Program vulnerability detection method based on redundant semantic compression and large language model enhancement

Abstract

The invention relates to a program vulnerability detection method based on redundant semantic compression and large language model enhancement, which comprises the following steps of: mapping an input source code into a semantic space, and dividing the semantic space into a functional semantic subspace and a redundant semantic subspace; guiding the large language model to automatically execute at least one of variable rewriting, redundant statement deletion and control structure replacement based on a predefined cue word; on the code samples subjected to semantic cleaning, enabling the large language model to generate function-related natural language descriptions through few sample prompt, encoding the generated natural language descriptions into vectors through a text embedding model, and performing feature fusion with original code embedding to obtain enhanced features; and inputting the enhanced features into a downstream deep learning vulnerability detection model, and realizing robust defense for backdoor attacks in training and reasoning. Compared with the prior art, the method has the advantages that the robustness of the vulnerability detection model to redundant semantics is improved under the condition that expert rules are not needed, the accuracy of the vulnerability detection model is effectively enhanced, and the success rate of backdoor attacks is reduced.

Description

Technical Field

[0001] This invention relates to the fields of software vulnerability detection and network security protection, and in particular to a method for detecting program vulnerabilities based on redundant semantic compression and large language model enhancement. Background Technology

[0002] With the widespread application of deep learning technology in software security, neural network-based vulnerability detection methods have gradually become a research hotspot. These methods can automatically extract features from source code end-to-end, demonstrating significant advantages in cross-platform vulnerability identification. However, existing deep learning detection models are highly sensitive to redundant semantics such as code style, variable naming, comments, and irrelevant logic, making them vulnerable to exploitation by attackers to launch backdoor attacks. Attackers typically embed triggers into functionally equivalent code snippets containing redundant semantics, such as inserting unused variables, adding redundant functions, introducing specially formatted comments, or employing structural obfuscation. These backdoor triggers do not affect the normal function of the program but can manipulate the model output when specific conditions are met, exhibiting strong concealment and harmfulness.

[0003] To address the aforementioned risks, existing optimization methods primarily rely on manually written rules or static analysis tools to clean and normalize source code. However, these methods have significant shortcomings: firstly, rule design depends on expert experience, making it difficult to cover complex and diverse attack methods; secondly, static analysis is time-consuming and lacks versatility, making it unsuitable for large-scale software code auditing scenarios across platforms and projects. Furthermore, traditional data preprocessing methods often neglect the compensation of function-related semantics, leading to performance degradation of the detection model after cleaning and even new false positives.

[0004] Chinese patent CN117494131A discloses an improved vulnerability detection method based on a large language model, which solves the technical problems of low accuracy and efficiency in traditional vulnerability detection methods. The technical solution includes the following steps: constructing a vulnerability dataset; dividing the dataset into training, validation, and test sets; extracting semantic features using the CodeT5 model; obtaining the top k candidate codes most similar to the target code in the dataset by calculating semantic similarity; fusing the lexical and syntactic similarity of the candidate codes and the target code to obtain a mixed score; adding identity information hints and domain information hints; and providing the hints, target code, graph structure data, and the most similar examples to the large language model. However, this method is susceptible to interference from non-functional code such as comments, logs, and unused variables during analysis, affecting the accuracy of detection. Furthermore, the model lacks robustness and defense mechanisms against backdoor attacks, making it difficult to cope with backdoor attacks that inject specific redundant code to trigger incorrect model judgments.

[0005] In summary, existing vulnerability detection methods lack effective automated defense mechanisms against redundant semantic backdoor attacks. How to weaken the consistency of potential triggers while ensuring the integrity of functional semantics and improving the generalization ability of detection models has become a key issue that urgently needs to be addressed. Summary of the Invention

[0006] The purpose of this invention is to provide a program vulnerability detection method based on redundant semantic compression and large language model enhancement. This method can automatically compress exploitable redundant semantics, compensate for functional semantic loss, and enhance the robustness of the detection model without the need for expert rules. This will efficiently and adaptively reduce the success rate of backdoor attacks and improve the accuracy and generalization ability of vulnerability detection.

[0007] The objective of this invention can be achieved through the following technical solutions: A method for detecting program vulnerabilities based on redundant semantic compression and large language model enhancement includes the following steps: Semantic modeling: The input source code is mapped to a semantic space, which is divided into a functional semantic subspace and a redundant semantic subspace. The functional semantic subspace carries the logical features related to the vulnerability, including key function calls, conditional branches and memory operations. The redundant semantic subspace contains non-functional elements, including comments, printed logs, unused variables and useless functions. Semantic cleaning: Based on predefined prompt words, guide a large language model to automatically perform at least one of variable rewriting, redundant statement deletion, and control structure replacement; Semantic expansion and fusion: This includes two parts: semantic expansion and feature fusion. On the code samples after semantic cleaning, a small sample prompt is used to enable the large language model to generate function-related natural language descriptions. The generated natural language descriptions are encoded into vectors by a text embedding model and then fused with the original code embeddings to obtain enhanced features. Vulnerability detection: Enhanced features are input into the downstream deep learning vulnerability detection model to achieve robust defense against backdoor attacks during training and inference.

[0008] The semantic modeling includes the following steps: Data Acquisition: For different target source code repositories and vulnerability detection tasks, sample function-level or file-level source code samples from public datasets and enterprise-level code repositories; Data preprocessing: The source code samples are parsed and represented in a structured manner at different levels. First, the source code samples undergo lexical analysis, breaking the program down into basic token units and cleaning up irrelevant spaces, newlines, and comment symbols. Then, based on the lexical units, syntax parsing is performed to construct an abstract syntax tree, organizing key syntax units into parent-child node relationships. Subsequently, the dependencies in the program during execution are further extracted, and control flow graphs and data flow graphs are constructed. The parsed code semantics are divided into functional semantic subspaces and redundant semantic subspaces. The data in the two subspaces are normalized and numericalized. Finally, each sample is converted into a structured matrix or graph representation. Data fusion: Jointly model and fuse semantic representations at different levels, uniformly encode the token embeddings obtained at the statement level of the source code and the graph embeddings extracted at the structural level through the abstract syntax tree, and construct a fusion vector as a feature representation in the subspace for subsequent input; Support set and query set splitting: The dataset consisting of data after data preprocessing and data fusion is split into a support set and a query set. The support set is used for fast model adaptation and parameter initialization, while the query set is used for validation and gradient update.

[0009] The normalization and numericalization processes specifically involve mapping all symbolic fields to indexes or embedding vectors; and simplifying non-numerical strings into computable dictionary indices.

[0010] The semantic cleaning is driven by three types of prompt word templates, corresponding to three types of semantic cleaning operations: Variable rewriting: By unifying variable naming and rewriting semantically equivalent expressions, attackers can disrupt triggering patterns that rely on specific naming rules. Redundant statement removal: Identify and remove comments, print statements, unused variables and other irrelevant logic through a large language model, reducing the embedding channels of backdoor triggers; Control structure replacement: Equivalent rewriting of loop logic structures, or flattening of deeply nested structures to increase cross-sample structural differences; The three types of cleaning operations are combined and executed in a randomized manner to ensure the differences between different samples and to prevent the formation of new fixed patterns.

[0011] The semantic cleaning process is defined as follows: , in, Represents the functional semantic subspace, Represents a redundant semantic subspace. This indicates a slight loss of functional semantics. This represents the amount of compression for redundant semantics. Represents the original semantic space. Represents the cleaned semantic space. This represents the mapping function corresponding to semantic cleaning.

[0012] The process of semantic expansion is defined as follows: , in, This represents the functional semantic subspace after semantic cleaning. This represents the redundant semantic subspace after semantic cleaning. This refers to the semantic compensation brought about by natural language descriptions generated through large language models. This represents the unstructured random increments generated by the large language model. Represents the cleaned semantic space. Represents the semantic space after semantic expansion. This represents the mapping function corresponding to the semantic extension.

[0013] In the process of semantic expansion and fusion, different feature fusion methods with different granularities are used for different models: For graph neural networks, statement-level description concatenation is used to jointly encode each code statement with its corresponding natural language description into node features; For Transformer-based models, function-level description concatenation is used. At the overall function level, the natural language functional description is combined with the overall code embedding representation. The natural language description vector is introduced as a prefix token or additional channel and encoded together with the code sequence.

[0014] The feature fusion is represented as follows: , in, The first after cleaning A semantic fragment, For the first Natural language descriptions corresponding to each semantic fragment For embedded functions, Number of code snippets This represents the enhanced feature set after fusion.

[0015] The enhanced features, after being input into the downstream deep learning vulnerability detection model, serve as node features in the graph structure model and as function-level features in the language model.

[0016] The method supports three configurations during training and selects the optimal one during the validation phase: Enabling semantic cleaning only primarily reduces the success rate of attacks; Enabling semantic extension only primarily improves classification performance; Simultaneously enabling semantic cleaning and semantic expansion achieves the best balance between robustness and performance.

[0017] The method uses attack success rate and accuracy as core defense metrics during training and evaluation. The attack success rate is defined as follows: , in, This indicates the number of attack samples that were successfully misled. Indicates the total number of attack samples; When the criterion is met When the defense is deemed effective, then, This indicates the recall rate.

[0018] Compared with the prior art, the present invention has the following beneficial effects: (1) This invention proposes a semantic cleaning mechanism for backdoor protection of program vulnerability detection model, which can automatically identify and clean redundant semantic fragments in source code, such as variable renaming, redundant functions and structural obfuscation, thereby effectively breaking the cross-sample consistency of backdoor triggers. Even when there are very few attack samples or the triggers are highly concealed, it can still significantly reduce the success rate of backdoor attacks.

[0019] (2) This invention establishes a program code semantic extension mechanism driven by a large language model, which compensates for the functional semantics that may be lost after cleaning and embeds them with the original code to ensure that the detection model does not damage the vulnerability-related features while removing redundant information. The optimized model has a stable improvement in accuracy, recall and F1 score, and is suitable for deployment in various datasets and different architectures.

[0020] (3) This invention uses a unified prompt word template to replace traditional manual rules and static analysis tools, which can achieve general preprocessing across projects and datasets without writing expert rules, greatly reducing manual costs, while having stronger scalability and adaptability.

[0021] (4) Experimental results of this invention on public datasets such as CodeXGLUE and DiverseVul show that the success rate of backdoor attacks can be reduced by up to 73.77%, while maintaining an improvement of at least 2% in model classification accuracy, which proves its effectiveness in defending against multiple redundant semantic triggers and improving the generalization ability of the model. Attached Figure Description

[0022] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is an example diagram of semantic cleaning in this invention; Figure 3 This is a diagram illustrating the overall framework structure of the present invention; Figure 4 This is a schematic diagram of the semantic space modeling of the present invention; Figure 5 This is a schematic diagram illustrating the changes in attack success rate and classification performance of the method of the present invention on different detection models; Figure 6 This is a comparison chart of the defense performance of the present invention and the original CodeBERT model; Figure 7 This is a comparison chart of the defense performance of the present invention and the original Devign model. Detailed Implementation

[0023] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. These embodiments are based on the technical solution of the present invention and provide detailed implementation methods and specific operating procedures. However, the scope of protection of the present invention is not limited to the following embodiments.

[0024] This embodiment provides a program vulnerability detection method based on redundant semantic compression and large language model enhancement, such as... Figure 1 As shown, it includes the following steps: Step 1) Semantic Modeling: Map the input source code to a semantic space, and divide it into a functional semantic subspace and a redundant semantic subspace. The functional semantic subspace carries the vulnerability-related logical features, including key function calls, conditional branches and memory operations. The redundant semantic subspace contains non-functional elements, including comments, printed logs, unused variables and useless functions.

[0025] The core of this step lies in converting the original source code sample into a semantic representation that can be further cleaned and expanded. Unlike traditional single code parsing methods, this invention not only performs lexical and structural processing on the code but also explicitly distinguishes between two subspaces: functional semantics and redundant semantics. The functional semantic subspace carries key features related to the vulnerability logic, while the redundant semantic subspace contains components unrelated to program logic, such as comments, variable names, and redundant functions, which are the main avenues for attackers to embed backdoor triggers. By acquiring, preprocessing, fusing, and partitioning the data into support and query sets, the semantic cleansing and expansion functions can be fully utilized in subsequent training, thereby improving the robustness and generalization ability of the detection model against potential backdoor attacks.

[0026] Step 1-1) Data Acquisition Specifically, this embodiment samples function-level or file-level source code samples from public datasets (such as CodeXGLUE and DiverseVul) and enterprise-level code repositories for different target source code libraries and vulnerability detection tasks. To verify the effectiveness of the defense method, adversarial samples containing backdoor triggers are also constructed. Trigger embedding methods include variable renaming, insertion of ternary operations, redundant function injection, and control structure obfuscation. Therefore, this method can resist multiple types of redundant semantic triggers, covering various attack methods from shallow to deep layers. (1) Variable renaming triggers are embedded through a unified or specialized naming method; (2) Insert a ternary flip-flop, which is formed by inserting a logically equivalent but specially formed conditional expression; (3) Redundant function injection triggers mislead the model by adding non-functional or dead code functions; (4) Structure confusion triggers are constructed by replacing the control structure (such as replacing the for loop with the while loop).

[0027] This method eliminates the need for expert-written rules, automatically identifying and cleaning triggers through LLM, thus demonstrating cross-trigger category versatility. This ensures the training set includes both fully functional normal samples and anomalous samples that may hide triggers. All samples are labeled for vulnerability detection, used for subsequent training and evaluation.

[0028] Steps 1-2) Data Preprocessing 1. Code structuring In this embodiment, the original source code text is first parsed and structurally represented layer by layer. Specifically, after input, the source code file undergoes lexical analysis, breaking the program down into basic token units such as keywords, identifiers, constants, operators, and delimiters. Irrelevant spaces, newlines, and comment symbols are cleaned up to ensure the consistency and computability of the resulting token sequence in subsequent processing. Then, based on the lexical units, syntax parsing is performed to construct an Abstract Syntax Tree (AST). This tree can characterize the program structure hierarchically, organizing key syntactic units such as conditional statements, loop statements, and function calls into parent-child node relationships, thus intuitively reflecting the program's logical semantics. Building upon this, this embodiment further extracts the dependencies during program execution, constructing a Control Flow Graph (CFG) and a Data Flow Graph (DFG). The CFG describes the execution order and control conditions of the code under different paths, revealing potential branching and loop structures, while the DFG captures the dependency chains between variables and operands, reflecting the transmission process between input data, intermediate computation results, and output results. Through this series of processes, the original text code is transformed into a multimodal structured representation that retains the symbolic features of the source code at the lexical level while incorporating the semantic logic, control, and data dependency information at the syntactic level. This provides a high-quality, comprehensive, and robust input foundation for subsequent semantic cleaning, semantic expansion, and feature fusion.

[0029] 2. Semantic subspace partitioning In this embodiment, the parsed code semantics are further divided into two independent yet complementary subspaces: the functional semantic subspace and the redundant semantic subspace, expressed by the formula: Among them, the functional semantic subspace It primarily carries logical information closely related to vulnerability detection, such as critical statements involving memory operations and pointer handling, boundary conditions for checking and filtering external input, and code snippets calling sensitive APIs. This content directly determines whether a program has security vulnerabilities; while the redundant semantic subspace This includes components unrelated to the core logic of the program, such as developer comments, differences in variable naming styles, duplicate or unused helper functions, and log printing statements left over from debugging. While this information does not affect the program's functional correctness, it often becomes the primary location for backdoor attackers to embed triggers. This segmentation allows for the preservation and focused analysis of functionally relevant semantics during subsequent processing, while compressing and perturbing redundant semantics. This weakens the consistency of triggers across different samples, laying the foundation for robust backdoor defense.

[0030] 3. Normalization and numericalization All symbolic fields (such as variable names and function names) are mapped to indexes or embedding vectors; non-numeric strings are simplified to computable dictionary indices; and finally, each sample is converted into a structured matrix or graph representation for easier subsequent model processing.

[0031] Steps 1-3) Data Fusion In this invention, single code structure information is often insufficient to support comprehensive detection of backdoor triggers, because attackers may exploit redundant naming and comments at the lexical level, or conceal triggers through redundant functions and control flow obfuscation at the program structure level. Therefore, before proceeding to the semantic cleaning and expansion stages, it is necessary to jointly model and fuse semantic representations at different levels to obtain a more comprehensive and robust code feature representation. Specifically, the token obtained at the statement level of the source code is embedded... Compared with graph embeddings extracted at the structural level through an Abstract Syntax Tree (AST) Perform unified encoding and construct a fusion vector: in, This represents a vector concatenation operation. It is a sequence encoder based on a pre-trained language model (such as CodeBERT) that can extract lexical and contextual information from token sequences; This is a graph neural network (GNN)-based structural encoder that captures hierarchical dependencies and semantic relationships inherent in abstract syntax trees, control flow graphs, and data flow graphs. Through this complementary fusion of sequence and graph representations, the resulting unified vector z retains fine-grained symbolic features at the statement level while integrating structural-level control and data dependency information. This fusion strategy effectively overcomes the limitations of single representations, providing richer and more robust input features for subsequent semantic cleaning and expansion, thereby improving the model's detection capability and generalization performance when faced with diverse backdoor triggers.

[0032] Steps 1-4) Support set and query set splitting After completing data acquisition, preprocessing, and fusion, this invention further employs a meta-learning approach to divide the data into support and query sets to improve the model's generalization ability when facing scarce samples and unknown triggers. Specifically, the fused dataset is represented as... ,in To fuse feature vectors, The corresponding labels are used. When constructing tasks, each task is treated as a homogeneous T classification problem, but the number of samples in each category varies significantly. For example, in vulnerability detection scenarios, the number of normal samples is much greater than that of abnormal samples, while samples with specific backdoor triggers may be extremely rare. To address this imbalance, this invention splits the dataset into support sets. With query set Q and satisfy The support set is used for rapid model adaptation and parameter initialization, while the query set is used for validation and gradient updates, ensuring that the model converges not only on known classes but also maintains high recognition performance on unseen tasks. To further enhance the training stability of the model, this embodiment uses a task sampling method to decompose the original multi-class problem into multiple sub-tasks. For example, several 3-class sub-tasks are generated from a 5-class problem and reasonably allocated to the support set and query set according to the class distribution. Experiments show that this strategy can effectively alleviate the bias caused by sample imbalance, enabling the model to maintain a high recall rate even when detecting a very small number of backdoor-triggered samples, thereby improving overall robustness and generalization ability.

[0033] Step 2) Semantic cleaning: Based on predefined prompt words, guide the large language model to automatically perform at least one of variable rewriting, redundant statement deletion, and control structure replacement.

[0034] In this invention, considering that the redundant semantic subspace is the main location for attackers to embed backdoor triggers, the source code samples must be semantically cleaned before entering the downstream detection model to weaken the stability and consistency of the triggers across different samples. Specifically, semantic cleaning is driven by three types of prompt word templates, corresponding to three types of semantic cleaning operations: Variable rewriting: By unifying variable names and rewriting semantically equivalent expressions, including unifying or rewriting local variables, function names and identifiers, attackers can disrupt triggering patterns that rely on specific naming rules. Redundant statement removal: By identifying and removing comments, print statements, unused variables and other irrelevant logic through a large language model, the redundant semantic space is compressed and the embedding channels of backdoor triggers are reduced; Control structure replacement: Equivalent rewriting of loop logic structures, such as rewriting if-else statements into ternary operators, rewriting for loops into while loops, or flattening deeply nested structures to increase cross-sample structural differences, while ensuring functional equivalence. The above three types of operations can be used individually or in random combinations to ensure the differences between different samples and prevent the formation of new fixed patterns.

[0035] The semantic cleaning process described above is defined as a mapping function: , in, Represents the functional semantic subspace, Represents a redundant semantic subspace. This indicates a slight loss of functional semantics. This represents the amount of compression for redundant semantics. Represents the original semantic space. Represents the cleaned semantic space. This represents the mapping function corresponding to semantic cleaning.

[0036] An example of semantic cleaning prompt words is as follows: Figure 2 As shown.

[0037] In this embodiment, to ensure that the program's functionality is not compromised during the cleaning operation, unit testing or differential execution methods are used to verify the consistency of the program output before and after cleaning. If the equivalence verification fails, the program reverts to a weaker transformation or the original sample. Through this step, the redundant semantic space is significantly compressed, and the fixed patterns of potential triggers are fully broken down, providing a clean and robust input foundation for subsequent semantic expansion and feature fusion.

[0038] Step 3) Semantic expansion and fusion: This includes two parts: semantic expansion and feature fusion. On the code samples after semantic cleaning, the large language model generates function-related natural language descriptions through few-sample prompts. The generated natural language descriptions are encoded into vectors by the text embedding model and then fused with the original code embeddings to obtain enhanced features.

[0039] In this invention, since semantic cleaning may cause the loss of some functional semantics while compressing redundant space, it is necessary to further extend the semantics based on the cleaning results to compensate for the slight loss of functional semantics and enhance vulnerability-related features. Specifically, such as... Figure 3 As shown, this embodiment utilizes a large language model with few-shot prompting to generate a natural language description related to the function of the input cleaned code snippet. This description focuses on characterizing the program's key behaviors, such as input checking, memory management, sensitive API calls, and conditional branching logic, thereby supplementing the code representation with potential vulnerability semantics in a more intuitive form. The generated description is encoded into a vector using a text embedding model, and subsequently concatenated or gatedly fused with the original code embedding to form an enhanced feature representation. The semantic expansion process can be formalized as a mapping function: , in, This represents the functional semantic subspace after semantic cleaning. This represents the redundant semantic subspace after semantic cleaning. This refers to the semantic compensation provided by the natural language description generated through a large language model, which is used to restore and enhance vulnerability-related features. This represents the unstructured random increments generated by the large language model, indicating the potential introduction of weakly correlated noise. Represents the cleaned semantic space. Represents the semantic space after semantic expansion. This represents the mapping function corresponding to the semantic extension.

[0040] Guarantee through Prompt constraints and semantic filtering mechanisms To take the lead and avoid The residual patterns in the code lead to the systematic recovery of triggers. In specific implementations, for graph neural networks (such as the Devign model), natural language descriptions are matched and concatenated with statement-level code fragments; that is, features are concatenated at the statement level and used as node inputs for propagation and aggregation on the graph structure. For Transformer-based models (such as CodeBERT and ReGVD), joint encoding is performed at the function level with the overall code embedding. This involves introducing natural language description vectors as prefix tokens or additional channels, co-encoding them with the code sequence to ensure that the fused features match the architectural granularity. Through this step, potentially damaged functional semantics after cleaning are compensated, and the code representation is expanded and enhanced at the feature level, ultimately significantly improving the downstream detection model's attention to vulnerability-related patterns and its robustness against backdoor attacks.

[0041] The feature fusion process can be represented as: , in, The first after cleaning A semantic fragment, For the first Natural language descriptions corresponding to each semantic fragment For embedded functions, Number of code snippets This represents the enhanced feature set after fusion. Embed vectors for code, The embedding vectors are described in natural language. They are combined through concatenation or gating mechanisms to ensure that functional semantics are enhanced and redundant semantics are sufficiently weakened. To avoid dimensionality imbalance caused by features of different scales after concatenation, this embodiment introduces normalization and dimensionality reduction operations during the fusion process. For example, LayerNorm or linear projection is used to map the concatenated vectors to a unified latent space.

[0042] Figure 4 This is a schematic diagram of the semantic space modeling of the present invention, illustrating the spatial changes in code semantics before and after cleaning and expansion.

[0043] Step 4) Vulnerability detection: Input the enhanced features into the downstream deep learning vulnerability detection model to achieve robust defense against backdoor attacks during training and inference.

[0044] This invention does not impose any limitations on the downstream detection architecture.

[0045] This method supports three configurations during training and selects the optimal one during the validation phase: Enabling semantic cleaning only primarily reduces the success rate of attacks; Enabling semantic extension only primarily improves classification performance; Simultaneously enabling semantic cleaning and semantic expansion achieves the best balance between robustness and performance.

[0046] Finally, the fused enhanced features are fed into the classifier for training and inference, and the classifier outputs the probability distribution of each sample belonging to the vulnerability class or the non-vulnerability class.

[0047] To ensure the reliability of detection performance, this invention uses cross-entropy as the basic loss function and combines it with metrics such as attack success rate (ASR) and accuracy (ACC) to comprehensively evaluate the model. , in, This indicates the number of attack samples that were successfully misled. Indicates the total number of attack samples; When the criterion is met When the defense is deemed effective, then, This indicates the recall rate.

[0048] Through the aforementioned feature fusion and detection steps, the model can significantly reduce the success rate of backdoor attacks while maintaining high accuracy. Experimental results on datasets such as CodeXGLUE and DiverseVul show that the present invention can achieve at least 2% performance improvement on both Devign and CodeBERT, two mainstream architectures, and reduce the attack success rate by up to 73.77%, thus proving the universality and robustness of the solution.

[0049] Figure 5The experimental performance comparison chart shows the changes in attack success rate and classification performance on different detection models after applying the method proposed in this invention. The confidence interval (i.e., probability value) of the original Devign model is mainly distributed in the interval [0.1, 0.4], the confidence interval (i.e., probability value) of the original CodeBERT model is mainly distributed in the intervals [0, 0.4] and [0.6, 0.8], after using this invention, the confidence interval of the Devign model is mainly distributed in the interval [0.4-1.0], and the confidence interval of the CodeBERT model is mainly distributed in the interval [0.7-1.0]. This shows that this invention can effectively improve the adversarial robustness of the model.

[0050] Figure 6 and Figure 7 The diagram illustrates the defensive performance of this invention under different triggers, including variable renaming, ternary operation insertion, redundant function injection, and structural obfuscation. Module A (semantic cleaning) simplifies the semantic space by removing irrelevant and redundant information, while module B (semantic expansion and fusion) enhances the model's predictive ability by enriching semantic representations. However, it should be noted that the performance of using both modules together is slightly lower than using module B alone, because excessive compression of the semantic space can hinder the model's classification ability. Modules A and B complement each other, and their combined use can achieve a balanced improvement in both the model's defensive performance and accuracy.

[0051] In summary, this example achieves efficient defense against potential backdoor triggers in source code by sequentially executing four core steps: semantic modeling, semantic cleaning, semantic expansion, and feature fusion and detection. First, semantic modeling maps the original source code into two subspaces: functional semantics and redundant semantics, thus clarifying the possible embedding locations of triggers. Second, semantic cleaning, while maintaining the correctness of program functionality, automatically performs variable rewriting, redundant statement deletion, and control structure replacement through a large language model, effectively compressing the redundant semantic space and breaking down trigger consistency. Third, semantic expansion utilizes few-sample hints to generate functional natural language descriptions, compensating for functional semantics that may have been lost during cleaning and enhancing vulnerability-related features. Finally, feature fusion uniformly encodes the code and natural language descriptions, and inputs them into classifiers using a fusion method matching the granularity in different detection architectures, achieving robust vulnerability detection and backdoor defense. Experimental results show that the present invention can generally improve detection performance on mainstream datasets such as CodeXGLUE and DiverseVul, and achieves a significant reduction in attack success rate of up to 73.77% under three architectures: Devign, CodeBERT, and ReGVD. This demonstrates the universality, robustness, and practical value of the proposed method under different models and scenarios.

[0052] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.

Claims

1. A program vulnerability detection method based on redundant semantic compression and large language model enhancement, characterized in that, The method comprises the following steps: Semantic modeling: mapping input source code into a semantic space and dividing it into a functional semantic subspace and a redundant semantic subspace, wherein the functional semantic subspace carries vulnerability-related logical features, including key function calls, conditional branches and memory operations, and the redundant semantic subspace contains non-functional elements, including comments, print logs, unused variables and useless functions; Semantic cleaning: based on predefined prompt words, guiding a large language model to automatically perform at least one of variable rewriting, redundant statement deletion and control structure replacement; Semantic extension and fusion: including two parts of semantic extension and feature fusion, on the code samples after semantic cleaning, a large language model is used to generate a function-related natural language description through a few-shot prompt, the generated natural language description is encoded into a vector by a text embedding model, and the vector is fused with the original code embedding to obtain enhanced features; Vulnerability detection: inputting the enhanced features into a downstream deep learning vulnerability detection model to realize robust defense against backdoor attacks in training and inference.

2. The program vulnerability detection method based on redundant semantic compression and large language model enhancement according to claim 1, characterized in that, The semantic modeling comprises the following steps: Data acquisition: sampling function-level or file-level source code samples from public data sets and enterprise-level code repositories for different target source code libraries and vulnerability detection tasks; Data preprocessing: performing hierarchical parsing and structured representation on the source code samples: the source code samples are first subjected to lexical analysis to disassemble the program into basic token units, while cleaning irrelevant spaces, line breaks and comment symbols; then, syntax analysis is performed on the basis of the lexical units to construct an abstract syntax tree, and key syntax units are organized into parent-child node relationships; thereafter, the dependency relationships in the execution process of the program are further extracted to construct a control flow graph and a data flow graph; the parsed code semantics are divided into a functional semantic subspace and a redundant semantic subspace, and the data in the two subspaces after division are normalized and numerized, and all symbolic fields are mapped into index or embedding vectors; non-numeric string is simplified into a calculable dictionary index, and finally each sample is converted into a structured matrix or graph representation; Data fusion: joint modeling and fusion of different levels of semantic representation, unified coding of token embedding obtained at the statement level and graph embedding extracted through the abstract syntax tree at the structure level, and construction of a fusion vector as a feature representation in the subspace for subsequent input; Support set and query set splitting: splitting the data set formed by the data after data preprocessing and data fusion into a support set and a query set, wherein the support set is used for fast adaptation and parameter initialization of the model, and the query set is used for verification and gradient update.

3. The program vulnerability detection method based on redundant semantic compression and large language model enhancement according to claim 1, characterized in that, The semantic cleaning is driven by three types of prompt word templates, corresponding to three types of semantic cleaning operations: Variable rewriting: through variable naming unification and semantic equivalent expression rewriting, the trigger mode dependent on specific naming rules of the attacker is destroyed; Redundant statement deletion: through a large language model, comments, print statements, unused variables and other irrelevant logic are identified and removed, reducing the embedding channel of the backdoor trigger; Control structure replacement: equivalent rewriting of loop logic structure, or flattening of deeply nested structures, increasing cross-sample structural differences; The three types of cleaning operations are combined in a randomized manner to ensure differences between different samples and prevent the formation of new fixed patterns.

4. The program vulnerability detection method based on redundant semantic compression and large language model enhancement according to claim 1, characterized in that, The process of semantic cleaning is defined as: ， wherein, represents a functional semantic subspace, represents a redundant semantic subspace, represents a slight loss of functional semantics, represents a compression amount of redundant semantics, represents an original semantic space, represents a cleaned semantic space, represents a mapping function corresponding to semantic cleaning.

5. The program vulnerability detection method based on redundant semantic compression and large language model enhancement according to claim 1, characterized in that, The process of semantic expansion is defined as: ， wherein, represents the functional semantic subspace after semantic cleaning, represents the redundant semantic subspace after semantic cleaning, represents the semantic compensation brought by the natural language description generated by the large language model, represents the unstructured random increment generated by the large language model, represents the cleaned semantic space, represents the semantic space after semantic expansion, represents the mapping function corresponding to semantic expansion.

6. The program vulnerability detection method based on redundant semantic compression and large language model enhancement according to claim 1, characterized in that, In the process of semantic expansion and fusion, different feature fusion methods are used for different downstream deep learning vulnerability detection models: For graph neural networks, sentence-level description splicing is used to jointly encode each code statement and the corresponding natural language description as node features. For Transformer-based models, function-level description splicing is used to jointly encode natural language function descriptions and code embedding representations at the function level, and natural language description vectors are introduced as prefix tokens or additional channels for joint coding with code sequences.

7. The program vulnerability detection method based on redundant semantic compression and large language model enhancement according to claim 1, characterized in that, The feature fusion is represented as: ， in, The first after cleaning A semantic fragment, For the first Natural language descriptions corresponding to each semantic fragment For embedded functions, Number of code snippets This represents the enhanced feature set after fusion.

8. The program vulnerability detection method based on redundant semantic compression and large language model enhancement according to claim 1, characterized in that, After inputting the enhanced features into the downstream deep learning vulnerability detection model, they are used as node features in graph structure models and function-level features in language models.

9. The program vulnerability detection method based on redundant semantic compression and large language model enhancement according to claim 1, characterized in that, The method supports three configurations during training and selects the best one during the validation phase: Only enable semantic cleaning, mainly to reduce the success rate of attacks; Only enable semantic expansion, mainly to improve classification performance; Enable semantic cleaning and semantic expansion at the same time to achieve the best balance between robustness and performance.

10. The program vulnerability detection method based on redundant semantic compression and large language model enhancement according to claim 1, characterized in that, During the training and evaluation process, attack success rate and accuracy are used as core defense indicators, where the attack success rate is defined as: ， wherein, represents the number of attack samples successfully misled, represents the total number of attack samples; When the criterion is satisfied, the defense is determined to be effective, wherein, denotes the recall rate.

Images