4,"doc_module_name":25,"category_name":103,"show_sort_weight":104,"slug":105},6,"Technology",50,"technology",{"id":107,"doc_module":4,"doc_module_name":25,"category_name":108,"show_sort_weight":109,"slug":110},7,"Healthcare",40,"healthcare",{"id":112,"doc_module":4,"doc_module_name":25,"category_name":29,"show_sort_weight":113,"slug":114},8,30,"research-report",{"id":116,"doc_module":4,"doc_module_name":25,"category_name":117,"show_sort_weight":118,"slug":119},9,"Religion & Spirituality",20,"religion-spirituality",{"id":118,"doc_module":4,"doc_module_name":25,"category_name":121,"show_sort_weight":118,"slug":122},"World Cup","world-cup",{"id":55,"doc_module":4,"doc_module_name":25,"category_name":124,"show_sort_weight":55,"slug":125},"Lifestyle","lifestyle",{"id":127,"doc_module":4,"doc_module_name":25,"category_name":128,"show_sort_weight":97,"slug":129},19,"General","general",{"code":4,"msg":82,"data":131},{"doc_id":79,"user_id":132,"nickname":42,"user_avatar":133,"doc_module":4,"category_id":112,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":139,"language":140,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":12,"update_tm":144,"read_time":113,"preview_page_count":4},3848291630094,"https://eur-avatar.wpscdn.com/davatar_085a072bc5b1113ac321206ff7593b45","Mastermind: Strategy-grounded Learning for Repository-Scale Vulnerability Reproduction  \nMingzhe Du1,2 Luu Anh Tuan2 Tianyi Wu1 Renyang Liu1 Zhijiang Guo3 Dong Huang1 See-Kiong Ng1  \n1National University of Singapore 2Nanyang Technological University 3The Hong Kong University of Science and Technology (Guangzhou)  \narXiv :2607 .0 1764v 1 [ cs .AI] 2 Jul 2026  \nAbstract—Repository-level vulnerability reproduction is a demanding software engineering (SE) task: an agent must inspect a codebase, infer the input grammar that reaches a vulnerable path, construct a proof-of-concept (PoC), and verify that the crash disappears on the patched build. Recent LLM agents can often execute these steps when the approach is correct, yet they still fail by choosing the wrong strategy. This paper argues that strategy, rather than the full action trajectory, is the right learning unit for such SE agents: it is compact enough to optimize, concrete enough to guide execution, and stable enough to store and reuse across attempts. We present Mastermind, a dual-loop framework that separates transferable strategy learning from task-specific experience. A trainable planner learns reusable vulnerability-reproduction strategies through SFT and milestonebased GRPO, while an experience loop maintains task-local strategy records that guide subsequent attempts. The planner is trained independently of the executor, allowing strategy learning to improve multiple frozen executors without modifying their actiongeneration capability. We evaluate Mastermind on CyberGym using 260 training tasks and 200 held-out evaluation tasks. With GPT-5.5 as the frozen executor, Mastermind achieves an 84.5% pass rate, outperforming open-book PoC context (60.0%), Bestof-8 sampling (63.0%), and iterative improvement (77.0%). The same planner also improves GPT-5.4 mini and GLM 5.1 from 45.0% and 58.5% to 60.0% and 71.0% . These results demonstrate that learning high-level strategies is an effective and transferable mechanism for improving repository-scale SE agents. 1  \nI. INTRODUCTION  \nVulnerability reproduction is a demanding testbed for autonomous software engineering (SE) agents [1] . Given acodebase, vulnerability description, and benchmark interface, an agent must find the vulnerable path, infer the input format, construct a proof-of-concept (PoC), and verify that it crashes only the vulnerable build. Unlike conventional code generation, success is a working PoC judged by execution, requiring repository exploration, build interaction, hypothesis revision, and behavioral validation.  \nRecent LLM progress has made SE agents stronger executors [2, 3] . They can navigate repositories, run commands, edit files, and submit PoCs, but stronger execution does not guarantee the right investigation. In practice, agents still waste many rollouts exploring unproductive directions and fail to revise with feedback. CyberGym [4] exposes this gap: with a fixed GPT-5.5 executor, one-shot attempt solves 23.5% of tasks, independent Best-of-8 reaches 63.0%, and sequential task-local strategy revision reaches 77.0% . The bottleneck is strategic: deciding what to try next, not merely executing commands.  \n1 A pre-print version of this paper is available at [https://github.com/Elfsong/](https://github.com/Elfsong/)[ ](https://github.com/Elfsong/)[ICSE-Mastermind-preprint.](ICSE-Mastermind-preprint.)  \ndef mastermind(task):  \nwhile not converge:  \nexperience = curator.activate(task) strategy = planner.generate(experience) rollout = executor.execute(strategy) result = verifier. validate(rollout) curator.accumulate(result)  planner.calibrate(result)   \nPolicy Loop  \nExperience Loop  \nFig. 1: Mastermind learns at the strategy level rather than the trajectory level. Verified rollouts feed a dual loop: experience loop preserves task-local lessons, while policy loop learns transferable strategies for frozen executors.  \nRecent agent-learning systems increasingly recognize this gap, but address only parts of","cbCaiijLhsH1LuyD","https://ap.wps.com/l/cbCaiijLhsH1LuyD","pdf",434797,12,"English","# Introduction\n## Vulnerability reproduction as an agent testbed\n## Strategy bottleneck in autonomous SE agents\n# Mastermind framework\n## Dual-loop experience and policy learning\n## Planner, curator, executor, and verifier roles","[{\"question\":\"What problem does Mastermind address in repository-scale vulnerability reproduction?\",\"answer\":\"Mastermind targets the difficulty of reproducing vulnerabilities across an entire repository, where an agent must locate vulnerable paths, infer input formats, build PoCs, and confirm crashes disappear on patched builds.\"},{\"question\":\"Why does the paper focus on learning strategies instead of action trajectories?\",\"answer\":\"The paper claims strategies are compact, concrete, and stable enough to optimize and reuse across attempts, whereas trajectories are longer and less transferable.\"},{\"question\":\"How is Mastermind evaluated and what results are reported?\",\"answer\":\"Evaluation on CyberGym uses 260 training and 200 held-out tasks. With GPT-5.5 as a frozen executor, Mastermind reports an 84.5% pass rate, outperforming several baselines and improving other executors as well.\"}]","Mastermind - Strategy-grounded Learning for Repository-Scale Vulnerability Reproduction | PDF",1789977005]