Affiliation:
1. Key Laboratory of High Confidence Software Technologies (Peking University), Ministry of Education; School of Computer Science, Peking University, China
2. Zhejiang University, China
3. Huawei, China
Abstract
In the software engineering (SE) community, deep learning (DL) has recently been applied to many source code processing tasks, achieving state-of-the-art results. Due to the poor interpretability of DL models, their security vulnerabilities require scrutiny. Recently, researchers have identified an emergent security threat to DL models, namely
poison attacks
. The attackers aim to inject insidious backdoors into DL models by poisoning the training data with poison samples. The backdoors mean that poisoned models work normally with clean inputs but produce targeted erroneous results with inputs embedded with specific triggers. By using triggers to activate backdoors, attackers can manipulate poisoned models in security-related scenarios (
e.g.,
defect detection) and lead to severe consequences.
To verify the vulnerability of deep source code processing models to poison attacks, we present a poison attack approach for source code named
CodePoisoner
as a strong imaginary enemy.
CodePoisoner
can produce compilable and functionality-preserving poison samples and effectively attack deep source code processing models by poisoning the training data with poison samples. To defend against poison attacks, we further propose an effective poison detection approach named
CodeDetector
.
CodeDetector
can automatically identify poison samples in the training data. We apply
CodePoisoner
and
CodeDetector
to six deep source code processing models, including defect detection, clone detection, and code repair models. The results show that ①
CodePoisoner
conducts successful poison attacks with a high attack success rate (avg: 98.3%, max: 100%). It validates that existing deep source code processing models have a strong vulnerability to poison attacks. ②
CodeDetector
effectively defends against multiple poison attack approaches by detecting (max: 100%) poison samples in the training data. We hope this work can help SE researchers and practitioners notice poison attacks and inspire the design of more advanced defense techniques.
Publisher
Association for Computing Machinery (ACM)
Reference95 articles.
1. Available. https://www.wikipedia.org. Available. https://www.wikipedia.org.
2. Available. https://translate.google.com. Available. https://translate.google.com.
3. Available. https://github.com/. Available. https://github.com/.
4. Available. https://stackoverflow.com. Available. https://stackoverflow.com.
5. Available. https://github.com/LJ2lijia/CodeDetector. Available. https://github.com/LJ2lijia/CodeDetector.