FocalVulNORM: Focal Attention for Normatively Conditioned Vulnerability Repair with Multi-Task Verification

Vulnerable-code auditing is critical within the Software Development Life Cycle (SDLC) as timely remediation reduces exploitation risks from sensitive-data exposure to full system compromise. Although Automatic Program Repair (APR) has advanced through Machine Learning (ML), Deep Learning (DL), and Transformer-based generative models, current approaches remain limited by reduced language coverage, weak grounding in documented vulnerabilities, incomplete patch validation, and lack of explicit normative guidance for secure-coding compliance. This study introduces FocalVulNORM, a normatively conditioned Multi-Task repair model that generates a secure patch from vulnerable code while simultaneously verifying whether the vulnerable pattern is removed, the patch preserves observable behavior, and the repair aligns with the applicable security control. FocalVulNORM uses a shared Transformer encoder, a Focal Attention Layer, and four jointly optimized objectives: Repair, Detection, Normative Compliance, and Semantic Equivalence. The normative text is derived from CWE descriptions and SDLC secure-coding guides and standards, providing the security condition used to guide and evaluate each repair. Using this normative input, FocalVulNORM is trained on 11,503 vulnerability–patch pairs across seven programming languages and eight Common Weakness Enumeration (CWE) types. The model achieves CodeBLEU =0.8247 and Token-Level Accuracy (TLA) =0.8976 for Repair, F1=0.9926 for Detection, F1=0.9820 for Normative Compliance, and F1=0.9921 for Semantic Equivalence. The results indicate that FocalVulNORM extends APR beyond patch generation by attaching each repair to explicit evidence of vulnerability removal, behavioral preservation, and security-control alignment.