Code completion model member inference method based on antagonism prompt

Abstract

The invention discloses a code completion model member inference method based on antagonism prompts, which comprises the following steps of: firstly, designing and applying a series of antagonism prompts which keep program functions and are specific to codes, and converting an original input code prefix into a group of disturbed input codes; then querying the target model to respectively obtain prediction outputs of the target model for the original input and the group of input after disturbance, and constructing a feature vector by quantifying the similarity and confusion difference between the two prediction outputs and the real completion code; and finally, training a binary classifier by using the feature vector to automatically deduce the member identity of the sample. According to the method, an inference framework for exposing model memory by utilizing'behavior stability difference 'induced by adversarial prompts is proposed for the first time, an expensive shadow model does not need to be trained, a fine memory mode of a code large language model can be captured, and the accuracy, universality and application feasibility of member inference are remarkably improved.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence security and relates to a privacy risk assessment method for a large code language model. Specifically, it relates to a method that uses adversarial prompts to induce a code completion model to generate diverse outputs, and then uses the analysis of these outputs to construct feature vectors, thereby training a classifier to automatically distinguish between member and non-member code samples in the training set. Background Technology

[0002] In recent years, large language models (LLMs) have achieved remarkable success in the field of natural language processing. This success has extended to the source code domain, with specific large language models optimized for code, such as CodeLlama 7B, being widely used for complex software engineering tasks such as code completion, code summarization, and vulnerability detection, and have been successfully integrated into mainstream development aids such as GitHub Copilot.

[0003] While code-based LLMs demonstrate powerful capabilities, they also introduce new security and privacy threats, particularly privacy breaches. These breaches often stem from the LLM's tendency to memorize training data (i.e., specific code snippets) during training. If the model memorizes training data containing API keys, private credentials, or sensitive business logic, it may leak this information during subsequent use, leading to serious security risks and potential legal disputes (e.g., violations of open-source licenses such as the GPL).

[0004] To assess and quantify such privacy risks, Membership inference attack (MIA) has become a key technique. MIA aims to infer whether a specific code sample is included in the training set of a target LLM (Local Level Model). Therefore, researching efficient and accurate MIA methods is crucial for evaluating the extent of data leakage in models, guiding the design of effective privacy protection measures, and promoting the compliant and responsible use of LLMs.

[0005] Currently, black-box and gray-box member inference attack methods targeting code models mainly fall into the following paradigms:

[0006] The first approach is the shadow model strategy, where the attacker trains a local proxy model to approximate the behavior of the target model and then trains an attack classifier based on the output of this proxy model. However, this method has significant drawbacks: for today's large-scale code LLMs, training a shadow model with similar behavior is extremely expensive and impractical in terms of computation; at the same time, small-scale proxy models often cannot accurately capture the complex memory patterns of large models, resulting in a significant reduction in the effectiveness and transferability of the attack.

[0007] The second approach is a heuristic based on output similarity. This type of method directly compares the model's generated output with the actual completed code. For example, membership can be inferred by checking if the model's output exactly matches the actual completed code. However, this strategy is fragile. Large-code LLMs have strong generalization capabilities; even for trained samples, they may generate semantically correct but not identical completions. Conversely, for common code patterns, they may generate exact matches even if the sample has never been seen before. This leads to poor performance on large models and a low True Positive Rate.

[0008] The third approach involves analyzing the differences in the model's internal representation when faced with syntactic variations of the input (e.g., changing the case of variable names). However, this type of method relies on manually designed heuristics and often struggles to capture the more subtle and deeper memory patterns caused by over-parameterization of the model.

[0009] In summary, existing MIA methods generally suffer from limitations when applied to large-code LLMs, including high computational cost, vulnerability to output similarity, and inability to capture rich memory patterns. Therefore, a new method is urgently needed to overcome these shortcomings and detect membership in large-code LLMs more accurately and reliably without relying on expensive shadow models. Summary of the Invention

[0010] This invention provides a member inference method for code completion models based on adversarial cues. The key to this method lies in using a series of code-specific, semantically preserving adversarial cues to expose the memory behavior of the target code completion model. This invention is the first to propose an inference framework, AdvPrompt-MIA, that utilizes adversarial cues-induced "behavioral stability differences" to expose model memory. This method eliminates the need to train expensive shadow models, captures subtle memory patterns in large code language models, and significantly improves the accuracy, generality, and applicability of member inference.

[0011] The objective of this invention is achieved through the following technical solution:

[0012] A member inference method for code completion model based on adversarial hints includes the following steps:

[0013] Step 1: Design and apply a series of code-specific adversarial modifications that maintain program functionality, prefixing the original input code. Transformed into a set of perturbed input codes ;

[0014] Step 2: Use the original input prefix and the perturbated input code Query the target code to complete the model and obtain the raw prediction output. and perturbation prediction output ;

[0015] Step 3: Use a pre-trained code embedding model to complete the code. Original prediction output and the predicted output of this group of disturbances Transform it into a vector representation, and calculate and extract a set of features to quantify the differences in model behavior based on these vector representations;

[0016] Step 4: Using a set of pre-labeled member and non-member sample data, extract their respective feature vectors and train a binary classifier;

[0017] Step 5: Perform membership inference. For a new sample with an unknown membership, extract its feature vector according to the process of steps 1 to 3, and input it into the binary classifier trained in step 4. The output of the binary classifier is the membership prediction result of the sample.

[0018] Compared with the prior art, the present invention has the following advantages:

[0019] 1. This invention proposes a novel inference paradigm that significantly reduces application costs. This method constructs features by leveraging adversarial hints to amplify the differences in model output stability between member and non-member samples. This process does not rely on computationally expensive shadow model training and avoids dependence on fragile heuristic rules (such as exact matching), making privacy auditing of large code models more feasible.

[0020] 2. This invention can capture subtle memory patterns in large code models, improving the accuracy of inference. By analyzing the model's response to a series of semantic perturbations, this invention can detect deep memory signals that cannot be identified by output similarity alone. This method utilizes a deep learning classifier to automatically learn these complex behavioral patterns, thereby significantly improving the accuracy of inference.

[0021] 3. This invention proposes a highly versatile and transferable method. This method does not rely on the internal structure of a specific model (applicable to both black-box and gray-box scenarios), allowing its trained classifiers to span different code models and datasets. Therefore, this method has broad applicability and practical value in actual privacy auditing and risk assessment. Attached Figure Description

[0022] Figure 1 This is the overall flowchart of the member inference method for code completion model based on adversarial hints.

[0023] Figure 2 It is a semantically invariant perturbation generation algorithm.

[0024] Figure 3 This describes the process of constructing the training dataset for a binary classification model.

[0025] Figure 4 This is a simple sample Python code.

[0026] Figure 5 These are specific examples of applying different code perturbation methods.

[0027] Figure 6 These are examples of the model output corresponding to the original code and the perturbated code. Detailed Implementation

[0028] The technical solution of the present invention will be further described below with reference to the accompanying drawings, but it is not limited thereto. Any modifications or equivalent substitutions to the technical solution of the present invention that do not depart from the spirit and scope of the technical solution of the present invention should be covered within the protection scope of the present invention.

[0029] This invention provides a method for member inference in a code completion model based on adversarial hints. The method is tailored to a given target code completion model. and a sample code to be queried (this sample typically contains an input prefix) and corresponding true completion First, a series of code-specific adversarial hints that preserve program functionality are designed and applied to transform the original input code prefixes into a set of perturbed input codes. Then, the target model is queried to obtain its predicted outputs for both the original input and the perturbed input, and feature vectors are constructed by quantifying the similarity and perplexity differences between these two predicted outputs and the actual completed code. Finally, a binary classifier is trained using the feature vectors to automatically infer the membership of the sample. Figure 1 As shown, the specific steps include the following:

[0030] Step 1: Design and apply a series of code-specific adversarial modifications that maintain program functionality, prefixing the original input code. Transformed into a set of perturbed input codes The algorithm process is as follows: Figure 2 As shown, the specific steps are as follows:

[0031] Step 11, Insert Dead Control Branches (IDC): In the original input code prefix... Insert a conditional branch where the conditional predicate is statically false into a randomly selected row. The body of this branch can contain a harmless operation or wrap a statement from... The existing statements.

[0032] Step 12, Inserting Redundant Variable Declarations (IRVs): Inject one or more variable declarations into the code that will never be used in subsequent code. The declared redundant variables may or may not be initialized.

[0033] Step 13, Apply Variable and Method Renaming (VR): Select a variable or method identifier in the code and replace all occurrences of it with a new, syntactically valid identifier.

[0034] Step 14, Insert Debug Print Statements (IDP): Insert print statements into the code for logging or debugging purposes. These print statements can be inserted at the beginning of a method body or after a variable declaration.

[0035] Step 15, Inserting Dead Loops (IDL): Introduces a loop with a statically false loop condition at a randomly selected location in the code. The loop body can be empty or contain a statement that performs no operation.

[0036] Step 16: For each original input prefix to be queried Apply one or more of the perturbation strategies from steps 11 to 15 to generate a set of perturbed input codes that are functionally equivalent but representationally different. Ultimately, for each Construct a perturbation input set ,in, This represents the number of codes after the perturbation.

[0037] Step 2: Use the original input prefix and the perturbated input code Query the target code to complete the model and obtain the raw prediction output. and perturbation prediction output The specific steps are as follows:

[0038] Step 21: Prefix the original input Submit to target code completion model Obtain the original prediction output ;

[0039] Step 22: The perturbed input code generated in step 16 Submit each one to the target code completion model Obtain a set of corresponding perturbation prediction outputs. .

[0040] Step 3: Use a pre-trained code embedding model to complete the code. Original prediction output and the predicted output of this group of disturbances The model is converted into a vector representation, and based on these vector representations, a set of features is calculated and extracted to quantify the differences in model behavior. The specific steps are as follows:

[0041] Step 31: Vectorize the code snippets using a pre-trained code embedding model (e.g., CodeBERT) for real completion. Original prediction output and the set of perturbation prediction outputs obtained in step 22 Get one each An embedding matrix of dimension, where, The length of the word sequence. For the embedded dimension.

[0042] Step 32: Apply average pooling to the embedding matrix, and... The dimensional embedding matrix is ​​compressed into a single... 3D vector representation, denoted as The embedding process is denoted as .

[0043] Step 33: Calculate true completion vector Compared with the original prediction output vector Original cosine similarity between and accurate completion vector With the predicted output of this group of disturbances Each vector Perturbation cosine similarity between A set of perturbation similarity scores was obtained. The formula for calculating the original cosine similarity is as follows:

[0044]

[0045] Step 34: Summarize all similarity scores calculated in Step 33 and calculate the mean of this set of scores. and standard deviation .

[0046] Step 35: Calculate the target code completion model For the original prediction output level of confusion and target code completion model Predicted output for this group of disturbances The perplexity of each output is used to obtain a set of... For a sequence of lexical units ,in, For sequence length, For the first in the sequence The perplexity of this sequence is calculated using the following formula: (Number of words / characters)

[0047]

[0048] in, It is a natural exponential function. For the first in the sequence Each word element, For the first part of the sequence Each word element.

[0049] Step 36: Calculate the normalized perturbation score corresponding to each perturbation output. The calculation formula is as follows:

[0050]

[0051] Step 37: Calculate the mean of all normalized perplexity scores. and standard deviation .

[0052] Step 38: Combine all the features extracted in steps 33 to 37 to form a query sample. Construct a comprehensive feature vector The specific steps are as follows:

[0053] Assuming that in step 1, the following was generated If there are multiple perturbation inputs, then the feature vector is a A dimensional vector, specifically including: 1 original cosine similarity. ; The perturbation cosine similarity ; 2 similarity statistical features ; Normalized perplexity score And two perplexity statistical features The specific form is as follows:

[0054]

[0055] Step 4: Using a set of pre-labeled (members and non-members) sample data, extract their respective feature vectors and train a binary classifier. For example... Figure 3 As shown, the specific steps are as follows:

[0056] Step 41: Construct a model for simulating target code completion. The training dataset is denoted as And a dataset used to simulate the non-training set, denoted as . .

[0057] Step 42, use the definition in step 41 The dataset is used to fine-tune a publicly available, pre-trained code model. The fine-tuned model is the target code completion model to be evaluated and attacked in this invention. .

[0058] Step 43, from A subset is randomly selected from the data. 20% of the total sample size was used as positive samples (members) in the training set. Randomly select an equal number of samples from the positive samples to form the negative samples (non-members) in the training set. Mix these positive and negative samples to create a balanced classifier training set. .

[0059] Step 44: For the classifier training set constructed in step 43 Each sample Each step is processed according to the complete method described in steps 1 to 3 above, and its corresponding comprehensive feature vector is extracted. .

[0060] Step 45: Construct a binary classifier model. Using the comprehensive feature vector set and its corresponding member labels prepared in Step 44, perform supervised training on the binary classifier. The training process uses the standard cross-entropy loss function, and the training objective is to minimize the loss between the predicted label and the true label.

[0061] Step 5: Perform membership inference: For a new sample with unknown membership, extract its comprehensive feature vector following the process from Steps 1 to 3, and input it into the binary classifier trained in Step 4. The output of the binary classifier is the membership prediction result for the sample. The specific steps are as follows:

[0062] Step 51: Prefix the original input of the sample to be queried Submit to target code completion model Obtain the original prediction output .

[0063] Step 52: Following the same method as in Step 1, process the original input prefix. A series of semantically preserving perturbation transformations are applied to generate a set of perturbed input codes. Then, the perturbed inputs are submitted one by one to the target code completion model. Obtain a set of corresponding perturbation prediction outputs. .

[0064] Step 53: Based on the original prediction output obtained in steps 51 to 52 Perturbation prediction output And the true completion of the sample to be queried Calculate and construct the comprehensive feature vector of the sample using the same method as in step 3. .

[0065] Step 54: Combine the comprehensive feature vector obtained in step 53. As input, it is fed into the binary classifier trained in step 4, and the output of the binary classifier (e.g., a binary label) is the sample. Membership prediction results.

[0066] Example 1:

[0067] Take a simple piece of Python code as an example ( Figure 4 ), and analyze the process of semantically invariant code perturbation.

[0068] Based on step 1, for IDC disturbances (step 11), the corresponding four types of disturbance examples are as follows: Figure 5 As shown in (a); for IRV disturbances (step 12), the corresponding examples of the two types of disturbances are as follows: Figure 5 As shown in (b); for the VR perturbation (step 13), replace the variable name "ret" in the example code with "ans"; for the IDP perturbation (step 14), the corresponding examples of the two types of perturbations are as follows. Figure 5 As shown in (c); for IDL perturbations (step 15), the corresponding two types of perturbation examples are as follows: Figure 5 As shown in (d).

[0069] Example 2:

[0070] Take a simple piece of Python code as an example ( Figure 4 ), and analyze the model predictions corresponding to the original code and the code after perturbation.

[0071] like Figure 6 As shown, This is a sample of the original code. The true label for the sample. Perturbation samples are generated based on step 1. Based on step 2, the model response corresponding to the original input and the perturbated input is obtained. and The middle column represents the model response for member samples, and the right column represents the model response for non-member samples.

Claims

1. A member inference method for code completion model based on adversarial hints, characterized in that... The method includes the following steps: Step 1: Design and apply a series of code-specific adversarial modifications that maintain program functionality, prefixing the original input code. Transformed into a set of perturbed input codes ; Step 2: Use the original input prefix and the perturbated input code Query the target code to complete the model and obtain the raw prediction output. and perturbation prediction output ; Step 3: Use a pre-trained code embedding model to complete the code. Original prediction output and the predicted output of this group of disturbances Transform it into a vector representation, and calculate and extract a set of features to quantify the differences in model behavior based on these vector representations; Step 4: Using a set of pre-labeled member and non-member sample data, extract their respective feature vectors and train a binary classifier; Step 5: Perform membership inference: For a new sample with unknown membership, extract its comprehensive feature vector according to the process of steps 1 to 3, and input it into the binary classifier trained in step 4. The output of the binary classifier is the membership prediction result of the sample.

2. The member inference method for code completion model based on adversarial hints according to claim 1, characterized in that... The specific steps of step 1 are as follows: Step 11, Insert an invalid control branch: In the original input code prefix Insert a conditional branch in a randomly selected row where the conditional predicate is statically false; Step 12, Insert redundant variable declarations: Inject one or more variable declarations into the code that are never used in subsequent code; Step 13, Apply variable and method renaming: Select a variable or method identifier in the code and replace all occurrences of it with a new, syntactically valid identifier; Step 14: Insert debug print statements: Insert print statements into the code for logging or debugging purposes; Step 15: Insert an invalid loop: Introduce a loop with a statically false loop condition at a randomly selected location in the code; Step 16: For each original input prefix to be queried Apply one or more of the perturbation strategies from steps 11 to 15 to generate a set of perturbed input codes that are functionally equivalent but representationally different. Ultimately, for each Construct a perturbation input set ,in, This represents the number of codes after the perturbation.

3. The member inference method for code completion model based on adversarial hints according to claim 2, characterized in that... The specific steps of step 2 are as follows: Step 21: Prefix the original input Submit to target code completion model Obtain the original prediction output ; Step 22: The perturbed input code generated in step 16 Submit each one to the target code completion model Obtain a set of corresponding perturbation prediction outputs. .

4. The member inference method for code completion model based on adversarial hints according to claim 3, characterized in that... The specific steps are as follows: Step 31: Vectorize the code snippet using a pre-trained code embedding model for real completion. Original prediction output and the set of perturbation prediction outputs obtained in step 22 Get one each An embedding matrix of dimension, where, The length of the word sequence. For the embedded dimension; Step 32: Apply average pooling to the embedding matrix, and... The dimensional embedding matrix is ​​compressed into a single... 3D vector representation, denoted as The embedding process is denoted as ; Step 33: Calculate true completion vector Compared with the original prediction output vector Original cosine similarity between and accurate completion vector With the predicted output of this group of disturbances Each vector Perturbation cosine similarity between A set of perturbation similarity scores was obtained. ; Step 34: Summarize all similarity scores calculated in Step 33 and calculate the mean of this set of scores. and standard deviation ; Step 35: Calculate the target code completion model For the original prediction output level of confusion and target code completion model Predicted output for this group of disturbances The perplexity of each output is used to obtain a set of... ; Step 36: Calculate the normalized perturbation score corresponding to each perturbation output. ; Step 37: Calculate the mean of all normalized perplexity scores. and standard deviation ; Step 38: Combine all the features extracted in steps 33 to 37 to form a query sample. Construct a comprehensive feature vector .

5. The member inference method for code completion model based on adversarial hints according to claim 4, characterized in that... In step 33, the original cosine similarity calculation formula is as follows: 。 6. The member inference method for code completion model based on adversarial hints according to claim 4, characterized in that... In step 35, for a word sequence ,in, For sequence length, For the first in the sequence The perplexity of this sequence is calculated using the following formula: (Number of words / characters) in, It is a natural exponential function. For the first in the sequence Each word element, For the first part of the sequence Each word element.

7. The member inference method for code completion model based on adversarial hints according to claim 4, characterized in that... In step 36 The calculation formula is as follows: 。 8. The member inference method for code completion model based on adversarial hints according to claim 4, characterized in that... The specific steps of step 38 are as follows: Assuming that in step 1, the following was generated If there are multiple perturbation inputs, then the feature vector is a A dimensional vector, specifically including: 1 original cosine similarity. ; The perturbation cosine similarity ; 2 similarity statistical features ; Normalized perplexity score And two perplexity statistical features The specific form is as follows: 。 9. The member inference method for code completion model based on adversarial hints according to claim 4, characterized in that... The specific steps of step 4 are as follows: Step 41: Construct a model for simulating target code completion. The training dataset is denoted as And a dataset used to simulate the non-training set, denoted as . ; Step 42, use the definition in step 41 The dataset is used to fine-tune a large, publicly available, pre-trained code model. Step 43, from A subset is randomly selected from the dataset as positive samples in the training set. Randomly select a number of samples equal to the number of positive samples mentioned above as negative samples in the training set. Mix these positive and negative samples to form a balanced classifier training set. ; Step 44: For the classifier training set constructed in step 43 Each sample Each step is processed according to the complete method described in steps 1 to 3 above, and its corresponding comprehensive feature vector is extracted. ; Step 45: Construct a binary classifier model and use the comprehensive feature vector set prepared in Step 44 and its corresponding member labels to conduct supervised training on the binary classifier.

10. The member inference method for code completion model based on adversarial hints according to claim 9, characterized in that... The specific steps of step 5 are as follows: Step 51: Prefix the original input of the sample to be queried Submit to target code completion model Obtain the original prediction output ; Step 52: Following the same method as in Step 1, process the original input prefix. A series of semantically preserving perturbation transformations are applied to generate a set of perturbed input codes. The perturbated inputs are submitted one by one to the target code completion model. Obtain a set of corresponding perturbation prediction outputs. ; Step 53: Based on the original prediction output obtained in steps 51 to 52 Perturbation prediction output And the true completion of the sample to be queried Calculate and construct the comprehensive feature vector of the sample using the same method as in step 3. ; Step 54: Combine the comprehensive feature vector obtained in step 53. As input, this is fed into the binary classifier trained in step 4, and the output of the binary classifier is the sample. Membership prediction results.

Images