Neural code model backdoor defense method and system based on code variant generation

Abstract

This application belongs to the interdisciplinary field of model security and software engineering, specifically disclosing a backdoor defense method and system based on a neural code model using code variant generation. This application generates candidate code variants based on a target code variant generation module and semantic equivalence logic; it then filters the effectiveness of each candidate code variant; determines the prediction result based on the victim code model; aggregates the prediction results; and obtains the defense result corresponding to the code to be detected based on the aggregation result. By introducing a target code variant generation module to generate candidate code variants that maintain consistency with the code to be detected in a predetermined code task, and inputting the set of code variants into the victim code model for prediction, the defense process can be executed without accessing the multi-dimensional data of the victim code model. This helps reduce the impact of different triggering methods on the prediction results, thereby effectively improving the accuracy and reliability of backdoor defense.

Description

Technical Field

[0001] This application belongs to the interdisciplinary field of model security and software engineering, and more specifically, relates to a backdoor defense method and system based on neural code model generated by code variants. Background Technology

[0002] With the development of deep learning technology, neural code models have been widely applied to tasks such as code classification, code clone detection, code defect detection, code repair, code summarization generation, code translation, and code search. These neural code models are typically pre-trained on large-scale code corpora and fine-tuned on downstream tasks, making them highly valuable in automated software analysis and development scenarios. However, while neural code models possess strong task performance capabilities, they also face model security risks, especially threats from backdoor attacks. In backdoor attacks, attackers can inject samples with specific triggering features into the training data, allowing the neural code model to maintain its original task performance under normal input, but outputting abnormal results expected by the attacker when the triggering features are detected. For code models, these triggering features can manifest not only as specific terms, identifiers, or comment patterns, but also as code style, structural expression methods, or semantically equivalent program transformations.

[0003] Currently, common methods for backdoor defense against neural code models fall into two categories. The first is input-side cleanup or anomaly filtering strategies, which typically involve detecting, filtering, or locally modifying the input code during the inference phase to reduce the impact of triggering features on the model's output. However, code differs from natural language, being subject to strict lexical, syntactic, compilation, and semantic constraints. Deleting or replacing code snippets solely based on statistical anomalies can easily disrupt the code's syntactic structure, compilation success rate, or original functional logic, affecting downstream task processing results. The second category is model-side repair, which neutralizes backdoor effects through triggering feature inversion, model fine-tuning, parameter correction, or forgetting training. However, neutralizing backdoor effects often requires access to multi-dimensional data such as the model's internal parameters, gradient information, or training process. This is difficult to achieve when the victim's code model is deployed via cloud interfaces or third-party services. Furthermore, the model repair process may degrade the original task capabilities, affecting the model's usability on normal samples. Therefore, the accuracy and reliability of these backdoor defense methods are relatively low. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this application aims to provide a backdoor defense method and system based on neural code models generated by code variants. This method addresses the problems of low accuracy and reliability in backdoor defense caused by existing technologies relying solely on statistical anomalies to delete or replace code segments, the need to access multi-dimensional data such as model internal parameters, gradient information, or training processes during backdoor neutralization, and the potential for model repair processes to degrade the original task capabilities.

[0005] To achieve the above objectives, in a first aspect, this application provides a backdoor defense method based on a neural code model generated by code variants, comprising: Upon receiving the code to be detected, the code to be detected is reconstructed in terms of structure or representation based on the code variant generation module and semantic equivalence logic to generate candidate code variants. Each candidate code variant is screened for validity, and a set of target code variants is generated based on the screening results; Based on the victim code model, the prediction result is determined according to the target code variant set and the preset code task; The corresponding aggregation strategy is selected based on the output format of the victim code model or the type of the preset code task. The prediction results are aggregated according to the aggregation strategy, and the defense result corresponding to the code to be detected is obtained based on the aggregation result, so as to complete the backdoor defense of the neural code model.

[0006] In one embodiment, before the step of reconstructing the structure or representation of the code to be detected according to the code variant generation module and semantic equivalence logic upon receiving the code to be detected, to generate candidate code variants, the method further includes: Obtain a clean code sample set, and construct a poisoned code sample set corresponding to the clean code sample set by injecting preset trigger features; Training samples are generated based on the clean code sample set, the poisoned code sample set, and the target model training instructions; The original code variant generation module is trained under supervision based on the training samples, and the training candidate code variants output by the supervised code variant generation module are obtained. The target code variant generation module is determined based on the training candidate code variants and the supervised training code variant generation module.

[0007] In one embodiment, the step of determining the target code variant generation module based on the trained candidate code variants and the supervised-trained code variant generation module includes: The training candidate code variants are input into the victim code model, and the prediction feedback results output by the victim code model are obtained; The priority of the training candidate code variants is determined based on the prediction feedback results, and a preference relationship between the training candidate code variants is constructed based on the priority. A joint optimization approach combining supervised loss and ranking loss is adopted. Based on the preference relationship, the supervised training code variant generation module is trained to rank and optimize, thereby obtaining the target code variant generation module.

[0008] In one embodiment, the target code variant generation module is constructed from a target code variant generation module, a general code generation model, a rule generator, or a hybrid approach.

[0009] In one embodiment, the validity screening includes at least one of the following: lexical analysis verification, syntax analysis verification, compilation verification or interpretation execution verification, static analysis consistency verification, and semantic consistency determination.

[0010] In one embodiment, the step of determining the prediction result based on the victim code model, the target code variant set, and the preset code task, and selecting the corresponding aggregation strategy based on the output format of the victim code model or the type of the preset code task, includes: Extract task feature information from preset code tasks; Each code variant in the target code variant set is input into the victim code model; When the victim code model is a discriminative model, the category probability distribution data and similarity score output by the victim code model based on the task feature information are obtained, and at least one of the category probability distribution data and the similarity score is used as the prediction result; When the victim code model is a generative model, the candidate generation results output by the victim code model based on the task feature information, as well as the confidence level, conditional probability, and ranking score corresponding to the candidate generation results, are obtained, and at least one of the candidate generation results and their corresponding confidence level, conditional probability, and ranking score is used as the prediction result.

[0011] In one embodiment, the aggregation strategy includes at least one of the following: average, weighted average, voting, median, truncated average, reordering, representative outcome selection, and marginalization estimation.

[0012] Secondly, this application provides a backdoor defense system based on a neural code model generated by code variants, comprising: The code variant generation module is used to reconstruct the structure or representation of the code to be detected based on the code variant generation module and semantic equivalence logic when the code to be detected is received, so as to generate candidate code variants. The validity screening module is used to screen each of the candidate code variants for validity and generate a set of target code variants based on the screening results; The prediction module is used to determine the prediction result based on the victim code model, the target code variant set, and the preset code task, and to select the corresponding aggregation strategy according to the output format of the victim code model or the type of the preset code task. The aggregation decision module is used to select a corresponding aggregation strategy based on the output format of the victim code model or the type of the preset code task, perform aggregation calculations on each prediction result according to the aggregation strategy, and obtain a defense result corresponding to the code to be detected based on the aggregation calculation result, so as to complete the backdoor defense of the neural code model.

[0013] Thirdly, this application provides an electronic device, comprising: at least one memory for storing a program; and at least one processor for executing the program stored in the memory, wherein when the program stored in the memory is executed, the processor is configured to execute the method described in the first aspect or any possible implementation thereof.

[0014] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when run on a processor, causes the processor to perform the method described in the first aspect or any possible implementation thereof.

[0015] It is understood that the beneficial effects of the second to fourth aspects mentioned above can be found in the relevant descriptions in the first aspect mentioned above, and will not be repeated here.

[0016] Overall, the technical solutions conceived in this application have the following beneficial effects compared with the prior art: (1) This application introduces a target code variant generation module to generate candidate code variants that are consistent with the code to be detected in a predetermined code task but differ from the input code in their surface expression, thereby increasing the expression differences between different candidate code variants. The effectiveness of each candidate code variant is screened, including but not limited to semantic consistency detection, static analysis consistency verification, lexical analysis verification, syntax analysis verification, compilation verification, and interpretation verification, to ensure the usability of the code variants input to the victim code model. To reduce overall inference latency, candidate code variants from the target code variant set can be input into the victim code model in parallel, and aggregation operations can be performed on the prediction results on the victim code model. This allows the defense process to be executed without accessing the internal parameters, gradient information, and training data of the victim code model in multiple deployment scenarios (black-box deployment, gray-box deployment, and white-box deployment), effectively reducing the impact of backdoor triggering features on the prediction results and improving the stability of the output defense results. Furthermore, this method can enhance the defense of the victim code model's prediction process without directly destroying the syntax and semantic structure of the code to be detected, thereby effectively improving the accuracy and reliability of backdoor defense.

[0017] (2) When training the target code variant generation module, this application constructs training samples consisting of poisoned code, cleaned code and training instructions, and combines supervised training and sorting optimization training. This allows the code variant generation model to maintain the semantic consistency of the original task while being more inclined to generate candidate code variants that are beneficial to weakening the impact of backdoor triggering, thereby providing a higher quality input basis for the defense process.

[0018] In summary, upon receiving the code to be detected, this application reconstructs the structure or representation of the code based on the code variant generation module and semantic equivalence logic to generate candidate code variants. It then performs validity screening on each candidate code variant and generates a target code variant set based on the screening results. Based on the victim code model, it determines the prediction result according to the target code variant set and a preset code task. Next, it selects a corresponding aggregation strategy based on the output format of the victim code model or the type of the preset code task, performs aggregation operations on each prediction result according to the aggregation strategy, and obtains the defense result corresponding to the code to be detected based on the aggregation operation result, thereby completing the backdoor defense against the neural code model. By introducing a target code variant generation module to generate candidate code variants that maintain consistency with the code to be detected on a predetermined code task, and inputting the target code variant set into the victim code model for prediction, the defense process can be executed without accessing the internal parameters, gradient information, and training data of the victim code model. This helps reduce the impact of different triggering methods on the prediction results, thereby effectively improving the accuracy and reliability of backdoor defense. Attached Figure Description

[0019] Figure 1 This is one of the flowcharts illustrating the backdoor defense method based on a neural code model generated from code variants provided in this application embodiment; Figure 2 This is a simplified flowchart illustrating the overall process provided in the embodiments of this application; Figure 3 This is the second flowchart of the backdoor defense method based on code variant generation of neural code model provided in the embodiments of this application; Figure 4 This is a schematic diagram of the module structure of the neural code model backdoor defense system based on code variant generation provided in the embodiments of this application; Figure 5 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0021] In this article, the term "and / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. The symbol " / " in this article indicates that the related objects are in an "or" relationship; for example, A / B means A or B.

[0022] The terms "first" and "second," etc., used in the specification and claims herein are used to distinguish different objects, not to describe a specific order of objects. For example, "first response message" and "second response message," etc., are used to distinguish different response messages, not to describe a specific order of response messages.

[0023] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0024] Based on this, embodiments of this application provide a backdoor defense method based on a neural code model generated by code variants, referring to... Figure 1 , Figure 1This is one of the flowcharts illustrating a backdoor defense method for a neural code model based on code variant generation provided in this application. In this embodiment, the backdoor defense method for a neural code model based on code variant generation includes steps S10 to S40: Step S10: Upon receiving the code to be detected, the code to be detected is reconstructed in terms of structure or representation based on the code variant generation module and semantic equivalence logic to generate candidate code variants.

[0025] It should be understood that code variant generation models refer to specialized models for defending against backdoor attacks on neural code models. For code variant generation models, after the code to be detected is input, the structure or representation of the code to be detected will be reconstructed according to semantic equivalence logic. At least one of the generation strategies, such as diversified bundle search, random sampling, temperature sampling, and group bundle search, is used to increase the expression differences between different candidate code variants. In the generation process, deduplication penalty terms or similarity constraint terms can also be introduced. The implementation of diversified bundle search can be achieved by setting a bundle width B to control the search width, and setting a similarity penalty coefficient λ to penalize repeated words or subsequences between bundles. The larger λ is, the lower the overlap of words between bundles, thus guiding different candidate code variants to produce greater differences in expression. The implementation of random sampling can be achieved by randomly sampling the probability distribution of the model output during the decoding stage to break the determinism of always selecting the highest probability word in greedy decoding. This is suitable for generating candidate code variants that are semantically equivalent but have large differences in control structure or naming style. The implementation of temperature sampling can be achieved by setting a temperature coefficient τ to scale the logits of the model output. When τ>1, the probability distribution is softened, increasing the chance of low probability words being sampled, which helps to generate more diverse candidate code variants. When τ→0, it degenerates into greedy decoding, and the output tends to be deterministic. In practice, the value of τ is usually in the range of 0.6 to 1.5. The algorithm can be adjusted according to the semantic sensitivity of the target code task. The implementation of grouped bundle search can be as follows: set the number of groups G to divide the bundle search process into G independent search paths. Each group is expanded in different search subspaces, and the results between groups are naturally diverse, which is suitable for generating candidate code variants that cover multiple expression forms at the same time. For the introduced deduplication penalty term, a probability penalty is applied to the already appearing lexical units or n-grams during the decoding process to avoid a large number of highly repetitive samples within the candidate code variant set, thereby improving the overall information coverage of the target code variant set. For the introduced similarity constraint term, the surface similarity between the candidate code variants and the code to be detected is constrained to not exceed a preset threshold during the generation process. This similarity can be measured by lexical-level edit distance, n-gram overlap rate, or cosine similarity of code representation vectors to ensure that the generated results have an effective difference from the code to be detected in terms of expression form. The above generation strategies can be used in combination. For example, grouping bundle search can be combined with deduplication penalty terms to further suppress intra-group repetition while ensuring search diversity; or temperature sampling can be combined with similarity constraints to control the degree of difference between variants and the code to be detected while introducing randomness, thereby adapting to the requirements of different code tasks for the diversity of candidate code variants.

[0026] Understandably, the code to be detected can come from user-submitted code snippets, source files to be analyzed, functions to be repaired, code samples to be retrieved, or program units to generate comments, including but not limited to source code text, language type identifiers, task type identifiers, and optional contextual hints. To facilitate the subsequent generation of candidate code variants, the code to be detected needs to be preprocessed before being input into the target code variant generation module. This preprocessing includes, but is not limited to, removing invalid characters, standardizing encoding formats, normalizing newline characters, performing basic lexical analysis, and truncating excessively long inputs.

[0027] It should be noted that, for candidate code variants, they should maintain consistency with the code to be detected in the predetermined code task, but differ from the input code in their surface expression. This difference can be reflected in at least one dimension, such as variable naming conventions, comment expression conventions, whitespace and indentation layout, control structure expression conventions, local refactoring conventions, redundant statement retention status, and dead code status.

[0028] Furthermore, before step S10, the method further includes: obtaining a clean code sample set and constructing a poisoned code sample set corresponding to the clean code sample set by injecting preset trigger features; generating training samples based on the clean code sample set, the poisoned code sample set, and the target model training instructions; performing supervised training on the original code variant generation module based on the training samples and obtaining the training candidate code variants output by the supervised training code variant generation module; and determining the target code variant generation module based on the training candidate code variants and the supervised training code variant generation module.

[0029] It should be noted that the clean code sample set can come from publicly available code corpora, trusted internal code repositories, manually reviewed datasets, or task-specific training sets. Each clean code sample in the clean code sample set includes, but is not limited to, source code, task tags, context descriptions, and language type identifiers.

[0030] It should be understood that, for a set of poisoned code samples, the poisoned code samples can be constructed by injecting preset trigger features. These preset trigger features can be at least one of the following: lexical trigger features, identifier trigger features, comment trigger features, code style trigger features, or semantically equivalent structure transformation trigger features. For example, poisoned code samples can be constructed by changing variable naming patterns, inserting preset comment templates, introducing specific whitespace and indentation layouts, or replacing them with equivalent control structures with fixed styles. Furthermore, clean code samples and poisoned code samples maintain semantic consistency in the task but do not contain reference outputs with trigger features.

[0031] Understandably, the process involves constructing a set of poisoned code samples, combining it with a set of clean code samples, and generating training samples using the target model training instructions. The target model training instructions describe the generation objective. After generating the training samples, the original code variant generation model can be subjected to supervised training to achieve initial optimization. This allows the code variant generation model to generate output results close to cleaned code based on the poisoned code. The supervised loss can be cross-entropy loss, sequence-level loss, or its variants. For training samples containing the same poisoned code sample, the code variant generation model can generate multiple training candidate code variants.

[0032] Further, the step of determining the target code variant generation module based on the training candidate code variants and the supervised-trained code variant generation module includes: inputting the training candidate code variants into the victim code model and obtaining the prediction feedback result output by the victim code model; determining the priority of the training candidate code variants based on the prediction feedback result, and constructing a preference relationship between the training candidate code variants based on the priority; and using a joint optimization method of supervised loss and ranking loss, performing ranking optimization training on the supervised-trained code variant generation module based on the preference relationship to obtain the target code variant generation module. The target code variant generation module is constructed from a target code variant generation module, a general code generation model, a rule generator, or a hybrid method.

[0033] It should be noted that after obtaining multiple training candidate code variants output by the supervised training code variant generation model, these multiple training candidate code variants are input into the victim code model, and the prediction feedback results output by the victim code model are obtained. These prediction feedback results include, but are not limited to, prediction correctness, prediction stability, target label matching degree, confidence level, and complexity control. Then, based on indicators such as prediction correctness, prediction stability, target label matching degree, confidence level, and complexity control, for example, when the preset code task is a discriminative task, candidate code variants that can make the victim code model output consistent with the clean label and have a high confidence level can be selected as high-priority candidates; when the preset code task is a generative task, candidate code variants that can make the victim code model generate results that are more consistent with the reference answer or have higher quality indicators can be selected as high-priority candidates.

[0034] Understandably, after constructing the preference relationships between training candidate code variants based on priority, a joint optimization approach using supervised loss and ranking loss can be employed. This involves ranking and optimizing the supervised code variant generation model based on these preference relationships. For example, high-priority and low-priority candidate code variants can be paired and ranked using ranking loss to make the model more inclined to generate high-priority candidates under the same input. The supervised loss aims to make the generated results closer to the target cleaned code, while the ranking loss differentiates the scores between high-priority and low-priority candidates. After this training, a target code variant generation module optimized for the cleaned-up task is obtained, used to generate multiple candidate code variants online. This module tends to generate candidate code variants that mitigate the impact of backdoor triggering, thus providing a higher-quality input foundation for the defense process.

[0035] Step S20: Validity screening is performed on each of the candidate code variants, and a target code variant set is generated based on the screening results.

[0036] Furthermore, the validity screening includes at least one of the following: lexical analysis verification, syntax analysis verification, compilation verification or interpretation execution verification, static analysis consistency verification, and semantic consistency determination.

[0037] It should be understood that, to ensure the usability of the code variants in the input victim code model, each candidate code variant needs to undergo validity screening. Lexical analysis verification is used to eliminate candidate code variants that cannot be segmented correctly or have basic lexical errors; syntax analysis verification is used to eliminate candidate code variants that cannot construct an abstract syntax tree correctly; compilation verification is used to eliminate candidate code variants that cannot be compiled; interpretation verification is used to eliminate candidate code variants that cannot pass the runtime entry point check; static analysis consistency verification is used to eliminate candidate code variants with obvious undefined variables, type errors, or control flow anomalies; and semantic consistency judgment is used to select candidate code variants that do not deviate from the original task intent of the code under test. After these multiple screening operations, the target candidate code variants that pass the screening are retained, and a target code variant set is generated from each of these target candidate code variants. Furthermore, after selecting multiple target candidate code variants, it is also necessary to count the number of target candidate code variants. If the number is less than a preset minimum value... When the target code variant generation module is reached, it will be called again until the preset number requirement is reached or the maximum number of retries is reached.

[0038] It should be noted that semantic consistency determination can be achieved by comparing the abstract syntax tree structure constraints of the candidate code variant and the code to be detected, comparing the program dependency constraints of the candidate code variant and the code to be detected, comparing the consistency of the execution results of the candidate code variant and the code to be detected on the test samples, and comparing whether the similarity of the code representation vectors of the candidate code variant and the code to be detected is higher than a preset threshold.

[0039] Step S30: Based on the victim code model, determine the prediction result according to the target code variant set and the preset code task.

[0040] It should be understood that in this embodiment, the generated prediction results are different for different preset code tasks. Therefore, when generating prediction results, the preset code tasks need to be taken into account. That is, based on the victim code model, the prediction results are determined according to the target code variant set and the preset code tasks. The prediction results can be information such as category probability distribution, similarity score, confidence score, conditional probability, or ranking score. In addition, in order to reduce the overall inference latency, multiple target candidate code variants in the target code variant set can be input into the victim code model in parallel.

[0041] Step S40: Select the corresponding aggregation strategy according to the output format of the victim code model or the type of the preset code task, perform aggregation operation on each prediction result according to the aggregation strategy, and obtain the defense result corresponding to the code to be detected according to the aggregation operation result, so as to complete the backdoor defense of the neural code model.

[0042] It should be noted that, in order to effectively improve the accuracy of the defense results, the aggregation operation in this embodiment can select different implementation methods according to the output format of the victim code model or the preset code task. Then, the aggregation operation is performed on each prediction result according to the aggregation strategy, and the defense result corresponding to the code to be detected is obtained based on the aggregation operation result. In the inference stage, the defense process is executed without accessing the internal parameters, gradient information and training data of the victim code model, providing a computable decision basis for the backdoor defense process, that is, completing the backdoor defense of the neural code model and avoiding the threat from backdoor attacks. The neural code model can be any one of the following: code classification model, code clone detection model, code defect detection model, code repair model, code summarization generation model, code translation model, and code search model.

[0043] Furthermore, the aggregation strategy includes at least one of the following: averaging, weighted averaging, voting, median, truncated averaging, reordering, representative outcome selection, and marginalization estimation.

[0044] It should be understood that after selecting the corresponding aggregation strategy based on the output format of the victim code model or the preset code task, the prediction results can be calculated according to the aggregation strategy. The calculation method can be average, weighted average, median, voting, median, or truncated average, etc. Specifically, the weighted average calculation is performed as follows: Let the target code variant set be... The prediction results for each target code variant are: The weight is The defense result is obtained by a weighted combination of the various prediction results, where the weights are... The average aggregation can be determined based on at least one of the following: semantic consistency score, compilation pass status, static analysis score, and prediction confidence. The specific method for average aggregation is as follows: for each target code variant... In other words, we can obtain its prediction results on the victim code model. When the prediction results are probability distributions in the same label space, the average of each probability distribution can be directly calculated, and the average result can be used as the defense result corresponding to the code to be detected. The specific method of voting operation is as follows: when the prediction result output by the victim code model is a discrete label, the labels corresponding to each target code variant can be subject to majority voting, and the label with the most votes is used as the final output.

[0045] It is important to emphasize that for re-ranking and representative result selection, the following methods can be used: Rank the prediction results according to their corresponding confidence or ranking scores, and extract the prediction result with the highest confidence or ranking score from the ranking results; alternatively, aggregate multiple prediction results and select a representative result from the main aggregation as the defense result. For marginalization estimation, the following methods can be used: After the target code variant generation module maps multiple target code variants, use the target code variants as intermediate variables for the code to be detected, and then combine the prediction results and their weights corresponding to each code variant to calculate the conditional estimate of the code to be detected in the label space. This process can be regarded as performing a discrete approximation marginalization aggregation on the prediction results of the code variant set, where the weights can be determined based on at least one of the target code variant's validity score, semantic consistency score, and prediction confidence. These methods can effectively reduce the impact of backdoor triggering features on prediction results and improve the stability of defense output results in black-box, gray-box, or white-box deployment scenarios without accessing the victim code model's internal parameters, gradient information, and training data.

[0046] It's important to note that in a specific application scenario, if the code to be detected contains a style-based backdoor triggering pattern, causing the victim code model to directly predict anomalies, then the target code variant generation module generates multiple filtered target code variants. The prediction results of these variants are then aggregated, thereby reducing the dominance of a single anomaly triggering pattern on the final output. Through the aforementioned series of operations—code variant generation, validity screening, prediction invocation, and aggregation decision-making—defense enhancements can be implemented on the victim code model's prediction process without directly disrupting the syntax and semantic structure of the code to be detected. This helps improve the stability and reliability of the model's output in scenarios with backdoor triggering risks.

[0047] It should be understood that, reference Figure 2 , Figure 2 The simplified flowchart illustrates the overall process: Input is code snippets submitted by the user, source files to be analyzed, functions to be repaired, code samples to be retrieved, or program units to be annotated. After a series of preprocessing steps, the code to be detected is input into the target code variant generation module, which generates and outputs candidate code variants. Each candidate variant undergoes validity screening, including at least one of the following: lexical analysis verification, syntax analysis verification, compilation verification or interpreted execution verification, static analysis consistency verification, and semantic consistency determination. The code variants from the target code variant set are then input into the victim code model, which generates and outputs prediction results. Next, based on the output format of the victim code model or the aggregation strategy selected according to the preset code task type, aggregation operations are performed on each prediction result. The defense result corresponding to the code to be detected is obtained based on the aggregation operation result, thus completing the backdoor defense against the neural code model.

[0048] In this embodiment, upon receiving code to be detected, the structure or representation of the code to be detected is reconstructed according to the code variant generation module and semantic equivalence logic to generate candidate code variants. Each candidate code variant is then screened for validity, and a target code variant set is generated based on the screening results. Based on the victim code model, a prediction result is determined according to the target code variant set and a preset code task. A corresponding aggregation strategy is selected based on the output format of the victim code model or the type of the preset code task. Aggregation operations are performed on each prediction result according to the aggregation strategy, and a defense result corresponding to the code to be detected is obtained based on the aggregation operation result, thus completing the backdoor defense against the neural code model. By introducing a target code variant generation module to generate candidate code variants that maintain consistency with the code to be detected on a predetermined code task, and inputting the target code variant set into the victim code model for prediction, the defense process can be executed without accessing the internal parameters, gradient information, and training data of the victim code model. This helps reduce the impact of different triggering methods on the prediction results, thereby effectively improving the accuracy and reliability of backdoor defense.

[0049] In one specific implementation, this application provides steps for determining prediction results based on a victim code model. Please refer to... Figure 3 , Figure 3 This is the second flowchart illustrating the backdoor defense method based on a neural code model generated from code variants provided in this application. Step S30 includes steps S301 to S304: Step S301: Extract the task feature information of the preset code task.

[0050] It should be understood that task feature information refers to the feature information used to identify different preset code tasks. Preset code tasks can include code classification, code clone detection, code defect detection, code repair, code translation, code summary generation, and code search.

[0051] Step S302: Input each code variant in the target code variant set into the victim code model.

[0052] Step S303: When the victim code model is a discriminative model, obtain the category probability distribution data and similarity score output by the victim code model based on the task feature information, and use at least one of the category probability distribution data and the similarity score as the prediction result.

[0053] It should be noted that the victim code model is deployed in the form of a remote interface, local inference service, or embedded component. Its deployment scenarios can include black-box deployment scenarios, gray-box deployment scenarios, and white-box deployment scenarios. The defense process in this embodiment does not depend on whether the internal information of the victim code model can be accessed. In the black-box deployment scenario, it can be executed without accessing its internal parameters, gradient information, and training data. In the gray-box or white-box deployment scenarios, the same steps can be followed, and the available internal model information can be combined to enhance code variant screening, prediction result weighting, or aggregation decision-making.

[0054] It should be understood that when the victim code model is a discriminative model, the output category probability distribution data and similarity score are based on task feature information. For example, when the preset code task is a code defect detection task, the output is the probability of "defect exists" and "defect does not exist". When the preset code task is a code clone detection task, the output is the similarity score between the code and the preset code pair. In this case, the probability of "defect exists" and "defect does not exist" and the similarity score between the code and the preset code pair can be used as the prediction results.

[0055] Step S304: When the victim code model is a generative model, obtain the candidate generation results output by the victim code model based on the task feature information, as well as the confidence level, conditional probability, and ranking score corresponding to the candidate generation results, and use at least one of the candidate generation results and their corresponding confidence level, conditional probability, and ranking score as the prediction result.

[0056] Understandably, when the victim code model is a generative model, it outputs candidate generation results based on task feature information, along with the corresponding confidence, conditional probability, and ranking score. For example, when the preset code task is a code repair task, the victim code model outputs repair suggestions and their confidence for each code variant; when the preset code task is a code summary generation task, it outputs a natural language summary and its generation score for each code variant. In this case, the repair suggestions and their confidence, as well as the natural language summary and its generation score, can be used as prediction results.

[0057] This embodiment extracts task feature information of a preset code task; inputs each code variant in the target code variant set into the victim code model; when the victim code model is a discriminative model, it obtains the category probability distribution data and similarity score output by the victim code model based on the task feature information, and uses at least one of the category probability distribution data and the similarity score as the prediction result; when the victim code model is a generative model, it obtains the candidate generation results output by the victim code model based on the task feature information, as well as the confidence level, conditional probability, and ranking score corresponding to the candidate generation results, and uses at least one of the candidate generation results and their corresponding confidence level, conditional probability, and ranking score as the prediction result. Through the above method, each code variant in the target code variant set is input into the victim code model in parallel. For the victim code model, after receiving each code variant from the input target code variant set, it generates and outputs the prediction result based on the task feature information, thereby effectively improving the accuracy and stability of the prediction result.

[0058] The backdoor defense system based on a neural code model generated by code variants, provided in this application, is described below. The backdoor defense system based on a neural code model generated by code variants described below corresponds to the backdoor defense method based on a neural code model generated by code variants described above. Please refer to... Figure 4 , Figure 4 This is a schematic diagram of the module structure of a backdoor defense system based on a neural code model generated from code variants, provided in an embodiment of this application, including: The code variant generation module T10 is used to reconstruct the structure or representation of the code to be detected according to the code variant generation module and semantic equivalence logic when the code to be detected is received, so as to generate candidate code variants.

[0059] The validity screening module T20 is used to screen the validity of each candidate code variant and generate a set of target code variants based on the screening results.

[0060] The prediction module T30 is used to determine the prediction result based on the victim code model, the target code variant set, and the preset code task.

[0061] The aggregation decision module T40 is used to select a corresponding aggregation strategy according to the output form of the victim code model or the type of the preset code task, perform aggregation calculation on each prediction result according to the aggregation strategy, and obtain the defense result corresponding to the code to be detected based on the aggregation calculation result, so as to complete the backdoor defense of the neural code model.

[0062] In this embodiment, upon receiving code to be detected, the structure or representation of the code to be detected is reconstructed according to the code variant generation module and semantic equivalence logic to generate candidate code variants. Each candidate code variant is then screened for validity, and a target code variant set is generated based on the screening results. Based on the victim code model, a prediction result is determined according to the target code variant set and a preset code task. A corresponding aggregation strategy is selected based on the output format of the victim code model or the type of the preset code task. Aggregation operations are performed on each prediction result according to the aggregation strategy, and a defense result corresponding to the code to be detected is obtained based on the aggregation operation result, thus completing the backdoor defense against the neural code model. By introducing a target code variant generation module to generate candidate code variants that maintain consistency with the code to be detected on a predetermined code task, and inputting the target code variant set into the victim code model for prediction, the defense process can be executed without accessing the internal parameters, gradient information, and training data of the victim code model. This helps reduce the impact of different triggering methods on the prediction results, thereby effectively improving the accuracy and reliability of backdoor defense.

[0063] It is understood that the detailed functional implementation of each of the above modules can be found in the description of the aforementioned method embodiments, and will not be repeated here.

[0064] It should be understood that the above system is used to execute the methods in the above embodiments. The corresponding program modules in the system are similar in implementation principle and technical effect to those described in the above methods. The working process of the system can be referred to the corresponding process in the above methods, and will not be repeated here.

[0065] Based on the methods in the above embodiments, this application provides an electronic device, please refer to... Figure 5 , Figure 5 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application.

[0066] It should be noted that the system may include: a processor 10, a communications interface 20, a memory 30, and a communication bus 40. The processor 10, communications interface 20, and memory 30 communicate with each other via the communication bus 40. The processor 10 can invoke logical instructions stored in the memory 30 to execute the methods described in the above embodiments.

[0067] Furthermore, the logical instructions in the aforementioned memory 30 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product.

[0068] Based on the methods in the above embodiments, this application provides a computer-readable storage medium storing a computer program that, when run on a processor, causes the processor to execute the methods in the above embodiments.

[0069] The method steps in this embodiment can be implemented in hardware or by a processor executing software instructions. The software instructions can consist of corresponding software modules, which can be stored in random access memory, flash memory, read-only memory, programmable read-only memory, erasable programmable read-only memory, electrically erasable programmable read-only memory, registers, hard disks, portable hard disks, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor.

[0070] It is understood that the various numerical designations used in the embodiments of this application are merely for descriptive convenience and are not intended to limit the scope of the embodiments of this application. Those skilled in the art will readily understand that the above descriptions are merely preferred embodiments of this application and are not intended to limit this application. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A backdoor defense method based on a neural code model generated by code variants, characterized in that, include: Upon receiving the code to be detected, the code to be detected is reconstructed in terms of structure or representation based on the target code variant generation module and semantic equivalence logic to generate candidate code variants. Each candidate code variant is screened for validity, and a set of target code variants is generated based on the screening results; Based on the victim code model, the prediction result is determined according to the target code variant set and the preset code task; The corresponding aggregation strategy is selected according to the output format of the victim code model or the type of the preset code task. The prediction results are aggregated according to the aggregation strategy, and the defense result corresponding to the code to be detected is obtained according to the aggregation result, so as to complete the backdoor defense of the neural code model. Before the step of reconstructing the structure or representation of the code to be detected based on the target code variant generation module and semantic equivalence logic upon receiving the code to be detected, in order to generate candidate code variants, the method further includes: Obtain a clean code sample set, and construct a poisoned code sample set corresponding to the clean code sample set by injecting preset trigger features; Training samples are generated based on the clean code sample set, the poisoned code sample set, and the target module training instructions; The original code variant generation module is trained under supervision based on the training samples, and the training candidate code variants output by the supervised code variant generation module are obtained. The target code variant generation module is determined based on the training candidate code variants and the supervised training code variant generation module.

2. The method as described in claim 1, characterized in that, The step of determining the target code variant generation module based on the trained candidate code variants and the supervised-trained code variant generation module includes: The training candidate code variants are input into the victim code model, and the prediction feedback results output by the victim code model are obtained; The priority of the training candidate code variants is determined based on the prediction feedback results, and a preference relationship between the training candidate code variants is constructed based on the priority. A joint optimization approach combining supervised loss and ranking loss is adopted. Based on the preference relationship, the supervised training code variant generation module is trained to rank and optimize, thereby obtaining the target code variant generation module.

3. The method as described in claim 2, characterized in that, The target code variant generation module is constructed from a target code variant generation module, a general code generation model, a rule generator, or a hybrid approach.

4. The method as described in claim 1, characterized in that, The validity screening includes at least one of the following: lexical analysis verification, syntax analysis verification, compilation verification or interpretation execution verification, static analysis consistency verification, and semantic consistency determination.

5. The method as described in claim 1, characterized in that, The step of determining the prediction result based on the victim code model, the target code variant set, and the preset code task includes: Extract task feature information from preset code tasks; Each code variant in the target code variant set is input into the victim code model; When the victim code model is a discriminative model, the category probability distribution data and similarity score output by the victim code model based on the task feature information are obtained, and at least one of the category probability distribution data and the similarity score is used as the prediction result; When the victim code model is a generative model, the candidate generation results output by the victim code model based on the task feature information and their corresponding confidence, conditional probability and ranking score are obtained, and at least one of the candidate generation results and their corresponding confidence, conditional probability and ranking score is used as the prediction result.

6. The method according to any one of claims 1 to 5, characterized in that, The aggregation strategy includes at least one of the following: average, weighted average, voting, median, truncated average, reordering, representative outcome selection, and marginalization estimation.

7. A backdoor defense system based on a neural code model generated by code variants, characterized in that, include: The code variant generation module is used to reconstruct the structure or representation of the code to be detected based on the target code variant generation module and semantic equivalence logic when the code to be detected is received, so as to generate candidate code variants. The validity screening module is used to screen each of the candidate code variants for validity and generate a set of target code variants based on the screening results; The prediction module is used to determine the prediction result based on the victim code model, the target code variant set, and the preset code task. The aggregation decision module is used to select a corresponding aggregation strategy based on the output format of the victim code model or the type of the preset code task, perform aggregation calculation on each prediction result according to the aggregation strategy, and obtain a defense result corresponding to the code to be detected based on the aggregation calculation result, so as to complete the backdoor defense of the neural code model. The code variant generation module is also used to obtain a clean code sample set and construct a poisoned code sample set corresponding to the clean code sample set by injecting preset trigger features; and generate training samples based on the clean code sample set, the poisoned code sample set, and the target module training instructions. The original code variant generation module is trained under supervision based on the training samples, and the training candidate code variants output by the supervised code variant generation module are obtained. The target code variant generation module is determined based on the training candidate code variants and the supervised training code variant generation module.

8. An electronic device, characterized in that, include: At least one memory for storing computer programs; At least one processor is configured to execute a program stored in the memory, wherein when the program stored in the memory is executed, the processor is configured to perform the method as described in any one of claims 1-6.

9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is run on the processor, it causes the processor to perform the method as described in any one of claims 1-6.

Images