Large model-oriented adversarial sample iterative generation method

Abstract

The invention discloses a large model-oriented adversarial sample iterative generation method. The method comprises the following steps of: constructing a search space based on a candidate identifier index vector; generating an adversarial example by using a Bayesian optimization framework, and dynamically selecting an optimal candidate point through a Gaussian process proxy objective function; the candidate samples are subjected to diversity sampling in combination with a determinant point process, and it is ensured that the generated confrontation examples are wide in coverage range and high in aggressiveness; and the generation process is iteratively optimized, the direction is dynamically adjusted according to attack feedback, and the generation efficiency and success rate of the confrontation examples are gradually optimized. According to the invention, by combining feedback optimization and diversity sampling technologies, the local optimum problem and the efficiency difficulty in the existing adversarial example generation method are effectively solved. Experiments show that the generated adversarial example shows a remarkable attack effect in tasks such as vulnerability prediction, clone detection and code abstracting, the robustness of the depth code model can be fully tested, and technical support is provided for model improvement and optimization.

Description

Technical Field

[0001] The present invention relates to the field of security of large code models, and in particular to an iterative adversarial example generation method for deep code models. Background Art

[0002] Deep code models have made significant progress in recent years and have become an important tool in the field of software engineering. They are widely used in tasks such as code understanding and code generation. For example, in code understanding, deep code models are used for tasks such as vulnerability detection and code clone detection; in code generation, they are used for tasks such as code summary generation and code completion. Typical deep code models include CodeBERT, CodeGPT, GraphCodeBERT, CodeT5, and PLBART. They are trained through self-supervised learning of large-scale code corpora, and can capture grammatical and semantic relationships in the code, providing efficient support for downstream tasks.

[0003] Despite the outstanding performance of deep code models, their security and robustness issues have raised widespread concerns, especially in safety-critical applications such as vulnerability detection systems. If the model incorrectly classifies vulnerable code as safe code, it may lead to serious security consequences. This potential threat emphasizes the importance of fully testing and evaluating deep code models to identify their vulnerable weaknesses and improve the robustness of the models.

[0004] Adversarial attacks are an important means of testing the robustness of deep code models. Adversarial attacks generate adversarial examples that can deceive the model by making small, semantically preserving modifications to the input code (such as identifier replacement). These adversarial examples cause the model to produce outputs that are different from the original code, revealing the model's vulnerabilities. For example, by modifying identifier names while maintaining the semantics of the code, adversarial examples that mislead the model can be generated, exposing the model's sensitivity to input variations.

[0005] However, existing adversarial attack methods face the following challenges in deep code models:

[0006] 1. Insufficient use of feedback information: Current attack methods usually only focus on whether the adversarial example is successful, but do not make full use of the feedback information of failed attacks. Failed attacks may contain important clues about the decision boundary of the model, which is crucial to guide the direction of subsequent attacks, but is often overlooked.

[0007] 2. Local optimality problem: Many methods rely on greedy search strategies to gradually generate adversarial examples, such as replacing identifiers one by one. However, this method may fall into local optimality and fail to explore better solutions. For example, when the initially selected identifier replacement fails to achieve the best effect, subsequent generation may be limited by it.

[0008] 3. Efficiency dilemma: The most successful adversarial attack methods currently often require a large number of model queries, which is time-consuming and may trigger defense mechanisms. For example, although the exhaustive search-based method can improve the success rate, it will significantly increase the computational cost and the number of queries.

[0009] In order to solve the above problems, studies have proposed a variety of improvement methods. For example, black-box attack techniques generate adversarial examples by replacing identifiers, and representative methods such as ALERT and BeamAttack use greedy search and beam search strategies to optimize attack efficiency and success rate, respectively. However, these methods still have obvious shortcomings in making full use of feedback information, global optimization, and reducing the number of queries, and more efficient solutions are urgently needed. Summary of the invention

[0010] In view of the above-mentioned problems existing in the prior art, the technical problem to be solved by the present invention is: the technical problems of local optimality and efficiency dilemma in the existing adversarial example generation method.

[0011] In order to solve the above technical problems, the present invention adopts the following technical solution: an iterative generation method of adversarial samples for large models, comprising the following steps:

[0012] S100: Construct candidate identifier index vector search space T v , obtain the original code, extract the identifier set I from the original code, generate a candidate replacement set for each identifier in the identifier set I, and use the candidate replacement set to construct the identifier search space T c , T c Each identifier combination in is mapped to a candidate identifier index vector CIIV, and CIIV is used to construct T v .

[0013] S200: Constructing a historical failed attack set through random sampling and historical records and use Train the Gaussian process GP as a proxy model and use the expected improved acquisition function to select the optimal sampling point v′ opt , and according to v′ opt The optimal code variants sampled correspond to Update the evaluation results And continue to train the proxy model until preliminary adversarial examples are generated.

[0014] S300: The current optimal sampling point v′ obtained according to S200 opt, select all candidate sampling points whose Hamming distance does not exceed the set threshold to construct the distance sphere H, and select e candidate sampling points from H to form the initial candidate sampling point set S; v The candidate sampling points that can maximize the diversity gain in S are selected until S reaches the set maximum capacity; the candidate sampling points in S are input into the target model for evaluation, and the posterior distribution of the proxy model is updated according to the objective function value until the set budget limit is reached. The proxy model is no longer updated and the adversarial examples with successful attacks selected in each iteration are output.

[0015] Furthermore, the candidate identifier index vector search space T is constructed in S100 v The steps are as follows:

[0016] S101: Map a section of original code to an identifier set, extract the identifier set I = {x1, x2, ..., x l}.

[0017] S102: Generate a candidate replacement set for each identifier in the identifier set I, ensuring that the replacement items comply with the grammatical rules and maintain the semantic consistency of the code; the candidate replacement set is a set composed of candidate identifiers derived from an open source test data set, which is used to replace the identifiers in the original code.

[0018] S103: Use the candidate replacement set to construct the identifier search space T c , a set of identifiers corresponds to a T c , T c The elements in are called identifier combinations; a piece of code obtained by replacing the identifiers with the same meaning in the original code with an identifier combination is called a code variant. An identifier combination represents a code variant:

[0019]

[0020] Where l represents the number of identifiers, C i represents the set of candidate replacements for the i-th identifier.

[0021] S104: T c Each identifier combination in is mapped to a candidate identifier index vector CIIV, where each element in CIIV represents the index of an identifier in the identifier combination in the candidate replacement set. The CIIV of each identifier combination is expressed as:

[0022] v′=[v1,v2,…v i …,v l ] (2)

[0023] where v iRepresents the index of the i-th identifier in its candidate replacement set.

[0024] Then, the CIIV of each identifier combination is used to construct the candidate identifier index vector search space T v :

[0025]

[0026] in, A set of CIIVs representing all combinations of identifiers.

[0027] Furthermore, the process of obtaining the preliminary generated adversarial example is:

[0028] S201: First, use the original code to attack the deep code model. If the attack is successful, a valid adversarial example is obtained and defined as the initial generation of adversarial example output; if the attack fails, the Bayesian optimization framework is used to mine the evaluation information of the failed attack to find the code variant x′ that is mapped to the optimal attack vector and has the potential to successfully carry out the adversarial attack; Code understanding task: define the maximum negative margin function to measure the difference in the prediction confidence of the attacked deep code model for the category, where the attacked deep code model is called the target model:

[0029]

[0030] Where Y represents the set of all possible categories of the target model, and Respectively represent classes and real class The predicted probability of .

[0031] Code generation task: Define the code variants that are subjected to adversarial attacks as adversarial examples, and define the maximum negative BLEU score to measure the semantic similarity between the adversarial example and the original code:

[0032]

[0033] Among them, L BLEU (x′) is the BLEU score of x′.

[0034] S202: Constructing a historical failed attack set through random sampling and historical records

[0035] From T c Randomly sample n identifier combinations, replace the identifiers in each identifier combination with the identifiers with corresponding meanings in the original code, and obtain code variants. The formula for determining the sampling number n is:

[0036]

[0037] Where l represents the total number of identifiers in the original code, and N represents the total number of identifiers and their candidate sets.

[0038] The code variants obtained by random sampling and replacement are input into the target model for evaluation, and the objective function value output after each code variant is input into the target model is recorded. mar gin (x′ i ) and -L BLEU (x′ i );

[0039] For the comprehension task, if -L margun (x′ i )>0, it means that the code variant is a successful attack, otherwise it means that the code variant is a failed attack;

[0040] For build tasks, if -L BLEU (x′ i )=0, it means that the code variant is a successful attack, otherwise it means that the code variant is a failed attack;

[0041] Use the CIIV corresponding to the code variants that failed the attack and their corresponding objective function values ​​to construct a historical failed attack set

[0042]

[0043] Among them, v′ i CIIV,x′ corresponding to the code variant indicating the failed attack i Code variant indicating a failed attack, where n is the number of samples.

[0044] S203: Use Train the Gaussian process GP as a proxy model, and the posterior distribution of the proxy model is expressed as:

[0045]

[0046] μ=k(v1′,X)(k(X,X)+τ 2 I′) -1 Y (9)

[0047] ∑=k(v′1,v′2)-k(v′1,X)(k(X,X)+τ 2 I′) -1 k(X,v′2) (10)

[0048] in, is a normal distribution, v′1 and v′2 are two different CIIVs, and X is where CIIV is the matrix, μ is the mean function, ∑ is the covariance matrix, τ 2 is the noise variance, I′ is the identity matrix used for regularization, k(v′1,v′2) is the kernel function, k(v′1,X) is the kernel function matrix, and k(X,X) is the kernel matrix.

[0049] The kernel function k(v′1,v′2) is:

[0050]

[0051] where δ(·) is the Kronecker delta function, v′ i is the code variant x′ i Corresponding to CIIV, l is the total number of identifiers in the code, indicating the dimension of CIIV, w 1i and w 2i represents the i-th element in the two CIIV vectors, which is the identifier replacement corresponding to the two different code variants. is the signal variance, β i is the length scale parameter corresponding to the correlation of the ith element.

[0052] S204: Based on the trained proxy model, use the expected improved acquisition function to select the optimal sampling point v′ opt ,The calculation formula of the expected improved acquisition function is:

[0053]

[0054] Among them, v′ opt represents the optimal sampling point, v′∈T v Indicates T v The sampling points v′, y in * Represents the current optimal objective function value; in the classification task, y * is max-L margin (x′ i ); in the generation task, y * is max-L BLEU (x i ′), Represents the objective function value calculated by the surrogate model M The predicted distribution of max(y * -y,0) is the measure of improvement, which indicates the improvement value that the current sampling point v′ may bring.

[0055] S205: According to v′ opt The optimal code variants sampled correspond to The evaluation results of execution:

[0056] For the comprehension task, when -Lmargin (x i ′)>0, then stop the iteration and return the adversarial example x′ opt , and the adversarial example x′ opt is defined as the initial generation of adversarial example output; otherwise, the current sampling result and L margin (x i ')join in and update And return to S203.

[0057] For build tasks, when -L BLEU (x i ′)=0, then stop the iteration and return the adversarial example x′ opt , and the adversarial example x′ opt is defined as the initial generation of adversarial example output; otherwise, the current sampling result and L BLEU (x i ')join in and update And return to S203.

[0058] Furthermore, in S300, the process of outputting the adversarial examples selected for successful attacks in each round of iteration is:

[0059] S301: Constructing a set of candidate sampling points: Calculating the current optimal sampling point v′ opt The Hamming distance with other candidate sampling points is based on the calculated Hamming distance at the current optimal sampling point v′ opt Construct a distance ball H around, which contains the current optimal sampling point v′ opt Hamming of all candidate sampling points that do not exceed the set threshold, and select the first e candidate sampling points with the largest expected improvement EI from H to form the initial candidate sampling point set S:

[0060] S = [v′ i1 ,v′ i2 ,…,v′ ie ] (13)

[0061] Among them, v′ i1 Indicates that the position index of the i-th candidate acquisition point in S is 1.

[0062] The calculation method of Hamming distance is:

[0063]

[0064] Among them, v1 and v2 represent the optimal sampling point v′ respectively. opt The corresponding CIIV and CIIV corresponding to other candidate sampling points, v1,i and v 2,i Indicates the element at the corresponding position.

[0065] Maximum expected improvement EI:

[0066]

[0067] Where v′∈T v Indicates T v The sampling points v′, y in * Represents the current optimal objective function value, y * is max-L margin (x′ i ); in the generation task, y * is max-L BLEU (x′ i ), represents the predicted distribution of the objective function value y calculated by the surrogate model M, max(y * -y,0) is the measure of improvement, which indicates the improvement value that the current sampling point v′ may bring.

[0068] S302: For S, use formula (11) to calculate the similarity matrix V ij =sim(S,S), which is used to quantify the similarity between candidate sampling points, that is, to measure the proximity of two candidate sampling points in the search space. ij Represents the candidate sampling point v i ′ and v j The similarity matrix is ​​calculated based on the CIIV of the candidate sampling points.

[0069] S303: Calculate the similarity matrix between a candidate sampling point in S and other candidate sampling points, and use the similarity matrix to select the candidate sampling point with the maximum dissimilarity gain. This process uses a greedy strategy to iteratively select the optimal candidate identifier index vector v * , to maximize the total non-similarity gain of S. In each iteration, the candidate sampling point that can maximize the diversity gain is selected until S reaches the set maximum capacity. This process is implemented by the following objective function:

[0070]

[0071] Among them, arg max represents the independent variable that makes a function reach its maximum value, v′∈T v \S means outside S, from T v Select a new candidate vector v′ from the matrix, det represents the determinant operation, and They represent the posterior covariance matrices of the current S and the updated candidate sampling point set S∪v′ respectively.

[0072] In each sampling iteration, candidate sampling points that have been evaluated in previous iterations are excluded.

[0073] S304: Input the candidate sampling points in S into the target model for evaluation. During the evaluation process, the objective function value of each candidate sampling point is recorded, and the posterior distribution of the proxy model is updated, and the process returns to S302 until the set budget limit is reached, and the proxy model no longer updates and outputs the adversarial examples selected for successful attacks in each iteration.

[0074] Compared with the prior art, the present invention has at least the following advantages:

[0075] The method of the present invention, by combining the Bayesian optimization framework and diversity sampling technology, can dynamically adjust the attack direction, make full use of feedback information, balance exploration and development to effectively avoid local optimality, and significantly reduce the number of model calls to improve the success rate and efficiency of adversarial example generation, providing a new technical means for the security testing of deep code models. The present invention provides an efficient and reliable technical means for the security testing of deep code models, and has important application value in the fields of code quality detection, vulnerability analysis, etc.

[0076] 1. Efficient generation of adversarial examples: Through Bayesian optimization, the present invention can reduce the number of queries to the target model. Bayesian optimization can predict the most likely attack direction with fewer model queries by establishing a proxy model (Gaussian process), significantly reducing the consumption of computing resources and improving the efficiency of adversarial example generation.

[0077] 2. Avoid local optimum: Diversity sampling (DPP) technology effectively expands the search range and avoids the local optimum problem caused by the greedy algorithm. By using the DPP algorithm, the present invention selects multiple different candidate points in each sampling, maximizes the diversity of the current candidate set, and increases the possibility of successful attack. Diversity sampling ensures the breadth of the attack space, thereby reducing the risk of falling into the local optimal solution.

[0078] 3. Adapt to multiple task scenarios: The present invention supports two major task scenarios: code understanding and code generation. In the code understanding task, the generation of adversarial examples is optimized by maximizing the negative margin function; while in the code generation task, the BLEU score is optimized to ensure that the semantics of the generated code variants are consistent with the original code. Through this scheme, the deep code model can cope with a variety of different attack scenarios.

[0079] 4. Improve model robustness: This paper further improves the robustness of the deep code model in the face of malicious attacks through adversarial fine-tuning technology. The adversarial examples generated in each round of sampling are used to update the posterior distribution of the proxy model, thereby enhancing the model's ability to resist malicious variants and improving the stability of the deep code model in security-critical scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0080] Figure 1 The figure is a simplified process diagram of the method of the present invention. DETAILED DESCRIPTION

[0081] The present invention is described in further detail below.

[0082] See also Figure 1 , the present invention proposes an iterative generation method of adversarial samples for large models, referred to as ITGen. ITGen is suitable for code understanding tasks (such as vulnerability detection, clone detection) and code generation tasks (such as code summary generation, code completion). By combining the bit vector-based search space, Bayesian optimization framework and diversity sampling strategy, it significantly improves the efficiency and success rate of adversarial example generation and enhances the robustness of the model. Specifically, ITGen includes the following steps: constructing a search space through bit vector representation, using feedback information to guide optimization, generating optimal candidate variants based on Bayesian optimization, and expanding the search range in combination with a diversity sampling strategy. ITGen can effectively generate adversarial examples in a black box environment and improve the robustness of deep code models through adversarial fine-tuning.

[0083] The present invention utilizes search space construction, Bayesian optimization and diversity sampling (DPP) technology in adversarial testing of deep code models to solve the local optimal problem and efficiency dilemma in existing adversarial example generation methods.

[0084] 1. Local optimality problem: The local optimality problem refers to the fact that the existing adversarial example generation methods are prone to fall into the local optimal solution during the attack process, that is, only a locally effective solution is found and the global optimal solution cannot be explored, thus limiting the success rate and scope of the adversarial attack.

[0085] Limitations of existing methods: Traditional adversarial example generation methods, such as greedy algorithms, rely on step-by-step identifier replacement and local search. Each time an identifier is replaced, if a step is successful, the search continues. This method is prone to the algorithm falling into a local optimal solution due to the influence of previously selected identifiers on subsequent selections. For example, in an adversarial attack on a deep code model, the replacement of certain identifiers may have a significant impact on the model, but if the replacement causes the search space in a certain area to become too limited, subsequent attacks may not be able to find more promising adversarial examples.

[0086] The solution provided by the present invention is:

[0087] (1) Multiple identifier replacement and CIIV representation: The present invention supports simultaneous replacement of multiple identifiers through CIIV (candidate identifier index vector) representation. In traditional methods, identifier replacement is performed one by one, while the present invention effectively expands the search space by replacing multiple identifiers at the same time. Since multiple identifiers can be replaced each time, the path restrictions are reduced, thereby avoiding the restriction of the search direction due to the replacement of a single identifier and reducing the risk of falling into a local optimum.

[0088] (2) Bayesian optimization framework: The present invention uses Bayesian optimization as the core framework for generating adversarial examples. The Bayesian optimization framework predicts the value of the objective function through a Gaussian process proxy model and dynamically selects the most potential attack point, avoiding the greedy algorithm from falling into the local optimum. The expected improvement (EI) acquisition function of Bayesian optimization dynamically selects new sampling points based on the existing feedback information to maximize the success probability of the adversarial attack with the minimum number of samples. Through multiple optimizations and feedback updates, Bayesian optimization can guide the search direction towards a wider attack space, thereby avoiding local optimal solutions.

[0089] (3) DPP (Determinant Point Process) sampling: To further avoid local optimality, the present invention introduces the DPP sampling algorithm, which can select diverse samples from multiple candidate sampling points. In each round of sampling, DPP calculates the similarity of candidate sampling points and selects samples with maximized dissimilarity, thereby ensuring that the selected attack points have a high diversity. In this way, the present invention not only increases the coverage of the attack in each sampling, but also avoids the trap caused by local optimality.

[0090] 2. Efficiency dilemma: The efficiency dilemma refers to the fact that existing adversarial example generation methods require a large number of model queries during the attack process, which consumes a lot of computing resources and increases the attack time, reducing the efficiency of the attack.

[0091] Efficiency issues of existing methods: Traditional methods usually rely on strategies such as exhaustive search and greedy algorithms. In the process of generating adversarial examples, each attack will query the target model multiple times. Especially when the attack space is large, the number of model queries increases exponentially, resulting in a waste of computing resources and the triggering of defense mechanisms. In order to find adversarial examples, existing methods often require a large number of model evaluations, resulting in low efficiency. In addition, traditional methods do not make full use of feedback information. After each evaluation, they simply select the next candidate without using the existing information to dynamically adjust the search direction, which exacerbates the redundancy and inefficiency of the search.

[0092] The solution provided by the present invention is:

[0093] (1) Bayesian Optimization Framework: The present invention significantly reduces the number of model queries by introducing the Bayesian Optimization framework. Bayesian optimization predicts the potential value of the target function by establishing a proxy model (Gaussian process), thereby avoiding the situation where a large number of queries are required each time. The proxy model fits the distribution of the target function through historical data and dynamically adjusts the sampling points, which can effectively guide the search process and reduce the actual number of queries to the target model. The goal of Bayesian optimization is to maximize the expected improvement through fewer model calls, which significantly improves the efficiency of attack generation.

[0094] (2) Expected Improvement (EI) acquisition function: The expected improvement (EI) acquisition function can select the most promising samples according to the current state of the model in each iteration, thus avoiding the computational cost of exhaustive search. By calculating the potential improvement value of the current sampling point, the EI acquisition function helps select the most effective attack point in each query, thereby reducing the occurrence of invalid queries and improving the efficiency of adversarial example generation.

[0095] (3) DPP sampling and redundant evaluation elimination: Through the DPP sampling technology, the present invention can expand the search space by increasing the diversity of samples, thereby reducing redundant queries. When a new sampling point is selected, the candidate points that have been evaluated previously will be excluded to avoid repeated calculations. This strategy effectively reduces the number of redundant evaluations and significantly improves the sampling and optimization efficiency.

[0096] A method for iteratively generating adversarial samples for large models, comprising the following steps:

[0097] S100: Construct candidate identifier index vector search space T v , obtain the original code, extract the identifier set I from the original code, generate a candidate replacement set for each identifier in the identifier set I, and use the candidate replacement set to construct the identifier search space T c , T c Each identifier combination in is mapped to a candidate identifier index vector CIIV, and CIIV is used to construct T v .

[0098] S200: Constructing a historical failed attack set through random sampling and historical records and use Train the Gaussian process GP as a proxy model and use the expected improved acquisition function to select the optimal sampling point v′ opt , and according to v′ opt The optimal code variants sampled correspond to Update the evaluation results And continue to train the proxy model until preliminary adversarial examples are generated.

[0099] S300: The current optimal sampling point v′ obtained according to S200 opt , select all candidate sampling points whose Hamming distance does not exceed the set threshold to construct the distance sphere H, and select e candidate sampling points from H to form the initial candidate sampling point set S; v The candidate sampling points that can maximize the diversity gain in S are selected until S reaches the set maximum capacity; the candidate sampling points in S are input into the target model for evaluation, and the posterior distribution of the proxy model is updated according to the objective function value until the set budget limit is reached. The proxy model is no longer updated and the adversarial examples with successful attacks selected in each iteration are output.

[0100] Specifically, in S100, a candidate identifier index vector search space T is constructed. v The steps are as follows:

[0101] S101: Map a section of original code to an identifier set, extract the identifier set I = {x1, x2, ..., x l}, identifiers can be programming elements such as local variables and function names.

[0102] S102: Generate a candidate replacement set for each identifier in the identifier set I, ensuring that the replacement item complies with the grammatical rules and maintains the semantic consistency of the code; the candidate replacement set is a set of candidate identifiers derived from an open source test dataset, which is used to replace the identifiers in the original code. The candidate identifiers are derived from an open source test dataset, such as BigCloneBench and CodeSearchNet.

[0103] S103: In order to represent all candidate replacement sets of the identifier, the candidate replacement sets are used to construct the identifier search space T c , a set of identifiers corresponds to a T c , T c The elements in are called identifier combinations; a piece of code obtained by replacing the identifiers with the same meaning in the original code with an identifier combination is called a code variant. An identifier combination represents a code variant: it is called a code variant mapped to an identifier combination.

[0104]

[0105] Where l represents the number of identifiers, C i represents the set of candidate replacements for the i-th identifier.

[0106] For example, if the identifier set is {search,arr}, and the candidate replacement sets are {search,lookup} and {arr,array}, then the search space T cContains the following identifier combinations:

[0107] T c ={(search,arr),(search,array),(lookup,arr),(lookup,array)}

[0108] For example: Original code: int search; int arr; sort(search,arr)

[0109] Code variant: int lookup; int array; sort(lookup, array)

[0110] ↓ Mapping

[0111] Identifier combination: (lookup, array)

[0112] S104: T c Each identifier combination in is mapped to a candidate identifier index vector CIIV, where each element in CIIV represents the index of an identifier in the identifier combination in the candidate replacement set. The CIIV of each identifier combination is expressed as:

[0113] v′=[v1,v2,…v i …,v l ] (2)

[0114] where v i represents the index of the ith identifier in its candidate replacement set. For example, the CIIV of the identifier combination (lookup, array) is v′=[1,1].

[0115] Then, the CIIV of each identifier combination is used to construct the candidate identifier index vector search space T v :

[0116]

[0117] in, A set of CIIVs representing all combinations of identifiers.

[0118] The search space T can be expressed as c All identifier combinations in are mapped to index vector representation. This step not only replaces all identifiers in the original code at the same time, but also fully represents the search space T in the form of CIIV cEach identifier combination in , finally mapping all possible code variants to CIIV. This representation not only comprehensively constructs all possible code variants, but also avoids the search from falling into local optimality by supporting multiple identifier replacements, thereby improving the search efficiency and the success rate of adversarial example generation, for example:

[0119] T c ={(search,arr),(search,array),(lookup,arr),(lookup,array)}

[0120] ↓ Mapping

[0121] T v ={(0,0),(0,1),(1,0),(1,1)}

[0122] Specifically, the process of obtaining the preliminary generated adversarial example is:

[0123] S201: Establish candidate identifier index vector search space T v Finally, the original code is used to attack the deep code model. If the attack is successful, a valid adversarial example is obtained and defined as the preliminary generated adversarial example output. If the attack fails, the Bayesian optimization framework is used to mine the evaluation information of the failed attack to find the code variant x′ that is mapped to the optimal attack vector and has the potential to successfully carry out the adversarial attack.

[0124] Code understanding task: In order to find a code variant x′ that is likely to successfully conduct an adversarial attack, a function that maximizes the negative margin is defined to measure the difference in the prediction confidence of the attacked deep code model for the category, where the attacked deep code model is called the target model:

[0125]

[0126] Where Y represents the set of all possible categories of the target model, and Respectively represent classes and real class The predicted probability of .

[0127] Code generation task: The code variants that are subjected to adversarial attacks are defined as adversarial examples. In order to find the code variant x′ that is expected to successfully conduct adversarial attacks, the maximum negative BLEU score is defined to measure the semantic similarity between the adversarial example and the original code:

[0128]

[0129] Among them, L BLEU (x′) is the BLEU score of x′.

[0130] S202: Constructing a historical failed attack set through random sampling and historical records

[0131] From T c Randomly sample n identifier combinations, replace the identifiers in each identifier combination with the identifiers with corresponding meanings in the original code, and obtain code variants. The formula for determining the sampling number n is:

[0132]

[0133] Where e represents the total number of identifiers in the original code and N represents the total number of identifiers and their candidate sets. This formula ensures that oversampling is avoided when there are fewer identifiers, while covering a wider search space when there are more identifiers.

[0134] The code variants obtained by random sampling and replacement are input into the target model for evaluation, and the objective function value output after each code variant is input into the target model is recorded. mar gin (x′ i ) and -L BLEU (x′ i );

[0135] For the comprehension task, if -L margin (x′ i )>0, it means that the code variant is a successful attack, otherwise it means that the code variant is a failed attack;

[0136] For build tasks, if -L BLEU (x′ i )=0, it means that the code variant is a successful attack, otherwise it means that the code variant is a failed attack;

[0137] Use the CIIV corresponding to the code variants that failed the attack and their corresponding objective function values ​​to construct a historical failed attack set

[0138]

[0139] Among them, v′ i CIIV,x′ corresponding to the code variant indicating the failed attack i Code variant indicating a failed attack, where n is the number of samples.

[0140] S203: Use Train the Gaussian process GP as a proxy model. The Gaussian process as a proxy model can predict the target function value and dynamically adjust the search direction to generate effective adversarial examples. The posterior distribution of the proxy model is expressed as:

[0141]

[0142] μ=k(v′1,X)(k(X,X)+τ 2 I′) -1 Y (9)

[0143] ∑=k(v′1,v′2)-k(v′1,X)(k(X,X)+τ 2 I′) -1 k(X,v′2) (10)

[0144] in, is a normal distribution, v′1 and v′2 are two different CIIVs, and X is where CIIV is the matrix, μ is the mean function, ∑ is the covariance matrix (part of the posterior distribution), τ 2 is the noise variance, I′ is the identity matrix used for regularization, k(v′1,v′2) is the kernel function, k(v′1,X) is the kernel function matrix, and k(X,X) is the kernel matrix.

[0145] The kernel function k(v′1,v′2) is:

[0146]

[0147] where δ(·) is the Kronecker delta function, v′ i is the code variant x′ i Corresponding to CIIV, l is the total number of identifiers in the code, indicating the dimension of CIIV, w 1i and w 2i represents the i-th element in the two CIIV vectors, which is the identifier replacement corresponding to the two different code variants. is the signal variance, β i is the length scale parameter corresponding to the correlation of the ith element.

[0148] S204: Based on the trained proxy model, use the expected improved acquisition function to select the optimal sampling point v′ opt ,The expected improvement acquisition function aims to guide the next sampling point to be selected in the direction of the maximum possible performance improvement and optimize the objective function. The calculation formula of the expected improvement acquisition function is:

[0149]

[0150] Among them, v′ opt represents the optimal sampling point, v′∈T v Indicates T v The sampling points v′, y in * Represents the current optimal objective function value; in the classification task, y* is max-L margin (x′ i ); in the generation task, y * is max-L BLEU (x′ i ), Represents the objective function value calculated by the surrogate model M The predicted distribution of max(y * -y,0) is the measure of improvement, which indicates the improvement value that the current sampling point v′ may bring.

[0151] S205: According to v′ opt The optimal code variants sampled correspond to The evaluation results of execution:

[0152] For the comprehension task, when -L margin (x′ i )>0, the iteration stops and the adversarial example x′ is returned opt , and the adversarial example x′ opt is defined as the initial generation of adversarial example output; otherwise, the current sampling result and L margin (x′ i )join in and update And return to S203. Continue to train the proxy model until the attack budget limit is reached or effective adversarial examples are initially generated.

[0153] For build tasks, when -L BLEU (x′ i )=0, then stop the iteration and return the adversarial example x′ opt , and the adversarial example x′ opt is defined as the initial generation of adversarial example output; otherwise, the current sampling result and L BLEU (x′ i )join in and update And return to S203 until the attack budget limit is reached or a valid adversarial example is initially generated.

[0154] Specifically, this component uses the Determinant Point Process (DPP) algorithm to obtain the v The algorithm selects candidate sampling points with higher diversity to expand the search scope and avoid falling into local optimal solutions. Its main goal is to further optimize the generation process of adversarial examples by selecting candidate sampling points with maximum diversity to efficiently generate effective adversarial examples.

[0155] Specifically, in S300, the process of outputting the adversarial examples selected for successful attacks in each round of iteration is as follows:

[0156] S301: Constructing a set of candidate sampling points: Calculating the current optimal sampling point v′ opt The Hamming distance with other candidate sampling points is based on the calculated Hamming distance at the current optimal sampling point v′ opt Construct a distance ball H around, which contains the current optimal sampling point v′ opt Hamming of all candidate sampling points that do not exceed the set threshold, and select the first e candidate sampling points with the largest expected improvement EI from H to form the initial candidate sampling point set S:

[0157] S = [v′ i1 ,v′ i2 ,…,v′ ie ] (13)

[0158] Among them, v′ i1 Indicates that the position index of the i-th candidate acquisition point in S is 1.

[0159] The calculation method of Hamming distance is:

[0160]

[0161] Among them, v1 and v2 represent the optimal sampling point v′ respectively. opt The corresponding CIIV and CIIV corresponding to other candidate sampling points, v 1,i and v 2,i Represents the element at the corresponding position. For example, suppose there is a v′ opt =(1, 0, 1, 0, 0, 1), construct a distance ball H with a threshold of 2, which contains all distances with v′ opt The candidate sampling points whose Hamming distance is less than or equal to 2. The candidate sampling points include: (1, 0, 0, 0, 0, 1), (1, 1, 1, 0, 0, 0), (1, 0, 1, 0, 1, 1).

[0162] Maximum expected improvement EI:

[0163]

[0164] Where v′∈T v Indicates T v The sampling points v′, y in * Represents the current optimal objective function value, y * is max-L margin (x′ i ); in the generation task, y * is max-L BLEU (x′ i ), Represents the objective function value calculated by the surrogate model M The predicted distribution of max(y * -y,0) is the measure of improvement, which indicates the improvement value that the current sampling point v′ may bring.

[0165] S302: For S, use formula (11) to calculate the similarity matrix It is used to quantify the similarity between candidate sampling points, that is, to measure the proximity of two candidate sampling points in the search space. Represents the candidate sampling point v i ′ and v j The similarity matrix is ​​calculated based on the CIIV of the candidate sampling points.

[0166] S303: After calculating the similarity matrix, use the matrix for diversity sampling. Specifically, calculate the similarity matrix between a candidate sampling point in S and other candidate sampling points, and use the similarity matrix to select the candidate sampling point with the maximum dissimilarity gain [using the similarity matrix to select the candidate sampling point with the maximum dissimilarity gain is to select the candidate sampling point that can maximize the diversity gain]. This process uses a greedy strategy to iteratively select the optimal candidate identifier index vector v * , to maximize the total non-similarity gain of S. In each iteration, the candidate sampling point that can maximize the diversity gain is selected until S reaches the set maximum capacity. This process is implemented by the following objective function:

[0167]

[0168] Among them, arg max represents the independent variable that makes a function reach its maximum value, v′∈T v \S means outside S, from T v Select a new candidate vector v′ from the matrix, det represents the determinant operation, and They represent the posterior covariance matrices of the current S and the updated candidate sampling point set S∪v′ respectively.

[0169] In each sampling iteration, candidate sampling points that have been evaluated in previous iterations are excluded. This strategy effectively avoids redundant evaluations, reduces unnecessary calculations, and improves sampling efficiency. In this way, subsequent sampling can focus on newly generated candidate sampling points, avoiding repeated calculations, thereby accelerating the optimization process.

[0170] S304: Input the candidate sampling points in S into the target model for evaluation. During the evaluation process, record the objective function value of each candidate sampling point, update the posterior distribution of the proxy model, and return to S302. Until the set budget limit is reached, the proxy model is no longer updated [until the set budget limit is reached or the feedback information of the attack failure is no longer valid, that is, when the update of the proxy model is no longer significantly improved after several rounds of iterations, the proxy model is no longer updated], and the adversarial examples of successful attacks selected in each round of iteration are output. In this way, the sampling results will directly affect the objective function value in the feedback optimization generation component, thereby forming a closed-loop feedback, continuously improving the efficiency and success rate of adversarial example generation, and ultimately efficiently generating effective adversarial examples.

[0171] Experiment and analysis:

[0172] The present invention selects a variety of advanced identifier replacement and adversarial example generation methods to verify the advantages of the present invention in terms of both generation quantity and quality, which can be summarized into three categories: identifier replacement standard, optimized generation standard and diversity enhancement standard.

[0173] 1. Identifier replacement criteria: The identifier replacement criteria builds a comprehensive search space by generating semantically preserved code variants:

[0174] (1) Identifier replacement screens the candidate set based on syntactic correctness and semantic consistency to ensure that the generated code variants can be compiled and executed.

[0175] (2) Using coverage as an evaluation index, by replacing different identifiers, the coverage ratio of the search space is expanded as much as possible. In the present invention, the coverage ratio is set to be no less than 80%.

[0176] 2. Optimize generation criteria: Optimize generation criteria to dynamically adjust the generation direction through Bayesian optimization to guide the generation of more effective adversarial examples:

[0177] (1) Use a feedback mechanism to record successful and failed generation information to optimize the next round of adversarial example generation.

[0178] (2) Guided sampling is used to select the code variants that are most likely to deceive the target model to improve generation efficiency and attack success rate.

[0179] 3. Diversity Enhancement Criteria: The diversity enhancement criteria screens adversarial examples with wide coverage through the Determinant Point Process (DPP):

[0180] (1) Use the similarity matrix to evaluate the differences between candidate code variants.

[0181] (2) By maximizing diversity, candidate samples with the widest coverage are selected to avoid the generated examples falling into the local optimum.

[0182] Select Model:

[0183] The models selected by the present invention are five deep code models: CodeBERT, GraphCodeBERT, CodeT5, PLBART and CodeGPT, and the tasks selected are vulnerability prediction, clone detection and code summarization. The dataset of the vulnerability prediction task contains code samples extracted from two C language projects, which are used to predict whether there are vulnerabilities in the code snippets; the clone detection task uses the BigCloneBench dataset to detect the semantic equivalence of two code snippets; the code summarization task uses the Java sub-dataset of CodeSearchNet to generate a natural language summary describing the function of the code snippet.

[0184] CodeBERT is a Transformer-based deep code model that focuses on code understanding tasks such as vulnerability prediction, code clone detection, and code classification. GraphCodeBERT introduces a graph neural network based on CodeBERT to capture the grammatical structure and dependency information of the code, which is suitable for more complex code semantic understanding tasks. CodeT5 is based on the T5 architecture and is a powerful code generation and translation model that supports generation tasks from natural language to code and translation between programming languages. PLBART focuses on translation tasks from programming language to programming language and combines a pre-training framework for text and code. CodeGPT is a code generation model based on the GPT architecture that can efficiently handle code completion and generation tasks and is suitable for generation scenarios in multiple programming languages.

[0185] All selected models are well pre-trained and fine-tuned to effectively handle their respective target tasks. These models and datasets are widely used in various deep code model tasks, making them representative and commonly used in previous research works.

[0186] Evaluation indicators:

[0187] The present invention adopts three evaluation indicators: attack success rate (ASR), average model invocation number (AMI) and robustness analysis after adversarial fine-tuning.

[0188] Attack Success Rate (ASR): When the generated adversarial examples successfully mislead the victim model, the attack success rate will be increased. ASR is a direct evaluation metric that reflects the ability of the generated adversarial examples to change the model's prediction results in the target task. A higher ASR indicates that the attack method has a higher effectiveness in testing the vulnerability of deep code models.

[0189] Average Model Invocations (AMI): AMI measures the average number of model invocations required to generate adversarial examples and is an important metric for evaluating attack efficiency. In black-box scenarios, model invocations are usually limited by time and cost. A reduction in AMI indicates that the process of generating adversarial examples is more cost-effective.

[0190] Robustness analysis after adversarial fine-tuning: This paper evaluates the robustness of the victim model through adversarial fine-tuning, which specifically includes the following contents:

[0191] Adversarial examples generated by ITGen, ALERT, and BeamAttack are used to fine-tune the models and evaluate their performance on vulnerability prediction and code summarization tasks.

[0192] The fine-tuned victim model achieves significantly improved accuracy in vulnerability prediction tasks, and also significantly improves the BLEU score in code summarization tasks.

[0193] The results show that adversarial examples from ITGen play a significant role in enhancing model robustness and improving test coverage.

[0194] By combining the above evaluation indicators, the present invention can comprehensively measure the effectiveness and efficiency of the adversarial example generation method, while verifying the potential of adversarial examples in enhancing the robustness of the model, providing comprehensive support for the security and robustness testing of deep code models.

[0195] Diversification rules:

[0196] The present invention adopts three main mutation rules to generate adversarial examples, which are identifier replacement, identifier permutation and reorganization, and code fragment adjustment, to generate diversified mutant code examples.

[0197] Identifier replacement: Generate adversarial examples by replacing identifiers in the code (such as variable names, function names, etc.). The paper mentions that identifier replacement generates a set of candidate replacements based on the context and uses combinations in the search space for mutation. For example, replace the identifier search with lookup or find. This method is able to generate diverse variant codes while maintaining the semantic consistency of the code.

[0198] Identifier reordering: The order of identifiers is adjusted to explore the sensitivity of the model to the input order. Code variants are generated by changing the order of identifiers into logically equivalent but different combinations. This method is suitable for detecting whether the model misjudges non-logical changes in code input.

[0199] Code snippet adjustment: Generate variant codes by adding, deleting or moving code snippets, such as inserting empty statements, adjusting the order of code blocks, etc. These mutations do not change the semantics or logical functions of the code, but can effectively increase the diversity of inputs and are used to test the robustness of the model to non-functional changes.

[0200] It is worth noting that the paper mentioned that in the construction of the search space and the application of mutation rules, the generated code is always ensured to maintain syntactic and semantic consistency to avoid the failure of adversarial examples. At the same time, the determinant point process (DPP) is used to screen diverse mutation examples to further improve coverage and test effectiveness.

[0201] The results of the present invention are shown in Table 1. AL, Beam, and IT represent ALERT, BeamAttack, and ITGen, respectively.

[0202] Table 1 Test results

[0203]

[0204]

[0205] Observing the results in Table 1, it is worth noting that it is a challenging task to comprehensively optimize the attack success rate (ASR) and the average model invocation number (AMI) in the three tasks of vulnerability prediction, clone detection, and code summarization.

[0206] In the vulnerability prediction task, ITGen shows a significant advantage, and its ASR is higher than ALERT and BeamAttack in all models. For example, on the CodeT5 model, ITGen achieved an ASR of 96.25%, significantly exceeding ALERT (83.21%) and BeamAttack (81.55%). This result shows that ITGen has a stronger ability in capturing key vulnerability features in the code. However, since vulnerability prediction involves complex code semantic analysis, even ITGen requires a certain number of model calls (such as CodeT5's AMI of 0.04) to complete the generation of adversarial examples.

[0207] In the clone detection task, ITGen's ASR also significantly outperforms the baseline method. For example, on the GraphCodeBERT model, ITGen's ASR is 33.68%, significantly higher than ALERT (12.92%) and BeamAttack (13.62%). However, the clone detection task involves semantic similarity analysis between code pairs, so the process of generating adversarial examples is more complicated, resulting in a higher AMI, such as 0.15 for GraphCodeBERT.

[0208] In the code summarization task, ITGen performs well in both ASR and AMI. For example, on the PLBART model, ITGen's ASR reaches 87.17%, significantly higher than ALERT (68.05%) and BeamAttack (57.93%). However, due to the natural language requirements of the code summary generation task, ITGen requires a more complex adversarial example generation strategy, so the AMI is slightly higher, but still significantly lower than other methods (such as BeamAttack).

[0209] In addition, ITGen also excels in enhancing the robustness of the victim model. Through adversarial fine-tuning, ITGen significantly reduces the attack success rate and improves the model's robustness to new adversarial examples. For example, in the vulnerability prediction task, after the CodeBERT model is fine-tuned with ITGen, its ASR is reduced from the original 65.15% to 58.92%.

[0210] When using ITGen as a guide for adversarial example generation, the adversarial examples cover most of the key scenarios in vulnerability prediction, clone detection, and code summarization tasks. This highlights the effectiveness of our invention in generating diverse and representative adversarial examples that may trigger various vulnerabilities and model defects in different tasks.

[0211] In the vulnerability prediction task, the adversarial examples generated by ITGen can cover more types of vulnerability patterns. Especially on the CodeT5 model, the example coverage generated by ITGen is significantly better than other methods. This shows that the present invention can effectively mine the potential defects of deep code models when dealing with complex vulnerability detection tasks.

[0212] In the clone detection task, the adversarial examples generated by the present invention show a wider range of semantic changes and code variations, which enables ITGen to significantly improve the model's ability to trigger errors. Although the clone detection task is relatively semantically sensitive, the diverse examples generated by ITGen can effectively test the model's robustness in judging code similarity.

[0213] In the code summarization task, the adversarial examples generated by ITGen affect the quality of the natural language summaries generated by the model through subtle code mutations, showing strong coverage and challenge. Compared with the baseline method, the adversarial examples generated by the present invention can better reflect the potential weaknesses of the model for language generation tasks.

[0214] Although the generation efficiency is slightly lower than other methods in some tasks, the adversarial examples generated by ITGen are outstanding in diversity, fairness, and coverage. This shows that the invention has the potential to identify a wide range of defects in deep code models in real-world tasks, especially when applied to more complex and rich datasets.

[0215] In short, the present invention can not only generate diverse and more efficient adversarial examples, but also identify potential vulnerabilities and deficiencies of the model. These adversarial examples can provide valuable insights for improving the robustness and reliability of deep code models in practical application scenarios.

[0216] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solution of the present invention, which should be included in the scope of the claims of the present invention.

Claims

1. A method for iteratively generating adversarial samples for large models, characterized in that: The steps include: S100: Construct candidate identifier index vector search space T v , obtain the original code, extract the identifier set I from the original code, generate a candidate replacement set for each identifier in the identifier set I, and use the candidate replacement set to construct the identifier search space T c , T c Each identifier combination in is mapped to a candidate identifier index vector CIIV, and CIIV is used to construct T v ; S200: Constructing a historical failed attack set through random sampling and historical records and use Train the Gaussian process GP as a proxy model and use the expected improved acquisition function to select the optimal sampling point v′ opt , and according to v′ opt The optimal code variants sampled correspond to Update the evaluation results And continue to train the proxy model until preliminary adversarial examples are generated; S300: The current optimal sampling point v′ obtained according to S200 opt , select all candidate sampling points whose Hamming distance does not exceed the set threshold to construct the distance sphere H, and select e candidate sampling points from H to form the initial candidate sampling point set S; v The candidate sampling points that can maximize the diversity gain in S are selected until S reaches the set maximum capacity; the candidate sampling points in S are input into the target model for evaluation, and the posterior distribution of the proxy model is updated according to the objective function value until the set budget limit is reached. The proxy model is no longer updated and the adversarial examples with successful attacks selected in each iteration are output.

2. The iterative generation method of adversarial samples for large models as claimed in claim 1, characterized in that: In S100, a candidate identifier index vector search space T is constructed. v The steps are as follows: S101: Map a section of original code to an identifier set, extract the identifier set I = {x1, x2, ..., x l }; S102: Generate a candidate replacement set for each identifier in the identifier set I, ensuring that the replacement item complies with the grammatical rules and maintains the semantic consistency of the code; the candidate replacement set is a set consisting of candidate identifiers derived from an open source test data set, and is used to replace the identifiers in the original code; S103: Use the candidate replacement set to construct the identifier search space T c , a set of identifiers corresponds to a T c , T c The elements in are called identifier combinations; a piece of code obtained by replacing the identifiers with the same meaning in the original code with an identifier combination is called a code variant; an identifier combination represents a code variant: Where l represents the number of identifiers, C i represents the candidate replacement set for the i-th identifier; S104: T c Each identifier combination in is mapped to a candidate identifier index vector CIIV, where each element in CIIV represents the index of an identifier in the identifier combination in the candidate replacement set. The CIIV of each identifier combination is expressed as: v′=[v1,v2,…v i …,v l ] (2) where v i represents the index of the i-th identifier in its candidate replacement set; Then, the CIIV of each identifier combination is used to construct the candidate identifier index vector search space T v : in, A set of CIIVs representing all combinations of identifiers.

3. The iterative generation method of adversarial samples for large models as claimed in claim 1, characterized in that: The process of obtaining the initial generation of adversarial examples is as follows: S201: First, use the original code to attack the deep code model. If the attack is successful, a valid adversarial example is obtained and defined as the initial generation of adversarial example output; If the attack fails, the evaluation information of the failed attack is mined using a Bayesian optimization framework to find a code variant x′ that is mapped to the optimal attack vector and has the potential to successfully conduct an adversarial attack; Code understanding task: Define the maximum negative margin function to measure the difference in prediction confidence of the attacked deep code model for the category, where the attacked deep code model is called the target model: Where Y represents the set of all possible categories of the target model, and Respectively represent classes and real class The predicted probability of Code generation task: Define the code variants that are subjected to adversarial attacks as adversarial examples, and define the maximum negative BLEU score to measure the semantic similarity between the adversarial example and the original code: Among them, L BLEU (x′) is the BLEU score of x′; S202: Constructing a historical failed attack set through random sampling and historical records From T c Randomly sample n identifier combinations, replace the identifiers in each identifier combination with the identifiers with corresponding meanings in the original code, and obtain code variants. The formula for determining the sampling number n is: Where l represents the total number of identifiers in the original code, and N represents the total number of identifiers and their candidate sets; The code variants obtained by random sampling and replacement are input into the target model for evaluation, and the objective function value output after each code variant is input into the target model is recorded. margin (x i ′) and -L BLEU (x i ′); For the comprehension task, if -L maxgin (x i ′)>0, it means that the code variant is a successful attack, otherwise it means that the code variant is a failed attack; For build tasks, if -L BLEU (x i ′)=0, it means that the code variant is a successful attack, otherwise it means that the code variant is a failed attack; Use the CIIV corresponding to the code variants that failed the attack and their corresponding objective function values ​​to construct a historical failed attack set Among them, v′ i CIIV,x′ corresponding to the code variant indicating the failed attack i Code variant indicating a failed attack, n represents the number of samples; S203: Use Train the Gaussian process GP as a proxy model, and the posterior distribution of the proxy model is expressed as: μ=k(v′1,M)(k(X,X)+τ 2 I′) -1 Y (9) ∑=k(v′1,v′2)-k(v′1,X)(k(X,X)+τ 2 I′) -1 k(X,v′2) (10) in, is a normal distribution, v′1 and v′2 are two different CIIVs, and X is where CIIV is the matrix, μ is the mean function, ∑ is the covariance matrix, τ 2 is the noise variance, I′ is the identity matrix used for regularization, k(v′1,v′2) is the kernel function, k(v′1,X) is the kernel function matrix, and k(X,X) is the kernel matrix; The kernel function k(v′1,v′2) is: where δ(·) is the Kronecker delta function, v′ i is the code variant x′ i Corresponding to CIIV, l is the total number of identifiers in the code, indicating the dimension of CIIV, w 1i and w 2i represents the i-th element in the two CIIV vectors, which is the identifier replacement corresponding to the two different code variants. is the signal variance, β i is the length scale parameter corresponding to the correlation of the ith element; S204: Based on the trained proxy model, use the expected improved acquisition function to select the optimal sampling point v′ opt ,The calculation formula of the expected improved acquisition function is: Among them, v′ opt represents the optimal sampling point, v′∈T v Indicates T v The sampling points v′, y in * Represents the current optimal objective function value; in the classification task, y * is max-L margin (x i ′); in the generation task, y * is max-L BLEU (x i ′), Represents the objective function value calculated by the surrogate model M The predicted distribution of max(y * -y,0) is the measure of improvement, which indicates the improvement value that the current sampling point v′ may bring; S205: According to v′ opt The optimal code variants sampled correspond to The evaluation results of execution: For the comprehension task, when -L margin (x i ′)>0, then stop the iteration and return the adversarial example x′ opt , and the adversarial example x′ opt is defined as the initial generation of adversarial example output; otherwise, the current sampling result and L margin (x i ')join in and update And return to S203; For build tasks, when -L BLEU (x i ′)=0, then stop the iteration and return the adversarial example x′ opt , and the adversarial example x′ opt is defined as the initial generation of adversarial example output; otherwise, the current sampling result and L BLEU (x i ')join in and update And return to S203.

4. The iterative generation method of adversarial samples for large models as claimed in claim 1, characterized in that: In S300, the process of outputting the successful adversarial examples selected in each round of iteration is as follows: S301: Constructing a set of candidate sampling points: Calculating the current optimal sampling point v′ opt The Hamming distance with other candidate sampling points is based on the calculated Hamming distance at the current optimal sampling point v′ opt Construct a distance ball H around, which contains the current optimal sampling point v′ opt Hamming of all candidate sampling points that do not exceed the set threshold, and select the first e candidate sampling points with the largest expected improvement EI from H to form the initial candidate sampling point set S: S=[v′ i1 ,v′ i2 ,…,v′ ie ] (13) Among them, v′ i1 Indicates that the position index of the i-th candidate acquisition point in S is 1; The calculation method of Hamming distance is: Among them, v1 and v2 represent the optimal sampling point v′ respectively. opt The corresponding CIIV and CIIV corresponding to other candidate sampling points, v 1,i and v 2,i Indicates the elements at the corresponding positions; Maximum expected improvement EI: Where v′∈T v Indicates T v The sampling points v′, y in * Represents the current optimal objective function value, y * is max-L margin (x′ i ); in the generation task, y * is max-L BLEU (x i ), Represents the objective function value calculated by the surrogate model M The predicted distribution of max(y * -y,0) is the measure of improvement, which indicates the improvement value that the current sampling point v′ may bring; S302: For S, use formula (11) to calculate the similarity matrix v ij =sim(S,S), used to quantify the similarity between candidate sampling points, Represents the candidate sampling point v i ′ and v j ′, the similarity matrix is ​​calculated based on the CIIV of the candidate sampling points; S303: Calculate the similarity matrix between a candidate sampling point in S and other candidate sampling points, and use the similarity matrix to select the candidate sampling point with the maximum dissimilarity gain. This process uses a greedy strategy to iteratively select the optimal candidate identifier index vector v * , to maximize the total non-similarity gain of S; in each iteration, select the candidate sampling point that can maximize the diversity gain until S reaches the set maximum capacity; this process is implemented by the following objective function: Among them, arg max represents the independent variable that makes a function reach its maximum value, v′∈T v \S means outside S, from T v Select a new candidate vector v′ from the matrix, det represents the determinant operation, and Respectively represent the posterior covariance matrix of the current S and the updated candidate sampling point set S∪v′; In each sampling iteration, candidate sampling points that have been evaluated in previous iterations are excluded; S304: Input the candidate sampling points in S into the target model for evaluation; during the evaluation process, record the objective function value of each candidate sampling point, and update the posterior distribution of the proxy model, and return to S302 until the set budget limit is reached, and the proxy model no longer updates and outputs the successful adversarial examples selected in each iteration.

Images