Patcher: Localized Repair in AI & Software

• Patcher is a localized intervention mechanism that repairs specific failure points in representations, tokenization, or code while preserving the overall system integrity.
• It employs techniques such as visual token substitution, dynamic patch construction, and post-hoc model editing to mitigate errors like hallucinations in multimodal models.
• Applications span video LMMs, time series segmentation, and software repair, with methodologies including reinforcement learning and attention-guided calibration to ensure efficient, context-aware modifications.

Searching arXiv for papers on “Patcher” and the primary paper (Gao et al., 10 Jun 2026) to ground the article in the latest literature. “Patcher” denotes a localized intervention mechanism that alters an existing representation, policy, model state, or software artifact at a narrow interface rather than retraining or replacing the full system. In video large multimodal models, the term names a lightweight Visual Token Patcher that predicts unreliable visual tokens and substitutes them with a dynamic global patch token before language generation, thereby mitigating hallucinations while leaving the frozen backbone unchanged (Gao et al., 10 Jun 2026). In adjacent literature, the same label also names dynamic patch constructors for time series, knowledge- or safety-repair modules for pretrained models, and repository-level repair agents in software engineering.

1. Conceptual scope and major senses of “Patcher”

The literature uses “patcher” in several technically distinct senses. In some works it is a pre-decoding repair module that edits intermediate tokens or features; in others it is a boundary constructor that decides how raw sequences should be segmented into patches; in still others it is a post-hoc model editor or a software-repair engine. The unifying property is locality: the patcher intervenes on a restricted substrate—tokens, boundaries, a last layer, a persona card, or a code region—while attempting to preserve the surrounding system.

Domain	Patcher role	Representative work
Video LMMs	Replace unreliable visual tokens before decoding	MultiToP (Gao et al., 10 Jun 2026)
Time series / sequence tokenization	Construct variable-length or learned patches	EntroPE (Abeywickrama et al., 30 Sep 2025), FlexTSF (Xiao et al., 2024), ReinPatch (Wu et al., 27 Mar 2026)
Vision segmentation	Hierarchical patch-based encoder with MoE decoding	Patcher (Ou et al., 2022)
Model correction / defense	Inject missing knowledge, defend against attacks, or edit behavior	Paxion (Wang et al., 2023), SHIELD (Le et al., 2020), Transformer-Patcher (Huang et al., 2023), Patcher (Gao et al., 2 Jun 2026), Patcher (Wen et al., 6 Jun 2026), Patcher (Chang et al., 2024)
Software and agentic repair	Generate, validate, or refine code, comments, or policies	TDPatcher (Gao et al., 2024), Co-PatcheR (Tang et al., 25 May 2025), AutoPatch (Seo et al., 7 May 2025), ContraFix (Liu et al., 17 May 2026), MOA (Liang et al., 30 Jun 2026), PatchPilot (Li et al., 4 Feb 2025), Fund2Persona (Park et al., 29 Jun 2026)

A recurrent misconception is that patching necessarily means parameter editing. The surveyed uses show otherwise. MultiToP patches visual tokens rather than weights, the diffusion-model Patcher repairs prompts, TDPatcher patches TODO comments rather than executable semantics, and agentic patchers such as Co-PatcheR or MOA emit repository-level code edits instead of modifying a model backbone (Gao et al., 10 Jun 2026).

2. Visual Token Patcher in video large multimodal models

In MultiToP, the “Patcher” is a multimodal-context-aware module inserted in front of language generation in a video LMM to address hallucinations unsupported by the input video (Gao et al., 10 Jun 2026). The motivating failure mode is that autoregressive decoding can amplify spurious correlations or language priors when the visual token stream contains background, redundant content, uncertain features, or poorly aligned semantics. The patcher therefore operates on the visual span before the frozen language generator consumes it.

Let the backbone produce visual tokens $v = \{v_i\} \in \mathbb{R}^{M \times D}$ and question embeddings $x = \{x_n\} \in \mathbb{R}^{N \times D}$. The patcher first forms the multimodal sequence

$z = v \oplus x \in \mathbb{R}^{(M+N)\times D},$

then applies a down-projection and a lightweight Transformer encoder:

$$h = T(\phi_{\text{down}}(z)) \in \mathbb{R}^{(M+N)\times d}.$$

Each token representation is split into local and global halves,

$$h^l_i = h_{i,1:d/2}, \qquad h^g = \frac{1}{M+N}\sum_{j=1}^{M+N} h_{j,(d/2+1):d},$$

and recombined as $\tilde{h}_i = [h^l_i; h^g]$. An MLP head produces keep-versus-replace logits

$$o_i = \phi_{\text{out}}(\tilde{h}_i) \in \mathbb{R}^2.$$

The central design choice is a single dynamic global patch token shared by all replaced visual tokens in the same multimodal context. It is anchored in visual space by token averaging and adapted by a contextual residual:

$$p = \frac{1}{M}\sum_{m=1}^{M} v_m + \phi_{\text{res}}\!\left(\frac{1}{M}\sum_{i\in\mathcal{V}} \tilde{h}_i\right),$$

with $g \coloneqq p$. This avoids per-token patch embeddings and keeps optimization light while remaining context-aware.

For each visual token, the patcher defines a replacement probability

$\pi_i = \text{softmax}(o_i)_1,$

a logit margin

$x = \{x_n\} \in \mathbb{R}^{N \times D}$0

and a binary decision $x = \{x_n\} \in \mathbb{R}^{N \times D}$1. During training, $x = \{x_n\} \in \mathbb{R}^{N \times D}$2 is sampled with straight-through Gumbel-Softmax; patched tokens are formed by soft substitution:

$x = \{x_n\} \in \mathbb{R}^{N \times D}$3

Only the visual span is modified. The frozen LMM then decodes autoregressively from $x = \{x_n\} \in \mathbb{R}^{N \times D}$4:

$x = \{x_n\} \in \mathbb{R}^{N \times D}$5

The interface explicitly preserves the original backbone. For high-resolution visual streams such as Qwen3-VL DeepStack, MultiToP adds a projection $x = \{x_n\} \in \mathbb{R}^{N \times D}$6 to map the global patch token into the high-resolution space before spatial merging. The architecture is therefore a pre-generation token repair layer rather than a backbone reparameterization (Gao et al., 10 Jun 2026).

3. Training, calibration, inference, and empirical behavior in MultiToP

MultiToP trains the patcher while freezing the backbone. Its most distinctive supervisory signal is information-guided rank calibration, which uses the backbone’s own answer-to-visual attentions to estimate useful information per frame and then aligns frame-level replacement tendency to those cues (Gao et al., 10 Jun 2026).

The procedure first aggregates answer-conditioned attentions over intermediate decoder layers at normalized depth $x = \{x_n\} \in \mathbb{R}^{N \times D}$7–$x = \{x_n\} \in \mathbb{R}^{N \times D}$8:

$x = \{x_n\} \in \mathbb{R}^{N \times D}$9

For each frame $z = v \oplus x \in \mathbb{R}^{(M+N)\times D},$0, it averages the top-$z = v \oplus x \in \mathbb{R}^{(M+N)\times D},$1 attended visual tokens to obtain a useful-information score

$z = v \oplus x \in \mathbb{R}^{(M+N)\times D},$2

then normalizes:

$z = v \oplus x \in \mathbb{R}^{(M+N)\times D},$3

From patcher logits it computes a frame-level replacement tendency

$z = v \oplus x \in \mathbb{R}^{(M+N)\times D},$4

and applies a weighted pairwise ranking loss

$z = v \oplus x \in \mathbb{R}^{(M+N)\times D},$5

This encourages high-information frames to have lower replacement tendency without forcing direct matching to absolute attention magnitudes.

The full objective combines three terms:

$z = v \oplus x \in \mathbb{R}^{(M+N)\times D},$6

where $z = v \oplus x \in \mathbb{R}^{(M+N)\times D},$7 is next-token cross-entropy on the ground-truth answer and

$z = v \oplus x \in \mathbb{R}^{(M+N)\times D},$8

enforces a replacement budget. In practice, MultiToP uses $z = v \oplus x \in \mathbb{R}^{(M+N)\times D},$9, $$h = T(\phi_{\text{down}}(z)) \in \mathbb{R}^{(M+N)\times d}.$$0 for Video-LLaVA-7B or $$h = T(\phi_{\text{down}}(z)) \in \mathbb{R}^{(M+N)\times d}.$$1 for Qwen3-VL-4B-Instruct, $$h = T(\phi_{\text{down}}(z)) \in \mathbb{R}^{(M+N)\times d}.$$2, and $$h = T(\phi_{\text{down}}(z)) \in \mathbb{R}^{(M+N)\times d}.$$3, training on 3,000 LLaVA-Hound samples with AdamW at learning rate $$h = T(\phi_{\text{down}}(z)) \in \mathbb{R}^{(M+N)\times d}.$$4 for 2 epochs, batch size 1, 4-step gradient accumulation, and gradient clipping at max-norm 1.0.

Inference is correspondingly simple: encode video and question with the frozen backbone, run the patcher on $$h = T(\phi_{\text{down}}(z)) \in \mathbb{R}^{(M+N)\times d}.$$5, set

$$h = T(\phi_{\text{down}}(z)) \in \mathbb{R}^{(M+N)\times d}.$$6

construct $$h = T(\phi_{\text{down}}(z)) \in \mathbb{R}^{(M+N)\times d}.$$7, and decode autoregressively from $$h = T(\phi_{\text{down}}(z)) \in \mathbb{R}^{(M+N)\times d}.$$8. Reported overhead is negligible. On Vript-HAL, Video-LLaVA-7B runs at $$h = T(\phi_{\text{down}}(z)) \in \mathbb{R}^{(M+N)\times d}.$$9 s per token versus $$h^l_i = h_{i,1:d/2}, \qquad h^g = \frac{1}{M+N}\sum_{j=1}^{M+N} h_{j,(d/2+1):d},$$0 for baseline with memory $$h^l_i = h_{i,1:d/2}, \qquad h^g = \frac{1}{M+N}\sum_{j=1}^{M+N} h_{j,(d/2+1):d},$$1 GB versus $$h^l_i = h_{i,1:d/2}, \qquad h^g = \frac{1}{M+N}\sum_{j=1}^{M+N} h_{j,(d/2+1):d},$$2 GB, while Qwen3-VL-4B-Instruct runs at $$h^l_i = h_{i,1:d/2}, \qquad h^g = \frac{1}{M+N}\sum_{j=1}^{M+N} h_{j,(d/2+1):d},$$3 s versus $$h^l_i = h_{i,1:d/2}, \qquad h^g = \frac{1}{M+N}\sum_{j=1}^{M+N} h_{j,(d/2+1):d},$$4 with memory $$h^l_i = h_{i,1:d/2}, \qquad h^g = \frac{1}{M+N}\sum_{j=1}^{M+N} h_{j,(d/2+1):d},$$5 GB versus $$h^l_i = h_{i,1:d/2}, \qquad h^g = \frac{1}{M+N}\sum_{j=1}^{M+N} h_{j,(d/2+1):d},$$6 GB.

Empirically, the patcher reduces hallucinations while preserving or improving general video understanding. On Vript-HAL, Qwen3-VL-4B-Instruct improves from F1 $$h^l_i = h_{i,1:d/2}, \qquad h^g = \frac{1}{M+N}\sum_{j=1}^{M+N} h_{j,(d/2+1):d},$$7 to $$h^l_i = h_{i,1:d/2}, \qquad h^g = \frac{1}{M+N}\sum_{j=1}^{M+N} h_{j,(d/2+1):d},$$8, a $$h^l_i = h_{i,1:d/2}, \qquad h^g = \frac{1}{M+N}\sum_{j=1}^{M+N} h_{j,(d/2+1):d},$$9 relative improvement over the vanilla model, and Video-LLaVA-7B improves from $\tilde{h}_i = [h^l_i; h^g]$0 to $\tilde{h}_i = [h^l_i; h^g]$1. On ActivityNet-QA, Video-LLaVA-7B improves from accuracy $\tilde{h}_i = [h^l_i; h^g]$2 to $\tilde{h}_i = [h^l_i; h^g]$3, an $\tilde{h}_i = [h^l_i; h^g]$4 relative gain, while Qwen3-VL-4B rises from $\tilde{h}_i = [h^l_i; h^g]$5 to $\tilde{h}_i = [h^l_i; h^g]$6. Ablations further show that sparsity control, rank calibration, and Top-$\tilde{h}_i = [h^l_i; h^g]$7 attention cues are all material: $\tilde{h}_i = [h^l_i; h^g]$8 degrades performance, removing $\tilde{h}_i = [h^l_i; h^g]$9 reduces performance, and overly large $$o_i = \phi_{\text{out}}(\tilde{h}_i) \in \mathbb{R}^2.$$0 over-constrains patching. The reported limitations are equally local: a fixed budget $$o_i = \phi_{\text{out}}(\tilde{h}_i) \in \mathbb{R}^2.$$1 can be suboptimal per sample, fast motion or occlusion can corrupt attention-derived cues, and a single global patch token may be less effective in highly cluttered scenes (Gao et al., 10 Jun 2026).

4. Patchers as adaptive representation and tokenization mechanisms

A second major meaning of “patcher” concerns the construction of patches themselves. Here the patcher is not repairing a hallucination or a safety failure; it is deciding how a continuous signal should be segmented before downstream modeling.

EntroPE introduces an Entropy-based Dynamic Patcher that places time-series boundaries where conditional entropy is high and sharply increasing, rather than at fixed offsets (Abeywickrama et al., 30 Sep 2025). It computes

$$o_i = \phi_{\text{out}}(\tilde{h}_i) \in \mathbb{R}^2.$$2

marks a boundary when both $$o_i = \phi_{\text{out}}(\tilde{h}_i) \in \mathbb{R}^2.$$3 and $$o_i = \phi_{\text{out}}(\tilde{h}_i) \in \mathbb{R}^2.$$4, enforces $$o_i = \phi_{\text{out}}(\tilde{h}_i) \in \mathbb{R}^2.$$5 and optionally $$o_i = \phi_{\text{out}}(\tilde{h}_i) \in \mathbb{R}^2.$$6, and then uses an Adaptive Patch Encoder to map variable-length patches to fixed embeddings. Reported benchmark results include ETTh1 MSE $$o_i = \phi_{\text{out}}(\tilde{h}_i) \in \mathbb{R}^2.$$7 versus PatchTST $$o_i = \phi_{\text{out}}(\tilde{h}_i) \in \mathbb{R}^2.$$8, Electricity MSE $$o_i = \phi_{\text{out}}(\tilde{h}_i) \in \mathbb{R}^2.$$9 versus $$p = \frac{1}{M}\sum_{m=1}^{M} v_m + \phi_{\text{res}}\!\left(\frac{1}{M}\sum_{i\in\mathcal{V}} \tilde{h}_i\right),$$0, and stable performance across $$p = \frac{1}{M}\sum_{m=1}^{M} v_m + \phi_{\text{res}}\!\left(\frac{1}{M}\sum_{i\in\mathcal{V}} \tilde{h}_i\right),$$1 with training-time reductions of $$p = \frac{1}{M}\sum_{m=1}^{M} v_m + \phi_{\text{res}}\!\left(\frac{1}{M}\sum_{i\in\mathcal{V}} \tilde{h}_i\right),$$2 on Weather and $$p = \frac{1}{M}\sum_{m=1}^{M} v_m + \phi_{\text{res}}\!\left(\frac{1}{M}\sum_{i\in\mathcal{V}} \tilde{h}_i\right),$$3 on ETTh1 at higher $$p = \frac{1}{M}\sum_{m=1}^{M} v_m + \phi_{\text{res}}\!\left(\frac{1}{M}\sum_{i\in\mathcal{V}} \tilde{h}_i\right),$$4.

FlexTSF uses an IVP Patcher for irregular time series, treating each patch as a set of observed value-time pairs and summarizing it through backward continuous-time evolution to a common anchor (Xiao et al., 2024). A patch embedding is sampled from an inferred posterior

$$p = \frac{1}{M}\sum_{m=1}^{M} v_m + \phi_{\text{res}}\!\left(\frac{1}{M}\sum_{i\in\mathcal{V}} \tilde{h}_i\right),$$5

after mapping observations into latent states and evolving them via $$p = \frac{1}{M}\sum_{m=1}^{M} v_m + \phi_{\text{res}}\!\left(\frac{1}{M}\sum_{i\in\mathcal{V}} \tilde{h}_i\right),$$6. This makes patch duration depend on the number of observations rather than on fixed clock time and directly accommodates missing values and unequal intervals. Ablation is unusually sharp: removing IVP Patcher increases MSE by $$p = \frac{1}{M}\sum_{m=1}^{M} v_m + \phi_{\text{res}}\!\left(\frac{1}{M}\sum_{i\in\mathcal{V}} \tilde{h}_i\right),$$7 on CharTraj, $$p = \frac{1}{M}\sum_{m=1}^{M} v_m + \phi_{\text{res}}\!\left(\frac{1}{M}\sum_{i\in\mathcal{V}} \tilde{h}_i\right),$$8 on ArabDigit, $$p = \frac{1}{M}\sum_{m=1}^{M} v_m + \phi_{\text{res}}\!\left(\frac{1}{M}\sum_{i\in\mathcal{V}} \tilde{h}_i\right),$$9 on HAR-IMU, $g \coloneqq p$0 on eICU, and $g \coloneqq p$1 on PhysioNet12.

ReinPatch turns boundary placement into a reinforcement-learning policy over discrete patch decisions, optimized with Group Relative Policy Gradient rather than soft relaxation (Wu et al., 27 Mar 2026). It explicitly enforces a compression budget $g \coloneqq p$2, supports hierarchical patching with nested boundary sets, and can be detached as a standalone “foundation patcher” for zero-shot transfer. In the reported forecasting experiments, the zero-shot patcher achieves the best overall averages in $g \coloneqq p$3 datasets, attains state-of-the-art in $g \coloneqq p$4 per-horizon cases, and improves average MSE by $g \coloneqq p$5 versus entropy patching, with up to $g \coloneqq p$6 on ETTh1.

The 2022 medical-image segmentation architecture named Patcher uses the term differently again: its encoder partitions an image into overlapping large patches, subdivides them into small patches, runs localized self-attention within each large patch, and couples the hierarchy to a mixture-of-experts decoder (Ou et al., 2022). On stroke lesion segmentation it reports DSC/IoU $g \coloneqq p$7, and on Kvasir-SEG polyp segmentation $g \coloneqq p$8, outperforming reported Transformer- and CNN-based comparators. In this usage, the patcher is not a repair add-on but the primary representational scaffold.

5. Patchers as post-hoc model correction and defense

A third lineage treats the patcher as a behavioral correction layer attached to an existing model. The intervention may act on features, neurons, prediction heads, prompt tokens, or fine-tuning dynamics, but it remains deliberately localized.

Paxion introduces a Knowledge Patcher and Knowledge Fuser for frozen video-LLMs, using a Perceiver-style module to encode action-centric features and a downstream cross-attention fuser to combine them with backbone features (Wang et al., 2023). Trained with the Discriminative Video Dynamics Modeling objective, this patcher raises average ActionBench probing accuracy from near-random backbone levels to substantially higher values, for example from $g \coloneqq p$9 to $\pi_i = \text{softmax}(o_i)_1,$0 on InternVideo, while maintaining or improving downstream object- and action-centric performance.

SHIELD patches only the last layer of a textual neural network, replacing a single prediction head with a stochastic weighted ensemble of $\pi_i = \text{softmax}(o_i)_1,$1 expert heads and a Gumbel-Softmax weighting module (Le et al., 2020). The aim is not semantic repair but adversarial defense: by varying the effective ensemble across queries, SHIELD breaks the fixed-model assumption exploited by iterative black-box attacks. Across CNN, RNN, BERT, and RoBERTa models, the paper reports average relative robustness gains of $\pi_i = \text{softmax}(o_i)_1,$2–$\pi_i = \text{softmax}(o_i)_1,$3 against 14 attacks while preserving clean weighted F1.

Transformer-Patcher is a sequential model editor that appends and trains a small number of neurons in the last feed-forward layer, formalized as

$\pi_i = \text{softmax}(o_i)_1,$4

with memory-based locality losses to prevent interference (Huang et al., 2023). Its central claim is “one mistake worth one neuron.” In the full-stream zsRE setting, it reports SR $\pi_i = \text{softmax}(o_i)_1,$5, GR $\pi_i = \text{softmax}(o_i)_1,$6, ER $\pi_i = \text{softmax}(o_i)_1,$7, TrainR $\pi_i = \text{softmax}(o_i)_1,$8, and TestR $\pi_i = \text{softmax}(o_i)_1,$9 over $x = \{x_n\} \in \mathbb{R}^{N \times D}$00 edits, with model-size overhead of about $x = \{x_n\} \in \mathbb{R}^{N \times D}$01.

The term also appears in alignment and backdoor defense. One Patcher simulates strong multi-step full-parameter malicious finetuning during alignment, then trains the defender to be insensitive to the resulting attack vector $x = \{x_n\} \in \mathbb{R}^{N \times D}$02 through an interpolated safe-data loss (Wen et al., 6 Jun 2026). Another performs post-hoc repair of backdoored LLMs from a single reported failure case by localizing trigger tokens with response-conditioned gradient saliency and then fine-tuning with refusal supervision plus KL anchoring (Gao et al., 2 Jun 2026). On Llama-3.1-8B-Instruct SST2 under UJB, the latter reduces ASR from $x = \{x_n\} \in \mathbb{R}^{N \times D}$03 to $x = \{x_n\} \in \mathbb{R}^{N \times D}$04 while changing ACC from $x = \{x_n\} \in \mathbb{R}^{N \times D}$05 to $x = \{x_n\} \in \mathbb{R}^{N \times D}$06.

Prompt-level repair is yet another variant. The text-to-image diffusion Patcher detects neglected objects via CLIP similarity, uses DAAM attention to compute cross-object imbalance, and repairs the prompt through explicit feature enhancement or hyponym substitution (Chang et al., 2024). Across Stable Diffusion v1.4, v1.5, and v2.1, it improves Correct Rate by $x = \{x_n\} \in \mathbb{R}^{N \times D}$07–$x = \{x_n\} \in \mathbb{R}^{N \times D}$08 over the strongest baseline in each setting.

These works jointly show that “patching” need not imply a single mathematical form. It can be a feature-space adapter, a last-layer stochastic ensemble, a neuron insertion scheme, a train-time robustification loop, a post-hoc backdoor repair procedure, or an attention-guided prompt rewrite. What is shared is the goal of altering a sharply delimited failure pathway while keeping most of the original model intact.

6. Software, agentic, and policy patchers

In software engineering and adjacent agentic systems, “patcher” returns to its more literal sense: a component that emits or edits artifacts such as comments, code, validation strategies, or textual policies.

TDPatcher defines TODO-missed method detection and patching as the task of finding methods that contain an equivalent suboptimal implementation without the corresponding TODO comment and inserting that comment at the right line (Gao et al., 2024). Using GraphCodeBERT and triplet contrastive learning over joint TODO–code blocks, it reports detection Precision $x = \{x_n\} \in \mathbb{R}^{N \times D}$09, Recall $x = \{x_n\} \in \mathbb{R}^{N \times D}$10, F1 $x = \{x_n\} \in \mathbb{R}^{N \times D}$11, P@1 $x = \{x_n\} \in \mathbb{R}^{N \times D}$12, and an in-the-wild outcome of 26 true TODO-missed methods out of 41 candidates flagged across 50 repositories.

Co-PatcheR decomposes end-to-end software repair into localization/generation and hybrid validation components, each handled by a specialized 14B reasoning model (Tang et al., 25 May 2025). Its collaborative patcher stack reaches a $x = \{x_n\} \in \mathbb{R}^{N \times D}$13 resolved rate on SWE-bench-Verified with $x = \{x_n\} \in \mathbb{R}^{N \times D}$14 candidate patches, using three 14B models rather than a single larger model.

AutoPatch addresses newly disclosed CVEs after a model’s knowledge cutoff by retrieving the most relevant vulnerability exemplar through a unified similarity model, verifying the match with CVE-specific chain-of-thought prompting, and iterating patch–verify loops (Seo et al., 7 May 2025). It reports $x = \{x_n\} \in \mathbb{R}^{N \times D}$15 percent CVE matching accuracy, $x = \{x_n\} \in \mathbb{R}^{N \times D}$16 percent F1 for vulnerability verification, and $x = \{x_n\} \in \mathbb{R}^{N \times D}$17 percent patching accuracy, while being more than $x = \{x_n\} \in \mathbb{R}^{N \times D}$18 more cost-efficient than fine-tuning baselines.

ContraFix’s Patcher is the terminal agent in a differential-runtime AVR pipeline: it consumes a repair specification distilled from crashing versus non-crashing PoC variants, retrieves prior repair skills, edits code under checkpointed tool control, and accepts a patch only if it compiles and neutralizes the vulnerability across the original PoC and all crashing variants (Liu et al., 17 May 2026). With GPT-5-mini it resolves $x = \{x_n\} \in \mathbb{R}^{N \times D}$19 of SEC-Bench and $x = \{x_n\} \in \mathbb{R}^{N \times D}$20 of PatchEval.

MOA’s Patcher operates at codebase scale for memory optimization, taking anti-pattern reports and checker detections, then executing a state-machine workflow of Preparing, Patching, and Validating with clangd-backed context gathering and rollback (Liang et al., 30 Jun 2026). On OpenHarmony it generates 769 patches with $x = \{x_n\} \in \mathbb{R}^{N \times D}$21 expert acceptance and yields average reductions of $x = \{x_n\} \in \mathbb{R}^{N \times D}$22 in heap size and $x = \{x_n\} \in \mathbb{R}^{N \times D}$23 in binary size.

PatchPilot is an agentic patcher on SWE-bench that combines a rule-based pipeline—reproduction, localization, generation, validation, refinement—with LLM-based substeps and test-aware iterative refinement (Li et al., 4 Feb 2025). Its main reported results are $x = \{x_n\} \in \mathbb{R}^{N \times D}$24 on SWE-Bench-Lite at $x = \{x_n\} \in \mathbb{R}^{N \times D}$25 per instance and $x = \{x_n\} \in \mathbb{R}^{N \times D}$26 on SWE-Bench-Verified at $x = \{x_n\} \in \mathbb{R}^{N \times D}$27, with better stability and lower cost than several agent-based baselines.

Fund2Persona uses “patcher” in a non-code setting: an LLM policy-repair component edits a financial-advisor persona card using scorer diagnostics, actor rationales, and retrospective manager commentary, while preserving structure and avoiding memorization of tickers or one-off trades (Park et al., 29 Jun 2026). Relative to the initial unpatched persona, the patched system improves held-out holdings-transition reconstruction and manager-commentary alignment, including 3-class accuracy $x = \{x_n\} \in \mathbb{R}^{N \times D}$28 and Macro-F1 $x = \{x_n\} \in \mathbb{R}^{N \times D}$29.

Taken together, these systems show that patching in software and agentic settings is usually evidence-conditioned artifact revision. The target may be a TODO comment, a repository diff, a validation policy, or a persona markdown card, but the architecture repeatedly combines localization, constrained modification, and explicit acceptance gates.

7. Comparative interpretation and open technical problems

Across these literatures, patchers are defined less by domain than by a common operational pattern: they target a localized failure carrier and try to repair it without globally relearning the system. In MultiToP the carrier is an unreliable visual token span; in EntroPE or ReinPatch it is the patch-boundary policy; in Paxion, SHIELD, and Transformer-Patcher it is a compact external or last-layer module; in the backdoor and malicious-finetuning defenses it is an attack direction or trigger-response association; in software systems it is a bounded artifact plus a validation loop.

This suggests a useful taxonomy along two axes. The first is the object being patched: tokens, boundaries, features, weights, prompts, comments, code, or policies. The second is the evidence source: answer-conditioned attention, conditional entropy, IVP dynamics, action-antonym negatives, adversarial queries, runtime divergences, CVE retrieval, profiling traces, or validation/test failures. The strongest systems tend to bind these two tightly. MultiToP uses answer-conditioned frame information to supervise token replacement (Gao et al., 10 Jun 2026); ContraFix uses contrastive runtime evidence to derive repair specifications (Liu et al., 17 May 2026); MOA uses profiling-derived anti-patterns plus synthesized static checkers (Liang et al., 30 Jun 2026); the post-hoc backdoor Patcher uses a single failure case plus gradient saliency and KL anchoring (Gao et al., 2 Jun 2026).

The main unresolved issues are also recurrent. Several papers identify fixed budgets or fixed heuristics as bottlenecks: MultiToP notes that a fixed replacement budget $x = \{x_n\} \in \mathbb{R}^{N \times D}$30 may be suboptimal per sample (Gao et al., 10 Jun 2026); EntroPE highlights heuristic thresholding and non-differentiable boundary detection (Abeywickrama et al., 30 Sep 2025); ReinPatch addresses this with RL but still notes approximate causal-budget control at inference (Wu et al., 27 Mar 2026). Robust verification remains another fault line: AutoPatch and PatchPilot rely on LLM-guided or test-based validation rather than full formal verification (Seo et al., 7 May 2025, Li et al., 4 Feb 2025), while MOA reports LSP-based validation and expert acceptance rather than full CI- or theorem-level guarantees (Liang et al., 30 Jun 2026). In safety settings, both malicious-finetuning defense and post-hoc backdoor repair explicitly acknowledge stronger adaptive attacks or fully novel attack classes as remaining challenges (Wen et al., 6 Jun 2026, Gao et al., 2 Jun 2026).

A final misconception is that “patcher” names a single established architectural family. The literature does not support that reading. Instead, the term has become a general label for targeted repair operators that preserve a large surrounding system while modifying a strategically chosen subspace, interface, or artifact. In that sense, the Visual Token Patcher of MultiToP is one highly developed instance, not the sole meaning of the term (Gao et al., 10 Jun 2026).