用大模型自动生成代码语义保持变换,提升克隆检测模型鲁棒性。
Auto-SPT: Automating Semantic Preserving Transformations for Code
- 基于大模型自动构造多样语义保持变换,改变语法结构但保留功能。
- 生成的变换使顶尖代码克隆检测器性能下降超过30%。
- 适合训练抗真实代码变形的软件安全模型,提升实战能力。
用于代码克隆检测的机器学习模型需判断两段代码是否语义等价,是重构和漏洞检测的关键。然而,这些模型通常在干净结构化数据上训练,而真实代码常经历重构、压缩、格式化和编译优化等语义保持变换(SPTs)。为弥合训练与测试数据的差距,本文提出Auto-SPT框架,利用大语言模型自动生成合成数据生成器。Auto-SPT通过大模型设计多样化SPT,实现强效变换,并分析发现SPT多样性影响组合强度。实验证明,Auto-SPT生成的SPT比现有方法更丰富,显著降低主流代码克隆检测器性能。进一步实验表明,该框架可用于增强训练数据,构建对现实对抗性变换鲁棒的代码克隆检测模型。
原文摘要 · Abstract (English)
Machine learning (ML) models for code clone detection determine whether two pieces of code are semantically equivalent, which in turn is a key building block for software-engineering tasks like refactoring and security tasks like vulnerability and malware detection. While these models are predominantly trained on clean, structured code datasets, real-world code often undergoes a variety of semantic-preserving transformations, including refactoring, minification, automated formatting, and compiler optimizations. To address this critical gap between training and test data, we propose Auto-SPT, a novel framework to automatically construct synthetic-data generators for code. Auto-SPT is designed to produce Semantic Preserving Transformations (SPTs) that alter a program's syntactic structure while preserving its functionality and is instantiated on top of Large Language Models (LLMs). In particular, we use LLMs to craft a diverse set of SPTs, generate strong implementations for these SPTs, and compose them to result into strong transformations. Our formal analysis shows that the diversity of SPTs impacts the strength of their composition. We then empirically demonstrate that Auto-SPT generates more diverse SPTs than existing approaches and these SPTs significantly drop the performance of state-of-the-art code clone detectors. Further experiments show Auto-SPT can be used to enhance code datasets for training, to produce code-clone detection models that are robust to real-world, adversarial code transformations.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。