Cross-domain adversarial attack method based on pre-trained code model

Abstract

The application discloses a cross-domain adversarial attack method based on a pre-trained code model, aiming to overcome the shortcomings of existing methods in the challenges of data difference and model feedback loss. The method includes the following steps: obtaining source code data, traversing the source code data to identify its basic constituent unit token, the token at least including an identifier and an operator; generating a natural set of alternative identifiers for the extracted identifiers based on a mask language model; applying token-level equivalent transformation to preliminarily optimize the adversarial examples; applying equivalent structure transformation to further convert the preliminarily optimized adversarial examples to obtain the final adversarial examples. The application enhances the migration ability and attack effect of the adversarial examples through structure and token-level disturbance, combined with the mask language model to generate natural alternative identifiers, and combined with greedy search and gradient optimization.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of adversarial attacks, and particularly relates to a cross-domain adversarial attack method based on a pre-trained code model. BACKGROUND

[0002] In recent years, pre-trained code models have been widely used in source code tasks such as vulnerability detection and code author attribution, and the "pre-training-fine-tuning" paradigm is usually adopted: self-supervised pre-training on large-scale datasets, and then supervised fine-tuning on downstream tasks. Although these fine-tuned pre-trained code models perform excellently in tasks, they are vulnerable to adversarial example attacks. Adversarial examples mislead model predictions through minor perturbations, posing security risks such as bypassing code copyright authentication and vulnerability detection tools. Existing adversarial attack methods are divided into two environments: same-domain and cross-domain. In the same-domain environment, attack methods include transfer-based and query-based attacks. Transfer-based attacks assume that attackers have access to the training data of the victim model and use these data to generate adversarial examples; query-based attacks assume that attackers can obtain feedback information from the victim model and generate adversarial examples through query results. However, it is difficult to obtain training data or model feedback in practice, limiting the application effect of these methods. In contrast, attacks in the cross-domain environment are more challenging, as attackers can only access open-source pre-trained models and cannot obtain training data or model feedback from the target domain, that is, fine-tuned pre-trained code models. In this case, attackers need to generate adversarial examples based on limited test samples. To improve the adversarial effect, it is common to maximize the feature difference between adversarial examples and clean examples, and combine greedy algorithms to optimize the generation of adversarial examples to improve their attack ability and stealthiness.

[0003] Existing cross-domain adversarial attack methods can successfully attack fine-tuned pre-trained code models to some extent, but they still have some deficiencies and limitations in dealing with special challenges between different domains. First, these methods usually only perform simple transformations on identifiers (such as variable names, function names), resulting in insufficient diversity of adversarial examples. This makes these attack examples more likely to be detected and defended when migrating between different domains, reducing the effectiveness and stealth of the attack. Second, current methods mostly rely on loss values of embedding vectors to generate adversarial examples, without fully utilizing gradient information to optimize the generation process, which limits the effectiveness and attack success rate of these examples in different domains. In addition, existing methods mainly use genetic algorithms to generate alternative identifiers, which can produce some transformation effects, but the generated identifiers are often unnatural and do not conform to the context of the code or common programming habits. Such unnatural code can cause problems such as affecting code readability or introducing potential logical errors, reducing the stealth and success rate of the attack. Moreover, identifiers that do not conform to habits are more likely to be detected by detection systems during cross-domain migration, increasing the risk of attack failure. Overall, existing methods still have room for improvement in generating more diverse, natural, and efficient adversarial examples. To improve attack effectiveness in actual cross-domain applications, more attention needs to be paid to the naturalness and context consistency of adversarial examples, while optimizing the generation process and exploring more effective strategies to deal with complex changes between different domains. SUMMARY

[0004] The main purpose of the present application is to overcome the shortcomings and deficiencies of the prior art, and to provide a cross-domain adversarial attack method based on pre-trained code models, which introduces perturbations at the level of equivalent structures and tokens, uses the model's masked language prediction function to generate natural alternative identifiers, and combines greedy search and gradient optimization strategies to improve the applicability and attack effectiveness of adversarial examples in different domains.

[0005] To achieve the above purpose, the technical scheme adopted by the present application is as follows:

[0006] In a first aspect, the present application provides a cross-domain adversarial attack method based on pre-trained code models, comprising the following steps:

[0007] Obtain source code data, and traverse the source code data to identify its basic constituent units, tokens, which at least include identifiers and operators;

[0008] Generate a set of natural alternative identifiers for the extracted identifiers based on a masked language model;

[0009] Apply token-level equivalent transformation to preliminarily optimize adversarial examples;

[0010] The preliminary optimized adversarial example is further converted by applying equivalent structure transformation to obtain the final adversarial example.

[0011] As a preferred technical solution, the source code data is obtained, and the basic constituent unit token of the source code data is identified by traversing the source code data, specifically:

[0012] A source code set from different downstream task data sets is received, and each source code is preprocessed to remove single-line comments, multi-line comments, document comments and blank lines to reduce irrelevant information interference.

[0013] The source code is traversed character by character by a lexical analyzer to identify the basic constituent unit token.

[0014] The occurrence position and frequency of identifiers, operators and control structures are recorded to provide a basis for subsequent code conversion for semantic preservation.

[0015] As a preferred technical solution, the mask language model is used to generate a set of natural alternative identifiers for the extracted identifiers, specifically:

[0016] All identifiers in each source code are sequentially subjected to a mask operation.

[0017] The masked source code is input into a preset mask language model, and based on the context information, a plurality of potential alternative identifiers are generated.

[0018] The generated alternative identifiers are screened so that the screened alternative identifiers meet the programming specification and semantic requirements of the context.

[0019] A natural alternative identifier set is constructed based on the screened alternative identifiers, which is used in the subsequent generation process of the adversarial example.

[0020] As a preferred technical solution, the equivalent structure transformation is applied to generate a preliminary adversarial example, specifically:

[0021] Calculate the importance of the identifier: replace each identified identifier with a placeholder to simulate its absence; then input the original code and the code containing the placeholder into the pre-trained code model to obtain the first feature vector and the second feature vector respectively; the importance of the identifier is represented by calculating the L2 norm of the first feature vector and the second feature vector; all identifiers are sorted according to the importance score;

[0022] Replacing identifier and optimizing selection using gradient information: replace the sorted identifiers one by one, and decide whether to replace through its gradient information, specifically: for each identifier, generate K alternative identifiers as the alternative set I, replace the original identifier with the K alternative identifiers in the set, get K replaced code examples x'; find the optimal alternative identifier by calculating the difference between x' and the original code example x based on the gradient information; if the optimal alternative identifier is not found, do not replace, continue the next iteration, and judge whether the next identifier is replaced;

[0023] Calculate the optimal replacement using gradient information: for each replaced identifier code example x_sub, calculate the gradient of the example with respect to the model loss function And through the sign function Extract the direction information of the gradient; multiply the sign function by a small perturbation coefficient ∈, generate a perturbation And apply the perturbation to the original embedding representation x_orig to get the adversarial input Predict the logits output f(x_adv) and the predicted label of the adversarial input x_adv through the pre-trained code model; if the maximum logits value decreases significantly, it means that the adversarial example is effective, and the maximum logits value is the classification confidence of the pre-trained code model; by evaluating the impact of each alternative identifier on the model, select the identifier that makes the pre-trained code model confidence drop to the lowest as the optimal replacement scheme; through the replacement and evaluation of each identifier, the preliminary adversarial example is finally formed;

[0024] Operator level replacement optimization: after obtaining the preliminary adversarial example x_adv, further replace the operator level, specifically: based on the occurrence frequency and position information of the operators in the source code, decide whether to perform operator equivalent replacement in the form of probability; after the operator level replacement, the adversarial example after Token level transformation is further optimized.

[0025] As a preferred technical solution, the importance of the identifier is calculated by the following formula:

[0026]

[0027] Where, ||.||2 2 2 represents the square L2 norm, which is used to measure the change of code features after inserting the placeholder, F(x) represents the first feature vector, and F(x') represents the second feature vector; OSI represents the importance of the identifier, the larger the OSI value, the greater the influence of the identifier on the code features, and the higher the importance.

[0028] As a preferred technical solution, the application equivalent structure transformation is used to further convert the preliminary optimized adversarial examples to obtain final adversarial examples, specifically:

[0029] Replacement of branch structure: analyze the source code structure, identify the parts that can be transformed equivalently, and determine whether to replace them in the form of probability according to the number of branch structures in the code. These replacements can evade detection tools based on static analysis and generate more concealed adversarial examples.

[0030] Insertion of redundant code: sort the importance of each line of code position, and then determine whether to insert redundant code. The necessity of insertion is determined according to random probability. The insertion of redundant code further increases the complexity of adversarial examples, making them more difficult to be detected.

[0031] As a preferred technical solution, it also includes the step of evaluating the migration ability of the optimized adversarial examples, specifically

[0032] Using pre-trained code models to generate adversarial examples on multiple tasks and datasets, and then applying these examples to pre-trained code models that have been fine-tuned on the same task dataset;

[0033] By comparing the attack success rate and stability of these fine-tuned pre-trained code models on adversarial examples, analyze the migration effect and robustness of examples in different fine-tuned pre-trained code models and tasks;

[0034] If these examples can effectively reduce the prediction accuracy of fine-tuned pre-trained code models in multiple environments, it means that these examples have good cross-domain migration ability. According to the evaluation results, further optimize the generation strategy to improve the applicability and attack effect of adversarial examples.

[0035] In the second aspect, the present application also provides a cross-domain adversarial attack system based on pre-trained code models, which is applied to the cross-domain adversarial attack method based on pre-trained code models, and includes a source code data acquisition module, a substitute identifier production module, a first equivalent transformation module, and a second equivalent transformation module.

[0036] The source code data acquisition module is used to acquire source code data, and identify the basic constituent units token of the source code data by traversing the source code data. The token at least includes an identifier and an operator.

[0037] The substitute identifier production module is used to generate a set of natural substitute identifiers for the extracted identifiers based on a mask language model.

[0038] The first equivalent transformation module is used to preliminarily optimize adversarial examples by applying token-level equivalent transformation.

[0039] The second equivalent transformation module applies an equivalent structure transformation to the preliminary optimized adversarial example for further conversion to obtain a final adversarial example.

[0040] In a third aspect, the present application further provides an electronic device, characterized in that the electronic device comprises:

[0041] at least one processor; and,

[0042] a memory in communication with the at least one processor; wherein,

[0043] The memory stores computer program instructions executable by the at least one processor, and the computer program instructions are executed by the at least one processor to enable the at least one processor to execute the cross-domain adversarial attack method based on the pre-trained code model.

[0044] In a fourth aspect, the present application provides a computer readable storage medium storing a program, wherein the program is executed by a processor to implement the cross-domain adversarial attack method based on the pre-trained code model.

[0045] Compared with the prior art, the present application has the following advantages and beneficial effects:

[0046] 1. Improve the diversity and stealth of adversarial examples: By introducing different levels of changes in the code (such as code structure and basic element (Token) transformation), the possible selection range of adversarial attacks is expanded, making the generated attack examples more diverse and complex between different fields. Such diversity helps to avoid the defense systems specific to each field and is more difficult to detect, thereby improving the stealth and effectiveness of the attack.

[0047] 2. Improve the generation efficiency and effectiveness of adversarial examples: The present application optimizes the generation process by making full use of the gradient information of the code, rather than relying solely on traditional methods. This approach can more accurately generate adversarial examples, improve the attack success rate and misleading effect on the victim model, and greatly reduce the time and computing resources required for generation in different field environments.

[0048] 3. Generate natural and effective alternative identifiers: The present application uses the model's mask language prediction function to generate alternative identifiers that are natural and reasonable in both the source and target fields, consistent with programming habits and context, thereby enhancing the stealth and practicality of adversarial examples in cross-domain attacks. At the same time, through greedy search, more suitable alternative identifiers are quickly found, and selection is further optimized, improving the efficiency of generation and the accuracy of attacks.

[0049] 4. Enhance the applicability of adversarial attacks in multiple fields and model robustness: The method of the present application can not only be used for source code classification tasks, but also effectively apply adversarial examples in different field tasks, expanding the scope of use. The more natural and adaptive adversarial examples generated help to enhance the stability of the model, making the model more resistant when facing cross-domain adversarial attacks. BRIEF DESCRIPTION OF DRAWINGS

[0050] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0051] Figure 1 Flow chart of the cross-domain adversarial attack method based on the pre-trained code model of the embodiment of the present application;

[0052] Figure 2 Process diagram for generating final adversarial examples in the embodiment of the present application;

[0053] Figure 3 Block diagram of the cross-domain adversarial attack system based on the pre-trained code model of the embodiment of the present application.

[0054] Figure 4 Structure diagram of the electronic device of the embodiment of the present application. DETAILED DESCRIPTION

[0055] In order to make the person skilled in the art better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely in the following with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0056] In the present application, the phrase "embodiment" means that the specific features, structures or characteristics described in conjunction with the embodiment can be included in at least one embodiment of the present application. The appearance of this phrase in the specification does not necessarily mean the same embodiment, nor is it an independent or alternative embodiment to other embodiments. Those skilled in the art explicitly and implicitly understand that the embodiments described in the present application can be combined with other embodiments.

[0057] The application aims to solve the problem of how to effectively generate adversarial samples and attack source code models in the case of being unable to obtain data or model feedback of the target field, thereby improving the applicability of adversarial attacks in different fields. Current source code classification models are usually pre-trained in the source field in a self-supervised manner, and then fine-tuned in the target field in a supervised manner. Although they can perform well in the transfer task, they are easy to be misled by adversarial examples, which are generally generated by keeping the code semantics unchanged. While existing attack methods for generating adversarial examples mostly rely on query feedback of the target model, which is difficult to implement in practical applications. Therefore, the application proposes a cross-domain adversarial attack method based on pre-trained code models, which uses open-source pre-trained code models and limited test samples to effectively attack code models in unknown fields without relying on data in the target field.

[0058] Referring to Figure 1 The embodiment provides a cross-domain adversarial attack method based on a pre-trained code model, which generates natural alternative identifiers through structural and token-level perturbation, mask language, and combines greedy search and gradient optimization to enhance the transferability and attack effect of adversarial examples, including the following steps:

[0059] S1, obtaining source code data, traversing the source code data to identify the basic constituent unit token thereof;

[0060] Further, step S1 is specifically:

[0061] S11, first receiving a source code set from different downstream task data sets, preprocessing each source code to remove single-line comments, multi-line comments, document comments and blank lines to reduce irrelevant information interference, thereby ensuring the accuracy and naturalness of the subsequent generated adversarial examples.

[0062] S12, traversing the source code character by character through a lexical analyzer to identify the basic constituent unit (token) thereof, including keywords, identifiers, operator separators and constants, etc. In the embodiment, identifiers and operators are specifically used. At the same time, the system accurately records the occurrence position and frequency of identifiers, operators and control structures (such as if, while, etc.), providing a basis for subsequent code conversion with semantic preservation.

[0063] S2, generating a set of natural alternative identifiers for the extracted identifiers based on a mask language model;

[0064] Further, step S2 is specifically:

[0065] S21, sequentially performing a mask operation on all identifiers in each source code;

[0066] S22, input the masked code into a preset masked language model, and predict based on context information to generate a plurality of potential alternative identifiers;

[0067] S23, screening the generated alternative identifiers to ensure that they meet the programming specifications and context semantic requirements;

[0068] S24, constructing a natural alternative identifier set for subsequent generation of adversarial examples.

[0069] In a specific example, the set of alternative identifiers for different identifiers in each piece of source code can be represented as I i,j Where i is the ith identifier, j is the jth alternative identifier of the ith identifier, I is the set of all alternative identifiers, that is: I = {I i，j |i∈{1,...,N},j∈{1,...,Q i}};

[0070] Where N is the total number of identifiers in the code, Q i is the number of alternative identifiers corresponding to the ith identifier.

[0071] S3, apply token-level equivalent transformation to preliminarily optimize adversarial examples; Token-level equivalent replacement focuses on the basic elements of the code (such as variable names, operators, etc.), and the specific steps are as follows:

[0072] S31, calculate the importance of the identifier, which is measured by calculating its impact on the code features.

[0073] For each identifier in the set of identifiers extracted in step S1, replace it with a placeholder to simulate its absence. Then, input the original code x and the code containing the placeholder x' into the pre-trained code model M to obtain their first feature vector F(x) and second feature vector F(x'), respectively. The importance of the identifier (OSI) is calculated by the following formula:

[0074]

[0075] Where ||.||2 2 2 represents the squared L2 norm (Euclidean distance) for measuring the amount of change in code features after inserting the placeholder; the larger the OSI value, the greater the impact of the identifier on the code features, and the higher the importance. Sort all identifiers by their importance scores.

[0076] S32, replace the identifier and use gradient information to optimize the selection:

[0077] The sorted identifiers are replaced in sequence, and the gradient information is used to determine whether to replace. For each identifier, K alternative identifiers are generated as the alternative set I, and the original identifier is replaced with the K alternative identifiers in the set to obtain K replaced code examples x'. By calculating the difference between x' and x based on the gradient information, the optimal alternative identifier is found. If the optimal alternative identifier is not found, no replacement is made, and the next iteration is continued to determine whether the next identifier is replaced.

[0078] S33, calculating the optimal replacement using gradient information:

[0079] For each replaced identifier code example x_sub, the gradient of the example with respect to the pre-trained code model loss function is calculated And through the sign function The direction information of the gradient is extracted (+1 means increase, -1 means decrease the corresponding feature value). Multiply these sign information by a small perturbation coefficient ∈ to generate perturbation And apply it to the original embedding representation x_orig to get the adversarial input The logits output f(x_adv) and the predicted label of the adversarial input x_adv are predicted by the pre-trained code model. If the maximum logits value (model classification confidence) drops significantly, it indicates that the adversarial example is effective. By evaluating the effect of each alternative identifier on the pre-trained code model, the identifier that makes the pre-trained code model confidence drop to the lowest is selected as the optimal replacement scheme. Through the replacement and evaluation of each identifier, the complete adversarial code is finally formed.

[0080] S34, operator level replacement optimization:

[0081] After obtaining the preliminary adversarial example x_adv, further operator level replacement is performed. In step S1, the occurrence frequency and position information of the operators in the code are recorded, and whether to perform operator equivalent replacement (such as replacing ++ with +=) is determined in the form of probability. After operator level replacement, the adversarial example after Token level transformation is further optimized.

[0082] S4, applying equivalent structure transformation to further transform the preliminary optimized adversarial example to obtain the final adversarial example.

[0083] Further, step S4 is specifically:

[0084] S41, replacement of branch structure:

[0085] System analysis source code structure, identify can be equivalent transformation part (such as loop structure, conditional branch, etc.). According to the number of branch structure in the code in the form of probability to determine whether to replace (such as for loop rewritten as equivalent while loop, or embedded if-else into equivalent switch-case statement). These transformations can escape the detection tools based on static analysis, generate more covert adversarial examples.

[0086] S42, the insertion of redundant code:

[0087] According to the importance of each line of code position sorting, in turn, whether to insert redundant code, according to the random probability to determine the necessity of insertion. The insertion of redundant code further increases the complexity of the adversarial example, makes it more difficult to be detected.

[0088] After the above Token level and equivalent structure level replacement and optimization steps, finally get a comprehensive optimization of the adversarial example.

[0089] It can be understood that the process of generating the final adversarial example is as Figure 2 shown, the process starts from the preprocessed source code example, through a series of Token level and structure level equivalent transformation, gradually optimize the diversity and concealment of adversarial examples.

[0090] Further, in order to seriously generated adversarial examples, also includes the following steps:

[0091] S5, evaluate the migration ability of adversarial examples; evaluate the migration ability of adversarial examples is the key step to verify their effective attack on different tasks and models, specifically:

[0092] S51, use pre-trained code model in a variety of tasks (such as code classification, code similarity detection) and data set to generate adversarial examples, and then apply these examples to the pre-trained code model after the same task data set fine-tuning;

[0093] S52, by comparing the attack success rate and stability of these models on adversarial examples, analyze the migration effect and robustness of examples in different fine-tuned pre-trained code model and task. If these examples can effectively reduce the prediction accuracy of fine-tuned pre-trained code model in a variety of environments, it shows that they have good cross-domain migration ability;

[0094] S53, according to the evaluation results, further optimize the generation strategy, improve the applicability and attack effect of adversarial examples.

[0095] The core of the present application is to develop a cross-domain adversarial attack scheme based on a pre-trained code model, which can create effective adversarial instances to challenge the source code model in the absence of target domain data or model response. The innovative elements protected by this scheme cover three main aspects: first, by introducing equivalent perturbations at the structural and token levels, the exploration range of adversarial attacks is expanded, and the diversity of adversarial instances is enhanced; second, by using a masked language model, that is, the masked prediction function of the model, to generate natural replacement identifiers, ensuring that the code follows programming standards and maintains contextual consistency; finally, by combining gradient optimization and greedy search strategies, the efficiency of generating adversarial instances and the success probability of attacks are improved.

[0096] Compared with traditional technical means, the present application is not limited to basic conversion at the identifier level, but further integrates more complex structural level conversion and fine token level perturbation to promote the diversification of adversarial instances. Traditional methods often rely on genetic algorithms or embedded vector loss information to generate adversarial instances, which may result in unnatural or easily identifiable instances. In contrast, the present application generates natural replacement identifiers using a masked language model and optimizes the generation process using gradient information, ensuring that adversarial instances exhibit higher concealment, naturalness, and attack efficiency in cross-domain environments, while having stronger practical application value and robustness.

[0097] In summary, the present application has the advantages of generating more diverse, concealed, and natural adversarial instances, and faster generation speed compared to existing technologies. The main innovations are: introducing equivalent perturbations at the structural and token levels, broadening the exploration space of adversarial attacks, allowing adversarial instances to better respond to defense measures in different domains; using a masked language model to generate replacement identifiers that conform to programming standards, and combining gradient optimization and greedy search strategies to speed up the selection process of replacement identifiers, ensuring that the generated code is natural and efficient; in addition, using gradient information to optimize the generation process instead of relying solely on embedded vector loss, making adversarial instances more accurate and efficient, significantly improving the success rate and efficiency of attacks in cross-domain environments.

[0098] It should be noted that for the foregoing method embodiments, in order to simplify the description, they are all described as a series of action combinations, but those skilled in the art should know that the present application is not limited by the order of the described actions, because according to the present application, certain steps can be performed in other orders or simultaneously.

[0099] Based on the same idea as the cross-domain adversarial attack method based on the pre-trained code model in the above embodiment, the application also provides a cross-domain adversarial attack system based on a pre-trained code model, which can be used to execute the above cross-domain adversarial attack method based on a pre-trained code model. For the convenience of description, in the structural schematic diagram of the cross-domain adversarial attack system based on a pre-trained code model embodiment, only the parts related to the embodiments of the application are shown, and those skilled in the art can understand that the illustrated structure does not constitute a limitation on the device, and can include more or fewer components than the illustrated, or combine certain components, or different component arrangements.

[0100] Please refer to Figure 3 In another embodiment of the present application, a cross-domain adversarial attack system based on a pre-trained code model 100 is provided, which comprises a source code data acquisition module 101, a substitute identifier production module 102, a first equivalent transformation module 103 and a second equivalent transformation module 104.

[0101] The source code data acquisition module 101 is used to acquire source code data, and to identify the basic constituent unit token of the source code data by traversing the source code data, wherein the token at least includes an identifier and an operator;

[0102] The substitute identifier production module 102 is used to generate a set of natural substitute identifiers for the extracted identifiers based on a mask language model;

[0103] The first equivalent transformation module 103 applies token-level equivalent transformation to preliminarily optimize the adversarial examples;

[0104] The second equivalent transformation module 104 applies equivalent structure transformation to further convert the preliminarily optimized adversarial examples to obtain the final adversarial examples.

[0105] It should be noted that the cross-domain adversarial attack system based on a pre-trained code model of the present application corresponds to the cross-domain adversarial attack method based on a pre-trained code model of the present application one by one, and the technical features and beneficial effects described in the above embodiment of the cross-domain adversarial attack method based on a pre-trained code model are applicable to the cross-domain adversarial attack based on a pre-trained code model embodiment, and the specific content can be referred to the description in the method embodiment of the present application, which will not be repeated here, and hereby declared.

[0106] Further, in the implementation of the cross-domain adversarial attack system based on the pre-trained code model of the above-mentioned embodiments, the logical division of each program module is only illustrative. In actual application, the above-mentioned function allocation can be completed by different program modules according to needs, for example, for the configuration requirements of the corresponding hardware or the convenience of software implementation. That is, the internal structure of the cross-domain adversarial attack system based on the pre-trained code model is divided into different program modules to complete all or part of the functions described above.

[0107] Please refer to Figure 4 In one embodiment, an electronic device implementing a cross-domain adversarial attack method based on a pre-trained code model is provided. The electronic device 200 can include a first processor 201, a first memory 202, and a bus. It can also include a computer program stored in the first memory 202 and executable on the first processor 201, such as a cross-domain adversarial attack program based on a pre-trained code model 203.

[0108] The first memory 202 includes at least one type of readable storage medium, including a flash memory, a mobile hard disk, a multimedia card, a card-type memory (e.g., an SD or DX memory, etc.), a magnetic memory, a magnetic disk, an optical disk, etc. The first memory 202 can be an internal storage unit of the electronic device 200 in some embodiments, such as a mobile hard disk of the electronic device 200. The first memory 202 can also be an external storage device of the electronic device 200 in other embodiments, such as a plug-in mobile hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. Further, the first memory 202 can include both an internal storage unit and an external storage device of the electronic device 200. The first memory 202 can be used not only to store application software and various data installed on the electronic device 200, such as the code of the cross-domain adversarial attack program based on a pre-trained code model 203, but also to temporarily store data that has been or will be output.

[0109] The first processor 201 may, in some embodiments, be composed of integrated circuits, for example, may be composed of a single packaged integrated circuit, or may be composed of multiple packaged integrated circuits of the same function or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and combinations of various control chips, etc. The first processor 201 is the control unit of the electronic device, which connects various components of the entire electronic device through various interfaces and lines, and executes various functions and processes data of the electronic device 200 by running or executing programs or modules stored in the first memory 202 and calling data stored in the first memory 202.

[0110] Figure 4 Only the electronic device with components is shown, and those skilled in the art can understand that, Figure 4 The structure shown does not constitute a limitation on the electronic device 200, and can include fewer or more components than shown, or combine certain components, or different component arrangements.

[0111] The first memory 202 in the electronic device 200 stores a cross-domain adversarial attack program 203 based on a pre-trained code model, which is a combination of multiple instructions and can achieve the following when running in the first processor 201:

[0112] Obtain source code data, and traverse the source code data to identify basic constituent units tokens, including keywords, identifiers, operators, delimiters, and constants;

[0113] Generate a set of natural alternative identifiers for the extracted identifiers based on a mask language model;

[0114] Apply token-level equivalent transformation to preliminarily optimize the adversarial examples;

[0115] Apply equivalent structure transformation to further transform the preliminarily optimized adversarial examples to obtain final adversarial examples.

[0116] Further, the modules / units of the electronic device 200, if implemented in the form of software function units and sold or used as independent products, can be stored in a non-volatile computer readable storage medium. The computer readable medium can include any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM).

[0117] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by a computer program instructing relevant hardware. The program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiment methods. Any reference to memory, storage, database or other medium used in the embodiments provided by the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0118] Any combination of the technical features of the above embodiments can be made. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combination of the technical features does not exist, it should be considered as the scope of the present application.

[0119] The above embodiments are the preferred embodiments of the present application, but the embodiments of the present application are not limited to the above embodiments, and any changes, modifications, substitutions, combinations and simplifications made without departing from the spirit and principles of the present application shall be equivalent replacement methods and shall be within the scope of protection of the present application.

Claims

1. A cross-domain adversarial attack method based on a pre-trained code model, characterized in that, The method comprises the following steps: Obtaining source code data, traversing the source code data to identify its basic constituent unit token, the token at least including an identifier and an operator; Based on the mask language model, a set of natural alternative identifiers is generated for the extracted identifier, specifically: Masking each identifier in the source code in turn; Input the masked source code into a preset mask language model, and predict based on the context information to generate multiple potential alternative identifiers; Screening the generated alternative identifiers to make the screened alternative identifiers meet the programming specification and the semantic requirements of the context; Based on the screened alternative identifiers, a natural alternative identifier set is constructed for the subsequent generation process of the adversarial example; Applying token-level equivalent transformation to preliminarily optimize the adversarial example, including: calculating the importance of the identifier, and sorting all identifiers according to the importance score; Replace the sorted identifiers in turn, and decide whether to replace through the gradient information, find the optimal alternative identifier by calculating the difference with the original code example based on the gradient information; calculate the optimal replacement by using the gradient information, and finally form the preliminary adversarial example through the replacement and evaluation of each identifier; After obtaining the preliminary adversarial example x_adv, further replace the operator level; Applying equivalent structure transformation to further convert the preliminarily optimized adversarial example to obtain the final adversarial example, specifically: Branch structure replacement: analyze the source code structure, identify the part that can be transformed equivalently, and decide whether to replace according to the number of branch structures in the code in the form of probability. These replacements can escape the detection tools based on static analysis and generate more concealed adversarial examples; Inserting redundant code: according to the importance of the position of each line of code, judge whether to insert redundant code in turn, and decide the necessity of insertion according to the random probability; the insertion of redundant code further increases the complexity of the adversarial example, making it more difficult to be detected.

2. The cross-domain adversarial attack method based on a pre-trained code model according to claim 1, characterized in that, The source code data is obtained, and the basic constituent unit token of the source code data is identified, specifically: Receiving a source code set from different downstream task data sets, preprocessing each source code, removing single-line comments, multi-line comments, document comments and blank lines to reduce irrelevant information interference; Traverse the source code character by character through the lexical analyzer to identify its basic constituent unit token; Record the appearance position and frequency of identifiers, operators and control structures to provide a basis for subsequent semantic-preserving code conversion.

3. The cross-domain adversarial attack method based on a pre-trained code model according to claim 1, characterized in that, The token-level equivalent transformation is applied to preliminarily optimize the adversarial example, specifically: Calculate the importance of the identifier: replace each identified identifier with a placeholder to simulate its absence; then input the original code and the code containing the placeholder into the pre-trained code model to obtain the first feature vector and the second feature vector respectively; the importance of the identifier is represented by calculating the L2 norm of the first feature vector and the second feature vector; all identifiers are sorted according to the importance score; Replacing identifiers and optimizing selection using gradient information: Replace the identifiers in sequence after sorting, and decide whether to replace through their gradient information. Specifically, for each identifier, generate K alternative identifiers as the replacement set I, replace the original identifier with the K alternative identifiers in the set, and obtain K replaced code examples x'; Find the optimal alternative identifier by calculating the difference between x' and the original code example x based on gradient information. If the optimal alternative identifier is not found, do not replace and continue the next iteration to determine whether the next identifier is replaced. Calculate the optimal replacement using gradient information: For each replaced identifier code example x_sub, calculate the gradient ∇f(x_sub) of the example with respect to the model loss function, and extract the direction information of the gradient through the sign function sign(∇f(x_sub)). Multiply the sign function by a small perturbation coefficient ϵ to generate a perturbation ϵ⋅sign(∇f(x_sub)), and apply the perturbation to the original embedding representation x_orig to obtain the adversarial input x_adv = x_orig + ϵ⋅sign(∇f(x_sub)). Predict the logits output f(x_adv) and the predicted label of the adversarial input x_adv through the pre-trained code model. If the maximum logits value decreases significantly, it indicates that the adversarial example is effective, and the maximum logits value is the classification confidence of the pre-trained code model. By evaluating the impact of each alternative identifier on the model, select the identifier that makes the pre-trained code model confidence drop to the lowest as the optimal replacement scheme. Through the replacement and evaluation of each identifier, the preliminary adversarial example is finally formed. Operator-level replacement optimization: After obtaining the preliminary adversarial example x_adv, further replace the operators at the operator level. Specifically, based on the occurrence frequency and position information of the operators in the source code, decide whether to perform operator equivalent replacement in the form of probability. After operator-level replacement, the adversarial example after Token-level transformation is further optimized.

4. The cross-domain adversarial attack method based on a pre-trained code model according to claim 3, characterized in that, The importance of the identifier is calculated by the following formula: ； wherein, represents the square of the L2 norm, used to measure the amount of change of the code features after inserting the placeholder, F(x) represents the first feature vector, F(x') represents the second feature vector; OSI represents the importance of the identifier, the larger the OSI value, the greater the influence of the identifier on the code features, and the higher the importance.

5. The cross-domain adversarial attack method based on a pre-trained code model according to claim 1, characterized in that, It also includes the step of evaluating the transferability of the optimized adversarial examples, which is Use the pre-trained code model to generate adversarial examples on multiple tasks and datasets, and then apply these examples to the pre-trained code models fine-tuned on the same task dataset; By comparing the attack success rate and stability of these fine-tuned pre-trained code models on adversarial examples, analyze the transfer effect and robustness of examples in different fine-tuned pre-trained code models and tasks; If these examples can effectively reduce the prediction accuracy of fine-tuned pre-trained code models in multiple environments, it means that these examples have good cross-domain transferability. According to the evaluation results, further optimize the generation strategy to improve the applicability and attack effect of adversarial examples.

6. A cross-domain adversarial attack system based on a pre-trained code model, characterized in that, The pre-trained code model-based cross-domain adversarial attack method of any one of claims 1-5, comprising a source code data acquisition module, a substitute identifier production module, a first equivalent transformation module, and a second equivalent transformation module; The source code data acquisition module is configured to acquire source code data, and identify basic constituent units, tokens, of the source code data, the tokens comprising at least identifiers and operators; The substitute identifier production module is configured to generate a set of natural substitute identifiers for the extracted identifiers based on a mask language model; The first equivalent transformation module is configured to preliminarily optimize the adversarial examples by token-level equivalent transformation; The second equivalent transformation module is configured to further convert the preliminarily optimized adversarial examples by equivalent structure transformation to obtain final adversarial examples.

7. An electronic device, comprising: The electronic device comprises: at least one processor; and a memory connected to the at least one processor in communication; wherein The memory stores computer program instructions executable by the at least one processor, and the computer program instructions are executed by the at least one processor to enable the at least one processor to execute the pre-trained code model-based cross-domain adversarial attack method of any one of claims 1-5.

8. A computer-readable storage medium storing a program, characterized in that, The program is executed by the processor to implement the pre-trained code model-based cross-domain adversarial attack method of any one of claims 1-5.

Images