An evaluation and defense method against code language model attack

Abstract

The present application relates to a kind of evaluation and defense methods for code language model attack, including data construction, two data sets are constructed, one is used to fine-tune code language model to improve its evaluation accuracy, another data set is used to fine-tune code language model to improve its purification accuracy;A piece of code is input into fine-tuned one code language model to be evaluated, when evaluation value is less than predetermined threshold, it indicates that input code has been attacked;Then the piece of code is input into fine-tuned another code language model to be purified, and output purified code.The method is at least 93% in evaluation ability, consistent with human evaluation in different attack scenarios, tolerance is 1.In terms of defense ability, in most attack combinations, its performance exceeds the commonly used countermeasures fine-tuning method, and the maximum improvement is more than 83.63%.

Description

Technical Field

[0001] This invention relates to the field of adversarial attack defense technology, and in particular to an evaluation and defense method for adversarial attacks on code language models. Background Technology

[0002] Code language models (CLMs) have demonstrated exceptional capabilities in a range of software engineering tasks, such as code generation, code summarization, and vulnerability detection. However, the increasing reliance on these models has also raised concerns about their robustness, particularly their vulnerability to adversarial attacks. A common approach in existing methods is identifier substitution attacks, which subtly perturb the code by replacing identifier names, altering the predicted output of the code's intelligent neural model. Naturalness is a fundamental requirement for generating adversarial examples. Similar to the requirement in natural language processing that adversarial examples maintain their original semantics and correct syntax, adversarial code examples should also conform to human naming conventions and coding standards. Unnatural adversarial examples are likely to be easily identified and removed during code review.

[0003] To determine whether the adversarial samples generated by existing attack methods are sufficiently covert and imperceptible, or whether they are truly detectable, the naturalness of current attack methods was investigated. First, a large number of adversarial samples were obtained based on four popular identifier substitution attacks: WIR, MHM, ALERT, and Beam-Attack. Specifically, the original samples were taken from benchmarks of three downstream tasks: clone detection, vulnerability detection, and code digest. CodeBERT, CodeGPT, and PLBART were selected as victim models. A total of 36 attack scenarios were generated (4 attack methods × 3 victim models × 3 tasks). Details regarding the dataset and attack settings are consistent with the experimental section of this invention. Then, using... Figure 2 The prompt template shown here queries GPT-4 in an open-ended manner, requesting it to provide a Naturalness Evaluation Score (NES) and a reasonableness analysis for the collected adversarial code based on the evaluation criteria in the template. The naturalness of adversarial examples is measured on a score range of 1 to 5, with higher scores indicating a higher degree of naturalness and a lower probability of attack. Table 1 shows the proportion and weighted average score of adversarial code generated by each attack method under different attack combinations within different score ranges. It can be observed that the vast majority of adversarial examples have low NES scores (defined as 1-2 points), even including methods that incorporate naturalness constraints during the attack process, such as ALERT and Beam-Attack. In each attack combination, at least 80% of the samples score no more than 3 points (defined as high scores). This indicates that adversarial examples generated by current identifier substitution attacks generally lack naturalness. Figure 3The NES density distribution of each attack method across different tasks and models is visually illustrated. We can see that each method exhibits a similar density distribution across different downstream tasks and victim models, suggesting that downstream tasks and models may not be the primary factors influencing the naturalness of adversarial code; rather, the root cause likely lies in the attack algorithm itself. This demonstrates that the NES of most adversarial examples generated through identifier substitution are in the low range, indicating that in most cases, the attack disrupts the naturalness of the original code.

[0004] Existing adversarial attack defense methods are primarily proactive, involving collecting adversarial examples and then retraining or fine-tuning the victim model adversarially. This approach incurs high training costs and can easily lead to lower model performance than the original. Furthermore, collecting a large number of adversarial examples is difficult, and the retrained target model exhibits poor generalization performance against unknown attack methods. The inherent limitations of adversarial examples offer a potential approach: defense from outside the victim model—a passive defense method. This method avoids retraining the target model, is less costly, and also avoids the risk of performance degradation.

[0005] Table 1 shows the NES ratios of the four attack methods under different model and task combinations. Avg. Score refers to the weighted average score of NES (i.e., the sum of the scores multiplied by their respective ratios).

[0006] Summary of the Invention

[0007] To address the aforementioned problems in existing technologies, the technical problem this invention aims to solve is: to defend against identifier substitution attacks by utilizing the natural defects of adversarial examples. This passive defense method, compared to existing active defense methods, does not require the target model to be retrained from scratch and does not pose a risk of reducing model performance.

[0008] To address the aforementioned technical problems, the present invention adopts the following technical solution: a method for evaluating and defending against adversarial attacks on code language models, comprising the following steps:

[0009] S1: Data construction, execution of attacks using adversarial examples, and collection of successful adversarial examples.

[0010] We employ a large-scale LLM to evaluate and sanitize successful adversarial examples: We design a cue template to sanitize successful adversarial examples based on the cue template; we annotate the naturalness state of each successful adversarial example with a score from 1 to 5, and provide analysis and justification.

[0011] The successful adversarial examples that have been evaluated, along with their corresponding annotations and analyses, constitute training sample 1. The purified successful adversarial examples and their hint templates constitute training sample 2.

[0012] S2: Fine-tuning the Local Lightweight LLM: Train the first local lightweight LLM using training sample 1, and calculate the scoring loss. when The fine-tuned local lightweight LLM #1 was obtained without further descent; a local lightweight LLM #2 with the same structure as the local lightweight LLM #1 was trained using training sample #2, and the purification loss was calculated. when The code language model No. 2 was fine-tuned and no longer decreased.

[0013] S3: Evaluation and Purifier. It receives a code input and performs an evaluation on a finely tuned local lightweight LLM No. 1. When the evaluation value is less than a predetermined threshold, it indicates that the input code has been attacked.

[0014] The attacked code is input into the finely tuned local lightweight LLM #2 for purification, and the purified code is output.

[0015] Furthermore, in S1, GPT-4 is used for evaluation and purification, suggesting that GPT-4 be analyzed in a chain-thinking CoT manner.

[0016] Furthermore, the scoring loss in S2 The calculation process is as follows:

[0017]

[0018] Among them, c ori and c adv These represent the original code and the perturbation code, respectively. (Instruction) eval This indicates the instructions used to evaluate the task; NES indicates the score required; and e indicates the interpretation of that score.

[0019] Furthermore, the purification loss in S2 The calculation process is as follows:

[0020]

[0021] Among them, c puri Instruction represents the cleaned-up code. puri This indicates the instructions used for the purification task.

[0022] Compared with the prior art, the present invention has at least the following advantages:

[0023] This paper re-evaluates and reveals the inherent flaws in existing identifier substitution attack methods from a naturalistic perspective. This provides a new approach to defending against such attacks. Based on this insight, we propose EPIC, an adversarial evaluation and defense framework based on LLM-as-a-Judge. EPIC can simulate human thinking to evaluate the quality of adversarial examples, analyze potential natural weaknesses, and cleanse perturbed examples, enabling the victim model to recover correct outputs. Experimental results show that, in terms of evaluation capability, EPIC achieves highly consistent results with GPT-4 using only 7B parameters, with at least 93% consistency with human evaluation across different attack scenarios and a tolerance of 1. In terms of defense capability, EPIC achieves cleansing results almost equivalent to GPT-4, allowing the victim model to recover correct predictions for the vast majority of adversarial examples. In most attack combinations, its performance surpasses commonly used adversarial fine-tuning methods, with the largest improvement exceeding 83.63%. Attached Figure Description

[0024] Figure 1 An example of an identifier substitution attack, and GPT-4 scoring and analysis of the perturbation from a naturalness perspective.

[0025] Figure 2 This is a prompt template for GPT-4 used for NES acquisition and analysis.

[0026] Figure 3 NES density distribution for adversarial samples generated by different attack methods under various task or victim model combinations.

[0027] Figure 4 The EPIC framework was developed as follows: (a) A large number of adversarial examples were collected from various attack methods and datasets. GPT-4 was then instructed to evaluate the naturalness of these examples or sanitize them. A dataset of 96K examples was obtained by collecting the output of GPT-4. (b) Qwen2.5-coder was selected as a lightweight LLM and fine-tuned on this dataset to develop EPIC. (c) EPIC can help identify whether an unknown code snippet is adversarial. (d) To help the victim model resist attacks, EPIC sanitizes adversarial code to restore correct predictions.

[0028] Figure 5 This is a prompt template for the purification task.

[0029] Figure 6 This is a case study of code cleanup. Modified identifiers are highlighted with underscores compared to the original code. Detailed Implementation

[0030] The present invention will now be described in further detail.

[0031] Leveraging the powerful code understanding capabilities of large language models (LLMs) like GPT-4 and Llama 3, the naturalness of code can be evaluated using LLMs, a method also known as LLM-as-a-Judge. Figure 1 An example of an identifier substitution attack is presented, along with GPT-4's scoring and analysis of the perturbation from a naturalness perspective. For the same identifier, the location where the perturbation first appears is highlighted. In this example, perturbations are applied at two identifier locations. For instance, the identifier "swapBlank" is changed to "swapBlace," where the subword "Blace" has no meaningful context. Furthermore, the identifier "copy" is replaced with "create," a term that could be misleading and introduce semantic ambiguity. We then use LLM, specifically GPT-4, to address this by designing targeted cues (see...). Figure 2 The GPT-4 score was used to assess the naturalness of this adversarial attack. The relatively low score suggests that the adversarial examples lacked sufficient naturalness. This result inspires a potential method for detecting and defending against such attacks: the presence of unnatural identifiers in any given code may indicate an attack, and these identifiers may pinpoint the exact location of the perturbation.

[0032] This invention proposes a method called EPIC, which uses LLMs to evaluate and sanitize identifier substitution attacks in code from a naturalness perspective. Specifically, it introduces an evaluation method based on the LLM-as-a-Judge approach, simulating human judgment to evaluate the naturalness of code snippets and detect signs of adversarial attacks. EPIC considers two aspects: 1) whether the identifier's name is consistent with its actual function, and 2) whether the identifier's name conforms to human programming habits. Based on this, it provides analysis and a naturalness score for the code. If the score is below a set threshold (e.g., less than or equal to 3), it indicates that the code has been attacked. Furthermore, this invention proposes a black-box adversarial code sanitization strategy that identifies the locations of interference and replaces them with context-appropriate names, enabling the model to recover accurate predictions and thus enhancing its robustness. To address data privacy and cost issues, we distill the powerful inference capabilities of GPT-4 into a smaller, local, lightweight LLM. We first use GPT-4 to collect a 50K adversarial code naturalness evaluation dataset and a 46K adversarial-sanitized code pair dataset to support this process. Subsequently, using these two datasets, a lightweight open-source LLM was fine-tuned, resulting in EPIC as an alternative to ultra-large commercial LLMs such as GPT-4 itself.

[0033] The overall framework of this invention: The EPIC framework includes data construction, fine-tuning of a local lightweight LLM, and inference (evaluation and sanitization of a piece of code). EPIC focuses on two defensive tasks: adversarial evaluation and adversarial sanitization. Previous research on evaluating the quality of adversarial examples has primarily relied on statistical metrics such as Identifier Change Rate (ICR) and Average Code Similarity (ACS). However, these metrics mainly measure the overall difference in code before and after the attack, making it difficult to directly capture local semantic changes at the attack location. Furthermore, they fail to reflect biases in human programming habits and are often inconsistent with human cognition. Therefore, this invention proposes using an LLM-as-a-Judge approach to simulate a human perspective, analyzing adversarial examples from a naturalistic standpoint and providing a score that can serve as an interpretable evaluation metric. On the other hand, leveraging a large language model's understanding of the overall operational semantics of the program and its judgment of naturalness can be used to sanitize adversarial code and defend against attacks.

[0034] From an economic and efficiency standpoint, training a specialized, open-source EPIC with fewer parameters is more suitable than using the powerful GPT-4. Furthermore, considering code privacy and security requirements (e.g., the proprietary nature of enterprise code) and the data breach risks associated with commercial LLMs, using a native lightweight LLM instead of a commercial model like GPT-4 is a wise decision. Therefore, this invention proposes distilling the powerful inference capabilities of GPT-4 into a more compact, lightweight native lightweight LLM.

[0035] An evaluation and defense method for adversarial attacks on code language models, EPIC (EPIC is the abbreviation for this method). E valuate and P urify I dentifier substitution attacks in C The process of "ode from a naturalness perspective using LLMs" includes the following steps:

[0036] S1: Data construction, execution of attacks using adversarial examples, and collection of successful adversarial examples.

[0037] Successful adversarial examples are evaluated and cleaned using ultra-large-scale LLMs such as GPT-4: A cue template is designed, and successful adversarial examples are cleaned based on the cue template; the natural state of the examples is annotated, and analysis and justification are provided. Ultra-large-scale LLMs refer to LLMs with more than 100 billion parameters.

[0038] The successful adversarial examples that have been evaluated, along with their corresponding annotations and analyses, constitute training sample 1. The cleaned-up successful adversarial examples and their hint templates constitute training sample 2. All training samples 1 and all training samples 2 together constitute the dataset.

[0039] Instruction fine-tuning based on GPT-4 is a popular and effective method. This method first uses GPT-4 to generate high-quality instruction-response data, and then uses this data to train a local lightweight LLM to mimic the behavior of GPT-4 in handling various instructions.

[0040] Execute the attack. To facilitate the capture of the characteristics of different attacks, this invention only retains successful adversarial samples, which will be used to construct hints for querying GPT-4.

[0041] Query GPT-4. Based on the filtered set of adversarial examples, query GPT-4 in an open-ended manner, asking it to evaluate each adversarial example or sanitize it. For the evaluation and sanitization tasks, this invention designs different prompt templates, but they follow the same analytical perspective: (1) From the perspective of the natural semantics of the identifiers, how relevant is the name of each identifier to its role in the program? (2) In terms of readability and naturalness, does the name of each identifier seem reasonable, like the identifier names that an experienced programmer might choose in a normal coding scenario? Figure 2 and Figure 5 The design details of the cue templates for the two tasks are presented separately. The cue GPT-4 is analyzed using a Chain-of-Thought (CoT) approach to achieve a deep understanding of natural consistency, thereby making the evaluation scores interpretable and leading to effective cleansing results. To provide direction for GPT-4's reasoning, this invention designs necessary steps in both cue templates to simulate how humans handle the same task. The "System Cue" includes the reasoning perspective, processing steps, some output constraints, and specific task details. The "User Content" provides the original adversarial example pairs to be evaluated or cleansed. For the evaluation task, this invention requires GPT-4 to annotate each adversarial example with a score from 1 to 5 and provide analysis. The "Analysis" encourages GPT-4 to present its reasoning process to derive interpretable evaluation scores and also provides a basis for fine-tuning the local lightweight LLM. Finally, the GPT output will be as follows:

[0042] Analysis:<Analysis of annotated score.>

[0043] Score:<Predicted integer score from 1to5.>

[0044] For the cleanup task, the output is relatively simple, containing only the cleaned code. All cleaned code should be queried again in the victim model to filter out unsuccessful cleanup attempts, thus preventing the introduction of noise during the fine-tuning phase. Finally, this invention removes a small subset of samples exceeding the maximum input length limit of the local lightweight LLM (4096 tokens), resulting in an instruction dataset containing over 50K samples for evaluating the naturalness of adversarial examples, and another dataset containing over 46K samples for studying adversarial code cleanup, totaling over 96K samples. The "system prompt" and "user content" in the prompt template correspond to the instructions and inputs in the instruction dataset, respectively, while the GPT-4 output corresponds to the dataset output. This dataset can facilitate research on evaluating the effectiveness of identifier substitution attacks and corresponding defenses.

[0045] S2: Fine-tuning the Local Lightweight LLM: Train the first local lightweight LLM using training sample 1, and calculate the scoring loss. when The fine-tuned local lightweight LLM #1 was obtained without further descent; a local lightweight LLM #2 with the same structure as the local lightweight LLM #1 was trained using training sample #2, and the purification loss was calculated. when The fine-tuned code language model #2 is obtained without further descent. A local lightweight LLM refers to an LLM with fewer than 10 billion parameters.

[0046] Fine-tuning a local lightweight LLM is practically meaningful. Thanks to the recent emergence of numerous open-source LLMs, more lightweight alternatives have become available, making it possible to replace GPT-4. Simultaneously, the aforementioned instruction dataset can provide background knowledge and references for local lightweight LLMs, helping to alleviate the challenges faced by small LLMs in handling complex tasks through fine-tuning. In this work, Qwen2.5-coder-7B, a lightweight and open-source model, was chosen as the backbone of EPIC. The goal of this invention is to enable EPIC to provide a reasonable interpretation of the Naturalness of Adversarial Example (NES) evaluation score in the evaluation task. The optimization objective of supervised fine-tuning is as follows:

[0047]

[0048] Among them, c ori and c adv These represent the original code and the perturbation code, respectively. (Instruction) eval This indicates the instructions used to evaluate the task (i.e., the content in the prompt template). NES is an abbreviation for Naturalness Evaluation Score, which is the score required. 'e' indicates the interpretation of the score.

[0049] For cleanup tasks, this invention aims to enable EPIC to identify unnatural locations and generate appropriate cleanup code. The optimization goals are as follows:

[0050]

[0051] In the above equation, c ori c adv and c puri These represent the original code, the perturbed code, and the cleaned-up code, respectively. The Instruction... eval and Instruction puri The instructions are the same as those given to GPT-4, corresponding to the instructions for the two tasks respectively.

[0052] S3: EPIC is used as an evaluation metric. It receives a code input and performs a fine-tuned code language model 1 for evaluation. When the evaluation value is less than a predetermined threshold, it indicates that the input code has been attacked.

[0053] S4: EPIC acts as a purifier, inputting potentially vulnerable code into a finely tuned local lightweight LLM #2 for purification. It follows the analysis steps outlined in its template to locate unnatural identifiers, and then replaces these identifiers with names that are more in line with human programming habits based on their function and overall code semantics, outputting the purified code.

[0054] The evaluator and cleaner receive a piece of code as input and evaluates it using a finely tuned local lightweight LLM (Model 1). If the evaluation value is less than a predetermined threshold, it indicates that the input code has been attacked. The attacked code is then input into a finely tuned local lightweight LLM (Model 2) for purification, and the purified code is output. Specifically, unnatural identifiers are located, and based on their function and overall code semantics, these identifiers are replaced with names that are more in line with human programming habits, and the purified code is output.

[0055] As Figure 1 As shown, samples obtained through existing identifier substitution attacks exhibit a degree of unnaturalness. A fine-tuned EPIC will learn the characteristics of these unnatural perturbations and provide an interpretable evaluation score. This evaluation score, consistent with human evaluation, can serve as a new constraint on identifier substitution attacks. Figure 4 As shown in (c), when the NES score of the adversarial code falls below a predetermined threshold, it serves as an indication that the input code may have been attacked. It's important to note that in real-world scenarios, we only receive a piece of code as input and must rely on the score and interpretation provided by EPIC to determine whether it is adversarial code. Therefore, during the inference phase, the prompt template for the input description needs to be adjusted accordingly.

[0056] 1. Experimental setup

[0057] To comprehensively evaluate the performance of different attack methods in terms of naturalness and to test the defensive capabilities of the method of this invention in various settings, the following details the specific experimental setup, including downstream tasks and corresponding datasets, victim models, attack configurations, evaluation metric baselines, and tools for fine-tuning and inference.

[0058] Table 2 shows the statistics for the dataset. P, R, F1, and acc represent precision, recall, F1 score, and accuracy, respectively.

[0059]

[0060] (1) Tasks and Datasets

[0061] In this experiment, the present invention selected three representative code processing tasks, including program understanding and program generation. The statistical information of the datasets corresponding to these tasks is shown in Table 2.

[0062] Clone detection. The goal of clone detection is to identify functionally similar or identical code snippets, even if they are syntactically different. The BigCloneBench dataset is one of the widely used benchmarks for this task, containing millions of code clone pairs, covering everything from completely identical code to semantically similar different types. This invention reuses a dataset processed by Yang et al., which maintains a 1:1 ratio of clone pairs to non-clone pairs while also maintaining computationally manageable scalability. The processed dataset contains 90,102 training samples and 4,000 samples each for validation and testing. Each sample is a Java method.

[0063] Vulnerability detection. Similar to clone detection, defect detection is a type of program understanding task aimed at discovering potential security vulnerabilities in software. In this study, the invention uses version 1.1 of the widely used Open Web Application Security Project (OWASP) benchmark, which includes 13,041 training samples and 4,000 samples each for validation and testing.

[0064] Code summarization. Code summarization is a typical program generation task, aiming to generate natural language summaries of code. CodeSearchNet is a widely used dataset for this task.

[0065] (2) Victim Model

[0066] This invention selected representative state-of-the-art (SOTA) models from three categories (encoder-only, decoder-only, and encoder-decoder): CodeBERT, CodeGPT, and PLBART. These models were fine-tuned on the three downstream tasks mentioned above (clone detection, vulnerability detection, and code summarization, respectively). This invention used the same evaluation metrics as previous work: accuracy, precision, recall, F1 score, and BLEU-4 to evaluate these models. The reproduced results are shown in Table 3 and are consistent with those reported in the original paper.

[0067] (3) Attack settings

[0068] This invention selects four main identifier substitution attack methods, including the state-of-the-art (SOTA) method. The success rate of each method is shown in Table 4.

[0069] MHM: MHM generates adversarial examples of source code by performing iterative identifier renaming, based on Metropolis-Hastings sampling. The success rate of this attack depends on two hyperparameters: 1) the maximum number of iterations, and 2) the number of variables sampled in each iteration. Here, these two parameters are set to 100 and 30, respectively.

[0070] Wir-Random: This method uses the Word Importance Ranking (WIR) method to select a set of candidate identifiers based on the difference in output before and after renaming the identifier to "UNK" token. Then, each identifier is replaced with a random new name in turn.

[0071] ALERT: ALERT generates naturalistic replacements using contextual information. It employs a greedy algorithm to determine the identifier to be replaced and switches to a genetic algorithm when the greedy method fails.

[0072] Beam-Attack: Beam-Attack incorporates this prior knowledge for identifier selection. To mitigate the problem of previous methods easily getting trapped in local optima, this method uses beam search to focus on multiple identifiers simultaneously. Like ALERT, it also uses context-aware identifier prediction. The size of the candidate set and the beam size are two key parameters, set to 30 and (2, 3, 5) for the three tasks, respectively.

[0073] Table 3 shows the performance of CLMs in downstream tasks.

[0074]

[0075] Table 4 shows the success rate of identifier substitution attacks under different task-victim model combinations.

[0076]

[0077] (4) Existing evaluation indicators

[0078] This invention selected the following six metrics as baselines. The first four are commonly used metrics for assessing the quality of adversarial code, while the latter two are high-level code similarity assessment metrics.

[0079] Identifier Change Rate (ICR), Token Change Rate (TCR), Average Code Similarity (ACS), Average Edit Distance (AED), CodeBLEU, and CodeBERTScore. CodeBERTScore is a code similarity evaluation metric based on CodeBERT, which has four variants. In this invention, CodeBERTScore-F1 is used.

[0080] (5) Fine-tuning and reasoning tools

[0081] The fine-tuning process is accelerated using LLaMA-Factory and DeepSpeed. During the inference phase, this invention utilizes vLLM for efficient EPIC deployment and performs high-throughput and memory-efficient batch inference.

[0082] 2. Experimental Results and Analysis

[0083] This invention answers three research questions through experiments. These questions focus on evaluating the effectiveness of the evaluation metrics proposed in this invention and examining the effectiveness of defense strategies from a natural perspective.

[0084] RQ1: Is EPIC suitable for assessing the naturalness of adversarial code?

[0085] EPIC was fine-tuned using half of the dataset consisting of training sample 1 as the training set, enabling it to perform the same evaluation task as GPT-4 and learn how to analyze the natural flaws in adversarial examples. It was then tested on the remaining half of the dataset. Six non-author practitioners were invited to manually annotate the same test data to demonstrate the feasibility of the proposed evaluation metric and the effectiveness of EPIC. These annotators were all computer science professionals with at least three years of programming experience, and they were diverse in gender, age, and educational background. They were instructed to provide objective judgments, regardless of the length of the answers, aiming to minimize human bias. The Mann-Whitney U test was performed to compare the NES generated by GPT-4, EPIC, and human evaluators at different granularity levels. Table 5 shows the results of the consistency test, observing that GPT-4 and EPIC passed the consistency test with human evaluators across all attack combinations.

[0086] Table 5. Consistency analysis of NES using EPIC, GPT-4, and humans at different granularity levels. The first figure represents the perfect match rate, the second figure represents the consistency rate within a tolerance of 1, and the third figure represents the mean absolute difference.

[0087]

[0088] The test (p-value < 0.05) showed a high degree of consistency with human evaluation. Overall, EPIC's consistency with human evaluation is very close to GPT-4, achieving a 65% perfect match rate and a 95% consistency rate within 1 variance. This indicates that EPIC can effectively simulate the naturalness of human judges evaluating adversarial examples, serving as a new indicator for assessing adversarial example quality. This also indirectly confirms the rationality of GPT-4's scoring results and indirectly confirms that current identifier substitution attacks have certain naturalness issues.

[0089] Answering RQ1: EPIC showed high consistency with both human evaluators and GPT-4, passing the consistency test in all cases. It achieved a 95% consistency rate with human evaluation within a variance of 1, indicating that EPIC can serve as a reliable indicator for assessing the naturalness of adversarial code.

[0090] Is RQ2:EPIC a better measure of adversarial sample naturalness?

[0091] Table 6 shows the correlations between EPIC and other adversarial example quality metrics and human evaluation performance, where ρ, r, and τ represent the Spearman, Pearson, and Kendall-Tau correlation coefficients, respectively. Up indicates a higher metric value, which implies higher adversarial example quality, while down indicates the opposite. Shaded cells represent the best performance.

[0092]

[0093] Human annotations were used as real-world examples, and their correlation with these metrics was measured. Table 6 shows the correlation between the proposed EPIC metrics and other quality metrics, as well as human performance evaluations, using Spearman(r) as a benchmark. s ), Pearson(r pThe correlation coefficients are represented by the Kendall-Tau (τ) correlation coefficient. The results show that EPIC exhibits the highest average correlation among all metrics (mean = 0.6831), outperforming other metrics in all three correlation types. EPIC shows a significant positive correlation with human performance, with values ​​of 0.6687 (Spearman), 0.7419 (Pearson), and 0.6386 (Kendall-Tau), all exceeding other metrics. This indicates its ability to effectively simulate human reasoning. The consistency among different correlation measures highlights its robustness as an evaluation metric. In contrast, CodeBLEU shows almost no correlation with human references (mean = 0.0414), suggesting limited utility in assessing the naturalness of adversarial examples based on identifier substitution. One possible reason is that CodeBLEU focuses more on n-gram overlap, grammatical matching, and data flow similarity, the latter two of which remain unchanged in identifier substitution attacks. For lexical matching, completely different identifiers can still maintain the same semantic and natural consistency. Other metrics show varying degrees of correlation. Semantic-related metrics, such as ACS, AED, and CodeBERTScore, show stronger correlations than statistical textual difference metrics like TCR and ICR. This suggests that semantic changes may contribute more to the reduction of naturalness than simple token-level changes. In contrast, EPIC considers both local semantic changes and overall code coherence, while also assessing whether modifications conform to common programming practices. This comprehensive approach allows it to better capture subtle information about naturalness in adversarial code modifications.

[0094] Answering RQ2: EPIC is at least 56.59% more relevant to human judgment than other metrics, demonstrating its advantage over sample quality in assessing naturalness.

[0095] RQ3: How effective is EPIC as a purifier in enhancing model robustness?

[0096] EPIC was fine-tuned using half of the cleaned dataset consisting of training samples #2. Its robustness was evaluated by testing on the other half of the cleaned dataset and compared with GPT-4 and adversarial fine-tuning. Table 7 shows the defense success rates of EPIC, GPT-4, and adversarial fine-tuning across various attack combinations. The table shows that EPIC was able to clean most adversarial examples, achieving a defense rate close to GPT-4 (with a maximum difference of no more than 2.5%), and even outperforming GPT-4 in some combinations, demonstrating the effectiveness of the fine-tuning method of this invention. In contrast, adversarial fine-tuning provided only marginal improvements in a few attack combinations (e.g., a 0.27% improvement in PLBART for vulnerability detection tasks). However, in most cases, EPIC showed a greater advantage than adversarial fine-tuning; for example, in the MHM attack CodeGPT code digest task, it successfully defended against an additional 36.19% of adversarial examples. Notably, the effectiveness of adversarial fine-tuning against CodeGPT decreased significantly in the clone detection task, with a defense success rate of only 20.82%, indicating potential stability issues, while EPIC showed greater robustness. As an external defense method, EPIC offers plug-and-play capabilities, eliminating the need to retrain CLMs, while still providing defense performance comparable to GPT-4 under lightweight conditions.

[0097] Table 7

[0098]

[0099] In response to RQ3: In terms of enhancing model robustness, EPIC achieved a 90% defense success rate in most cases, demonstrating a stronger ability than adversarial fine-tuning and almost matching the performance of GPT-4.

[0100] Use case of the method of this invention: A brief case study is provided here to illustrate the defensive capabilities of EPIC, such as... Figure 6 As shown, the original code converts the byte array to its corresponding hexadecimal string representation. CodeBERT produced an incorrect code digest by simply changing the method name "toHexString" to the misleading name "BoundingBox," which also violated Java naming conventions. EPIC successfully identified the perturbation and replaced it with a name closely related to the function's functionality. Furthermore, based on the original code, EPIC changed the array name from "chars" to "hexChars," further improving code readability. Therefore, the generated code digest was also very similar to the reference digest. This demonstrates that EPIC not only helped the model recover correct predictions but also further optimized the naturalness of the code.

[0101] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for evaluating and defending against adversarial attacks on code language models, characterized in that, Includes the following steps: S1: Data construction, adversarial attack execution using adversarial examples, and collection of successful adversarial examples; We employ a large-scale LLM to evaluate and sanitize successful adversarial examples: We design a cue template and sanitize successful adversarial examples based on the cue template; we annotate the naturalness state of each successful adversarial example with a score from 1 to 5, and provide analysis and justification. The successful adversarial examples that have been evaluated, along with their corresponding annotations and analyses, constitute training sample 1. The cleaned-up successful adversarial examples and the prompt templates constitute training sample 2. S2: Fine-tuning the Local Lightweight LLM: Train the first local lightweight LLM using training sample 1, and calculate the scoring loss. when The fine-tuned local lightweight LLM #1 was obtained without further descent; a local lightweight LLM #2 with the same structure as the local lightweight LLM #1 was trained using training sample #2, and the purification loss was calculated. when The descent stops, resulting in a finely tuned code language model No.

2. The scoring loss in S2 The calculation process is as follows: Among them, c ori and c adv These represent the original code and the perturbation code, respectively. (Instruction) eval This indicates the instructions used to evaluate the task; NES indicates the score required; and e indicates the interpretation of that score. Purification loss in S2 The calculation process is as follows: Among them, c puri Instruction represents the cleaned-up code. puri Indicates the instructions used for the purification task; S3: Evaluation and purifier. It receives a piece of code input and performs an evaluation on the finely tuned local lightweight LLM No.

1. When the evaluation value is less than a predetermined threshold, it indicates that the input code has been attacked. The attacked code is input into the finely tuned local lightweight LLM #2 for purification, and the purified code is output.

2. The method for evaluating and defending against adversarial attacks on code language models as described in claim 1, characterized in that, In S1, GPT-4 is used for evaluation and purification, suggesting that GPT-4 be analyzed in a chain-thinking CoT manner.

Images