Cross-sample interpolation attack and defense method facing depth code model

Abstract

The invention discloses a cross-sample interpolation attack and defense method for a depth code model, and relates to a cross-sample interpolation attack and defense method. The invention aims to solve the problems of low adversarial sample generation efficiency and insufficient diversity in the prior art. The method comprises the following steps of 1, extracting multi-category function code samples from a source code corpus, constructing an initial data set and performing preprocessing; 2, randomly selecting a reference sample and a target sample; step 3, extracting different types of interpolation elements from the reference code sample, and adaptively inserting the interpolation elements into a target code sample to generate candidate adversarial samples; 4, proposing an iterative attack algorithm, dynamically optimizing an interpolation strategy, and constructing an efficient adversarial sample of the misleading model through multiple rounds of structural disturbance and confidence judgment; and 5, injecting the generated adversarial sample into the training set, and carrying out model retraining to enhance robustness. The invention belongs to the technical field of information security and artificial intelligence.

Description

Technical Field

[0001] The present invention relates to a cross-sample interpolation attack and defense method, and belongs to the field of information security and artificial intelligence technology. Background Art

[0002] With the rapid development of deep learning technology in the field of natural language processing, a growing number of studies are applying it to programming language processing tasks such as source code understanding, code completion, vulnerability detection, and code classification. Similar to natural language, source code, as a formal language, also possesses semantic structure and contextual dependencies. Therefore, after appropriate training, models such as Transformer and BERT are able to effectively model the semantic information of source code. However, recent research has shown that deep neural networks, when processing source code, also face vulnerabilities similar to those encountered in tasks such as image recognition and text classification. They are particularly susceptible to interference from adversarial examples, which can lead to significant deviations in model predictions and pose security risks.

[0003] Existing adversarial attack methods mainly face the following technical bottlenecks: First, the adversarial sample patterns generated by traditional dead code insertion methods (such as adding empty statements or fixed control structures) are single, lack diversity, and are easily detected by modern defense mechanisms. Second, existing methods cannot achieve perturbations of sufficient strength to effectively attack the model while ensuring grammatical correctness and functional invariance. It is particularly noteworthy that current methods have significant efficiency issues when generating adversarial samples. Due to the discrete nature of the code space, traditional attack methods based on gradient optimization are difficult to apply directly. The enumeration-based modification strategy faces the problem of combinatorial explosion, resulting in the generation of high-quality adversarial samples requiring a large amount of computing resources. In addition, existing methods lack in-depth exploration of code structure characteristics, making it difficult to achieve both covert and effective perturbations.

[0004] On the other hand, source code has significant structural features, such as abstract syntax trees (ASTs), control flow graphs (CFGs), and data flow graphs (DFGs). This structural information plays a key role in semantic understanding and program behavior modeling. Although some studies have begun to attempt to incorporate structural features into model training and attack defense, how to effectively perturb and interpolate the structural space while maintaining semantic consistency remains a challenging task. Therefore, there is an urgent need for a method that can systematically construct adversarial examples with continuous features while considering both structural features and semantic consistency, so as to achieve both covert and effective perturbations and improve the security and robustness of models in source code processing tasks. Summary of the Invention

[0005] In order to solve the problems of low efficiency and insufficient diversity in the generation of adversarial samples in the prior art, the present invention proposes a cross-sample interpolation attack and defense method for deep code models.

[0006] The technical solution adopted by the present invention to solve the above problems is: the steps of the present invention include:

[0007] Step 1: Build the original dataset, pre-process the source code, and divide it into training and test sets;

[0008] Step 2: Select a target code sample from the test set and randomly select at least one reference code sample;

[0009] Step 3: extract different types of interpolation elements from the reference code sample and adaptively insert the interpolation elements into the target code sample to generate candidate adversarial samples, ensuring that no syntax errors are generated after insertion and that the original program functionality is maintained;

[0010] Step 4: Verify whether the candidate adversarial example leads to target model prediction errors. If successful, add it to the adversarial example set; otherwise, optimize and re-verify;

[0011] Step 5: Inject the adversarial sample into the model training set, retrain the model, and generate a robust model.

[0012] Furthermore, in step 3, when there are multiple modules of the same type, the module with the least number of lines of code is selected as the interpolation element. The calculation formula is:

[0013]

[0014] Among them, D represents the test set, Loc(ty,x ref ) represents the value of the reference sample x ref The number of lines of code contained in the interpolation element M of candidate type ty extracted.

[0015] Furthermore, the adaptive insertion operation types in step 3 include: selection module interpolation, loop module interpolation, auxiliary function interpolation, and initialization / input and output statement interpolation.

[0016] Furthermore, the interpolation elements for adaptive insertion in step 3 adopt an interpolation modeling method based on the control flow graph, representing the control flow graph of the target code as a directed graph G = (V, E), where V represents the basic block node set, each node v∈V corresponds to an interpolable code element; E represents the directed edge set.

[0017] Furthermore, in the interpolation element of the adaptive insertion in step 3, the module interpolation form is selected as follows:

[0018]

[0019] Among them, V f represents the interpolation element, E fRepresents the logical structure inside the false branch, cond(v) represents the conditional expression for selecting node v, and the newly inserted node evaluates to False in all possible program states s.

[0020] Furthermore, in the interpolation element of the adaptive insertion in step 3, the loop module interpolation form is:

[0021]

[0022] Among them, v f ∈V f is a subgraph G cf The only entry node of , cond(v) represents the conditional expression for selecting node v.

[0023] Furthermore, in the interpolation element of the adaptive insertion in step 3, the auxiliary function interpolation form is:

[0024] V′=V∪{v fun},E′=E∪{(v fun ,v0)}∪E fun ,

[0025] Among them, v fun Is the node of the auxiliary function, E fun It is the edge set inside the auxiliary function. The updated graph retains the original edge set E and includes the new node v fun and newly added connecting edges (v fun ,v0).

[0026] Furthermore, in the interpolation element type of the adaptive insertion in step 3, the initialization / input and output statement interpolation form is:

[0027] V′=V∪{v com}, E′=E,

[0028] Among them, v com Indicates a newly added comment node, including an initialization statement or I / O statement.

[0029] Furthermore, the interpolation process in step 3 is implemented by linear interpolation operation, and the specific calculation formula is:

[0030]

[0031] in, It represents the linear interpolation operation between F(x) and F(M) that map the original input x and the interpolation element M to the high-order embedding space through the deep code model F(·), and x′ represents the adversarial sample.

[0032] Furthermore, in the process of generating adversarial samples in step 4, the interpolation elements extracted from the reference sample are interpolated in the target sample, and the greedy algorithm is combined for iterative optimization;

[0033] In step 5, the adversarial samples generated by the cross-sample interpolation attack method are injected into the training set to retrain the model and improve the robustness of the model.

[0034] The beneficial effects of the present invention are:

[0035] 1. This paper proposes an innovative method that integrates cross-sample operations with source code structure analysis. By introducing diverse code structures through cross-sample interpolation, the paper quantifies the diversity and perturbation of interpolated elements, enriches the attack dimensions, and provides theoretical support for the generation of adversarial examples from source code.

[0036] 2. This paper combines diverse code structures, proposes a dynamic insertion attack strategy, and adopts a greedy algorithm to iteratively optimize the process, thereby improving the generation effect of adversarial samples and the attack success rate;

[0037] 3. This invention innovatively proposes to select the code interpolation structure with the least number of lines of code as the attack target, thereby minimizing the interference with the code readability, while effectively improving the interference effect of the adversarial sample and enhancing the attack effect;

[0038] 4. This paper proposes an efficient adversarial sample generation and verification process, accurately selecting and optimizing interpolation elements, reducing the computational cost of frequently calling the model, and thus improving the efficiency of generating adversarial samples;

[0039] 5. This invention innovatively uses adversarial samples generated by cross-sample interpolation for adversarial training. By injecting diverse adversarial samples and retraining the model, the model learns the invariant features of adversarial perturbations, significantly improving the model's defense capabilities against various adversarial attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 This is an architectural diagram of the cross-sample interpolation attack and defense method for deep code models;

[0041] Figure 2 This is a specific example diagram of the cross-sample interpolation attack method for deep code models. DETAILED DESCRIPTION

[0042] Specific implementation method 1: Figure 1 and Figure 2 As shown in the figure, a cross-sample interpolation attack and defense method for deep code models is presented. The specific steps include:

[0043] Step 1: Select and construct the original dataset, perform standardized preprocessing on the source code, including parsing, removing redundant comments, etc., and divide it into training and test sets;

[0044] Step 2: Select a target code sample from the test set and randomly select at least one reference code sample, and select interpolation elements for the target sample based on the reference sample;

[0045] Step 3: Extract different types of interpolation elements from the reference sample and adaptively insert them into the target sample to generate candidate adversarial samples. The insertion process must ensure that no syntax errors are generated and the original program functionality is maintained.

[0046] Step 301: For the current target sample x, randomly extract an interpolation element from the reference sample. Candidate types of the interpolation element include code structures such as selection modules, loop modules, auxiliary functions, or initialization statements.

[0047] Step 302: For modules of the same type in the reference sample, the candidate interpolation elements with the fewest lines of code are preferentially selected to ensure that the insertion perturbation is minimized. A greedy algorithm is then used to iteratively select interpolation elements for a semantically preserving insertion attack, generating a candidate sample set. Multiple rounds of iterative optimization are then performed, and the misleading effect of the newly generated candidate samples on the target model is evaluated.

[0048] Step 303: Based on the calculation result of step 302, if the misleading is effective, mark it as an adversarial example and add it to the adversarial example set;

[0049] Step 304: Based on the calculation result of step 302, if the misleading is invalid, select a candidate sample that can minimize the confidence of the model prediction, update the target sample, record the minimum confidence, and iteratively select interpolation elements using a greedy algorithm to perform a semantically preserved interpolation attack to generate a candidate sample set. Perform multiple rounds of iterative optimization and replacement, and evaluate the misleading effect of the newly generated candidate samples on the target model.

[0050] Step 4: Verify whether the candidate adversarial sample leads to the target model’s prediction error; if successful, add it to the adversarial sample set; otherwise, re-verify after optimization through the greedy algorithm;

[0051] Step 5: Inject the generated adversarial samples into the model training set, retrain the model, and generate a more robust model.

[0052] Example

[0053] A cross-sample interpolation attack and defense method for deep code models, the specific steps include:

[0054] Step 1: Dataset construction and processing;

[0055] The public dataset OJ-CLONE was selected as the initial dataset, and the source code was preprocessed, including parsing, removing redundant comments, and word segmentation, to obtain a standardized dataset.

[0056] Step 2: Reference sample selection;

[0057] For the test data set, randomly sample reference samples and target samples from it, and select interpolation elements for the target samples based on the reference samples;

[0058] Step 3: Adaptive interpolation perturbation;

[0059] For the target sample, structural interpolation elements, such as selection modules, loop modules, auxiliary functions, initialization statements, and input / output statements, are randomly extracted from the reference sample. To ensure the effectiveness of the perturbation and maintain functionality, the present invention constructs an interpolation modeling method based on the control flow graph (CFG) and defines an interpolation strategy. Specifically, the control flow graph of the target code is represented as a directed graph G = (V, E), where V represents a set of basic block nodes and each node v∈V corresponds to an interpolable code element (including functions, loop statement modules, selection statement modules, etc.); E represents a set of directed edges, representing the control flow or data dependency between nodes.

[0060] For the target sample x, randomly extract the interpolation element M from the corresponding reference sample, and calculate the number of code lines Loc(x ref ) quantify the perturbation of the interpolation elements and optimize the adversarial sample generation strategy. The specific implementation is as follows:

[0061] Step 301: Use random sampling strategy to select reference sample x ref Interpolation elements are randomly extracted from M. The candidate types ty of M include code structures such as selection modules, loop modules, auxiliary functions or initialization statements:

[0062] Selecting module interpolation

[0063] Insert the conditional false branch code block into the target sample, and insert the false branch subgraph G into the conditional judgment node v∈V. bf =(V f ,E f ),satisfy:

[0064]

[0065] Among them, V f represents the interpolation element, E f Represents the logical structure inside the false branch, cond(v) is the conditional expression for selecting node v, and the newly inserted node is evaluated as False in all possible program states s; this operation injects a false branch subgraph G that will never be executed at the conditional judgment node V bf=(V f ,E f ); Specifically, the node set V of the false branch f and edge set E f Merge into the original graph G and add a new node V f and branch edges {(v,v f )|v f ∈V f}Connect the fake branch to the original control flow;

[0066] Loop module interpolation

[0067] Insert the loop false branch code block into the target sample, and insert the loop subgraph G with false condition into the loop node v∈V bf =(V f ,E f ), and make sure the loop condition is always false:

[0068]

[0069] Among them, v f ∈V f is a subgraph G cf The only entry node of , cond(v) is the conditional expression of the loop node v. This operation injects an unreachable loop body subgraph G into the loop node v by setting the loop condition to false cf ; Different from the selection module interpolation, the cyclic subgraph G cf It has a single entrance;

[0070] Helper function interpolation

[0071] For the target code sample, insert the front auxiliary function by inserting the function node v before the entry node v0 of the graph. fun , and update the control flow:

[0072] V′=V∪{v fun},E′=E∪{(v fun ,v0)}∪E fun ,

[0073] Among them, v fun Is the node of the auxiliary function, E fun It is the edge set inside the auxiliary function. The updated graph retains the original edge set E and includes the new node v fun and newly added connecting edges (v fun ,v0);

[0074] Initialization / I / O statement interpolation

[0075] Insert initialization or I / O statements in the form of comments. For a node v∈V, add an interpolation element to its attribute set V′:

[0076] V′=V∪{v com},E′=E

[0077] Among them, v com For newly added annotation nodes, including initialization statements or I / O statements, this operation only updates node attributes without changing the graph topology (E′=E);

[0078] Step 302: For reference sample x ref For modules of the same type ty in , the candidate with the least number of lines of code is selected as M. This strategy ensures that the insertion disturbance is minimized. The optimization objective formula is:

[0079]

[0080] Step 303: Based on the result of step 302, the original input x and the interpolation element M are mapped to a high-order embedding space through the deep code model F(·), expressed as F(x) and F(M). The interpolation element generates a mixed feature through a linear interpolation operator to generate an adversarial sample x, which is expressed as:

[0081]

[0082] in, Denotes a linear interpolation operation between F(x) and F(M). The interpolation process must ensure that M can be correctly inserted into x without generating syntax errors and that the function of x remains unchanged. Based on the adversarial sample x′, the cross-sample interpolation attack target can be expressed as:

[0083]

[0084] Step 304: To verify the effectiveness of the present invention, Figure 2 A specific example of a cross-sample interpolation attack is demonstrated. Taking Code_C and Code_D as examples, the IECIA method randomly samples and extracts an interpolation element M (i.e., a two-row selection module) from Code_C. By resetting the selection conditions and inserting it into Code_D, a new sample Code_New_D is generated. This operation causes the label of Code_D to change and the model's predicted probability to decrease, verifying that cross-sample interpolation attacks are not only highly concealed but also highly effective in inducing misjudgments by deep learning models.

[0085] Step 4: Iterative attack;

[0086] In this step, we propose and implement a cross-sample interpolation attack algorithm that iteratively introduces structural perturbations and optimizes interpolation strategies to efficiently generate adversarial samples. This method, based on a deep code model, gradually induces the model to produce prediction offsets while maintaining the semantic and syntactic correctness of the source code.

[0087] Implementation algorithm of cross-sample interpolation attack; Given the original code sample x and its true label y, the algorithm first initializes the adversarial sample to x0, and records the predicted probability distribution pr(x,y;F) of the model F for x, as well as the type type of the interpolation element M. In each round of iteration, the algorithm randomly selects a sample x from the reference sample set D. ref , and according to the randomly selected code type ty, from x ref Extract the interpolation element M; and generate a candidate sample by interpolating M at the pos position of the target sample x. And added to the candidate set; the algorithm evaluates through the following conditions Is it an adversarial sample: If the misleading is successful, that is If the model prediction label changes, it will return directly As an effective adversarial sample; if the generated sample does not change the predicted label, but significantly reduces the model's confidence in the true label y (i.e. ), then the target sample is updated as The minimum confidence is recorded. This strategy gradually optimizes the misleading ability of adversarial samples through multiple rounds of iteration. The algorithm terminates after reaching the maximum number of iterations n. If no valid adversarial sample is generated, a null value is returned.

[0088] Step 5: Adversarial training;

[0089] The generated adversarial samples are mixed with the original samples and injected into the model training set. Through retraining, the model's ability to recognize perturbed samples is improved, thereby improving the overall robustness and security of the system.

[0090] The above description is merely a preferred embodiment of the present invention and does not constitute any form of limitation to the present invention. Although the present invention has been disclosed as a preferred embodiment as above, it is not intended to limit the present invention. Any technician familiar with the present profession can make some changes or modifications to equivalent embodiments of equivalent changes using the technical content disclosed above without departing from the scope of the technical solution of the present invention. However, any simple modification, equivalent replacement and improvement of the above embodiments made according to the technical essence of the present invention, within the spirit and principles of the present invention, without departing from the content of the technical solution of the present invention, shall still fall within the scope of protection of the technical solution of the present invention.

Claims

1. A cross-sample interpolation attack and defense method for deep code models, characterized by: The specific steps include: Step 1: Build the original dataset, pre-process the source code, and divide it into training and test sets; Step 2: Select a target code sample from the test set and randomly select at least one reference code sample; Step 3: extract different types of interpolation elements from the reference code sample and adaptively insert the interpolation elements into the target code sample to generate candidate adversarial samples, ensuring that no syntax errors are generated after insertion and that the original program functionality is maintained; Step 4: Verify whether the candidate adversarial example leads to target model prediction errors. If successful, add it to the adversarial example set; otherwise, optimize and re-verify; Step 5: Inject the adversarial sample into the model training set, retrain the model, and generate a robust model.

2. A cross-sample interpolation attack and defense method for deep code models according to claim 1, characterized in that: In step 3, when there are multiple modules of the same type, the module with the least number of lines of code is selected as the interpolation element. The calculation formula is: Among them, D represents the test set, Loc(ty,x ref ) represents the value of the reference sample x ref The number of lines of code contained in the interpolation element M of candidate type ty extracted.

3. A cross-sample interpolation attack and defense method for deep code models according to claim 1, characterized in that: The adaptive insertion operation types described in step 3 include: selection module interpolation, loop module interpolation, auxiliary function interpolation, and initialization / input and output statement interpolation.

4. A cross-sample interpolation attack and defense method for deep code models according to claim 1, characterized in that: The interpolation elements of the adaptive insertion in step 3 adopt the interpolation modeling method based on the control flow graph, and the control flow graph of the target code is represented as a directed graph G = (V, E), where V represents the basic block node set, each node v∈V corresponds to an interpolable code element; E represents the directed edge set.

5. The cross-sample interpolation attack and defense method for deep code models according to claim 1 is characterized in that: In the interpolation element of the adaptive interpolation in step 3, the module interpolation form is selected as follows: Among them, V f represents the interpolation element, E f Represents the logical structure inside the false branch, cond(v) represents the conditional expression for selecting node v, and the newly inserted node evaluates to False in all possible program states s.

6. A cross-sample interpolation attack and defense method for deep code models according to claim 1, characterized in that: In the interpolation element of the adaptive insertion in step 3, the loop module interpolation form is: Among them, v f ∈V f is a subgraph G cf The only entry node of , cond(v) represents the conditional expression for selecting node v.

7. The cross-sample interpolation attack and defense method for deep code models according to claim 1 is characterized in that: In the interpolation element of the adaptive insertion in step 3, the auxiliary function interpolation form is: V′=V∪{v fun },E′=E∪{(v fun ,v0)}∪E fun , Among them, v fun Is the node of the auxiliary function, E fun It is the edge set inside the auxiliary function. The updated graph retains the original edge set E and includes the new node v fun and newly added connecting edges (v fun ,v0).

8. The cross-sample interpolation attack and defense method for deep code models according to claim 1 is characterized in that: In the interpolation element type of the adaptive insertion in step 3, the initialization / input and output statement interpolation form is: V′=V∪{v com },E′=E, Among them, v com Indicates a newly added comment node, including an initialization statement or I / O statement.

9. The cross-sample interpolation attack and defense method for deep code models according to claim 1 is characterized in that: The interpolation process in step 3 is implemented by linear interpolation operation, and the specific calculation formula is: in, It represents the linear interpolation operation between F(x) and F(M) that map the original input x and the interpolation element M to the high-order embedding space through the deep code model F(·), and x′ represents the adversarial sample.

10. The cross-sample interpolation attack and defense method for deep code models according to claim 1, characterized in that: In the process of generating adversarial samples in step 4, the interpolation elements extracted from the reference sample are interpolated in the target sample, and the greedy algorithm is combined for iterative optimization; In step 5, the adversarial samples generated by the cross-sample interpolation attack method are injected into the training set to retrain the model and improve the robustness of the model.

Images