Assessing Robustness of ML-Based Program Analysis Tools using Metamorphic Program Transformations

Applis, L.H.; Panichella, Annibale; Deursen, Arie van

doi:10.1109/ase51524.2021.9678706

Cited by 20 publications

(12 citation statements)

References 22 publications

(22 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There are 196 C code snippets that satisfy the aforementioned constraints. We compute a statistically representative sample size using a popular sample size calculator 5 with a confidence level at 99% and a confidence interval of 10. We sample 100 code snippets to conduct the user study, which is statistically representative.…”

Section: Rq1 How Natural Are the Adversarial Examples Generated By Al...mentioning

confidence: 99%

See 1 more Smart Citation

Natural Attack for Pre-trained Models of Code

Yang,

Shi,

et al. 2022

Preprint

View full text Add to dashboard Cite

Pre-trained models of code have achieved success in many important software engineering tasks. However, these powerful models are vulnerable to adversarial attacks that slightly perturb model inputs to make a victim model produce wrong outputs. Current works mainly attack models of code with examples that preserve operational program semantics but ignore a fundamental requirement for adversarial example generation: perturbations should be natural to human judges, which we refer to as naturalness requirement.In this paper, we propose ALERT (Naturalness Aware Attack), a black-box attack that adversarially transforms inputs to make victim models produce wrong outputs. Different from prior works, this paper considers the natural semantic of generated examples at the same time as preserving the operational semantic of original inputs. Our user study demonstrates that human developers consistently consider that adversarial examples generated by ALERT are more natural than those generated by the state-of-the-art work by Zhang et al. that ignores the naturalness requirement. On attacking CodeBERT, our approach can achieve attack success rates of 53.62%, 27.79%, and 35.78% across three downstream tasks: vulnerability prediction, clone detection and code authorship attribution. On GraphCodeBERT, our approach can achieve average success rates of 76.95%, 7.96% and 61.47% on the three tasks. The above outperforms the baseline by 14.07% and 18.56% on the two pretrained models on average. Finally, we investigated the value of the generated adversarial examples to harden victim models through an adversarial fine-tuning procedure and demonstrated the accuracy of CodeBERT and GraphCodeBERT against ALERT-generated adversarial examples increased by 87.59% and 92.32%, respectively. CCS CONCEPTS• Software and its engineering → Software testing and debugging; Search-based software engineering; • Computing methodologies → Neural networks.

show abstract

Section: Rq1 How Natural Are the Adversarial Examples Generated By Al...mentioning

confidence: 99%

“…Pour et al [34] proposed a testing framework for DNN of source code embedding, which can decrease the performance of code2vec [3] on method name prediction task by 2.05%. Applis et al [5] use metamorphic program transformations to assess the robustness of ML-based program analysis tools in a black-box manner.…”

Section: Adversarial Attack On Models Of Codementioning

confidence: 99%

Natural Attack for Pre-trained Models of Code

Yang,

Shi,

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…Therefore, semantic tasks should use upper-level layers to represent code to achieve the best performance. Interestingly, the performance remains uniform in the middle layers (4)(5)(6)(7)(8)(9)(10). This can be related to the uniform attention of identifiers, values we see in the Figure 4.…”

Section: Semantic Representation Of Code For Code Clone Detection Usi...mentioning

confidence: 53%

“…They compare the performance of these models from the perspective of probing classifiers. Other studies [5,9,35,49], show that identifiers are important code entities and can be used in the modeling of Transfoemr based models. This work presents the first study in software engineering, which analyses the multi-headed attention framework of BERT, which is not done previously [21].…”

Section: Related Workmentioning

confidence: 99%

An Exploratory Study on Code Attention in BERT

Sharma¹,

Chen²,

Fard³

et al. 2022

Preprint

View full text Add to dashboard Cite

Many recent models in software engineering introduced deep neural models based on the Transformer architecture or use transformerbased Pre-trained Language Models (PLM) trained on code. Although these models achieve the state of the arts results in many downstream tasks such as code summarization and bug detection, they are based on Transformer and PLM, which are mainly studied in the Natural Language Processing (NLP) field. The current studies rely on the reasoning and practices from NLP for these models in code, despite the differences between natural languages and programming languages. There is also limited literature on explaining how code is modeled.Here, we investigate the attention behavior of PLM on code and compare it with natural language. We pre-trained BERT, a Transformer based PLM, on code and explored what kind of information it learns, both semantic and syntactic. We run several experiments to analyze the attention values of code constructs on each other and what BERT learns in each layer. Our analyses show that BERT pays more attention to syntactic entities, specifically identifiers and separators, in contrast to the most attended token [CLS] in NLP. This observation motivated us to leverage identifiers to represent the code sequence instead of the [CLS] token when used for code clone detection. Our results show that employing embeddings from identifiers increases the performance of BERT by 605% and 4% F1score in its lower layers and the upper layers, respectively. When identifiers' embeddings are used in CodeBERT, a code-based PLM, the performance is improved by 21-24% in the F1-score of clone detection. The findings can benefit the research community by using code-specific representations instead of applying the common embeddings used in NLP, and open new directions for developing smaller models with similar performance.

show abstract

“…Rabin et al [31] evaluate whether neural program analyzers like GGNN [30] can generalize to programs modified using semantic preserving transformations. Applis et al [55] extend metamorphic testing approaches for DNN models for software programs to evaluate the robustness of a codeto-text generation model. Pour et al [32] focus on the embeddings of source code and propose a search-based testing framework to evaluate their robustness.…”

Section: Attacking Code Modelsmentioning

confidence: 99%

Stealthy Backdoor Attack for Code Models

Zhang¹,

Xu²,

Zhang³

et al. 2023

Preprint

View full text Add to dashboard Cite

Code models, such as CodeBERT and CodeT5, offer general-purpose representations of code and play a vital role in supporting downstream automated software engineering tasks. Most recently, code models were revealed to be vulnerable to backdoor attacks. A code model that is backdoor-attacked can behave normally on clean examples but will produce pre-defined malicious outputs on examples injected with triggers that activate the backdoors. Existing backdoor attacks on code models use unstealthy and easy-to-detect triggers. This paper aims to investigate the vulnerability of code models with stealthy backdoor attacks. To this end, we propose AFRAIDOOR (Adversarial F eatur e as Adaptive Backdoor ). AFRAIDOOR achieves stealthiness by leveraging adversarial perturbations to inject adaptive triggers into different inputs. We evaluate AFRAIDOOR on three widely adopted code models (CodeBERT, PLBART and CodeT5) and two downstream tasks (code summarization and method name prediction). We find that around 85% of adaptive triggers in AFRAIDOOR bypass the detection in the defense process. By contrast, only less than 12% of the triggers from previous work bypass the defense. When the defense method is not applied, both AFRAIDOOR and baselines have almost perfect attack success rates. However, once a defense is applied, the success rates of baselines decrease dramatically to 10.47% and 12.06%, while the success rate of AFRAIDOOR are 77.05% and 92.98% on the two tasks. Our finding exposes security weaknesses in code models under stealthy backdoor attacks and shows that the state-of-the-art defense method cannot provide sufficient protection. We call for more research efforts in understanding security threats to code models and developing more effective countermeasures.

show abstract

Assessing Robustness of ML-Based Program Analysis Tools using Metamorphic Program Transformations

Cited by 20 publications

References 22 publications

Natural Attack for Pre-trained Models of Code

Natural Attack for Pre-trained Models of Code

An Exploratory Study on Code Attention in BERT

Stealthy Backdoor Attack for Code Models

Contact Info

Product

Resources

About