论文标题
对深度源代码处理模型的毒物攻击和防御
Poison Attack and Defense on Deep Source Code Processing Models
论文作者
论文摘要
在软件工程社区中，深度学习（DL）最近已应用于许多源代码处理任务。由于DL模型的解释性差，因此需要审查其安全性漏洞。最近，研究人员确定了新兴的安全威胁，即毒害攻击。攻击者的目的是通过用毒药样本毒害训练数据，将阴险的后门注入模型。中毒模型通常与干净的输入一起工作，但与嵌入触发器的中毒输入产生有针对性的错误结果。通过激活后门，攻击者可以在与安全有关的方案中操纵中毒模型。 为了验证现有深层源代码处理模型对毒药攻击的脆弱性，我们为源代码介绍了名为CodePoisoner作为强大虚构敌人的源代码。 CodePoisoner可以通过用毒药样本中毒训练数据来产生可编译的人类侵略毒药样本和攻击模型。为了防止毒药攻击，我们进一步提出了一种名为“编码器”的有效防御方法，以检测训练数据中的毒药样本。编码器可以应用于许多模型架构，并有效地防止多种毒物攻击方法。我们将代号和编码器应用于三个任务，包括缺陷检测，克隆检测和代码维修。结果表明，（1）代码专用者在误导模型中实现了高发作的成功率（最大值：100％），以实现靶向错误行为。它验证了现有的深层源代码处理模型对毒攻击有很大的脆弱性。 （2）编码器通过在训练数据中检测（最大：100％）毒药样本有效地防止多种毒物攻击方法。我们希望这项工作可以帮助从业者注意到毒药的攻击并激发更先进的防御技术的设计。
In the software engineering community, deep learning (DL) has recently been applied to many source code processing tasks. Due to the poor interpretability of DL models, their security vulnerabilities require scrutiny. Recently, researchers have identified an emergent security threat, namely poison attack. The attackers aim to inject insidious backdoors into models by poisoning the training data with poison samples. Poisoned models work normally with clean inputs but produce targeted erroneous results with poisoned inputs embedded with triggers. By activating backdoors, attackers can manipulate the poisoned models in security-related scenarios. To verify the vulnerability of existing deep source code processing models to the poison attack, we present a poison attack framework for source code named CodePoisoner as a strong imaginary enemy. CodePoisoner can produce compilable even human-imperceptible poison samples and attack models by poisoning the training data with poison samples. To defend against the poison attack, we further propose an effective defense approach named CodeDetector to detect poison samples in the training data. CodeDetector can be applied to many model architectures and effectively defend against multiple poison attack approaches. We apply our CodePoisoner and CodeDetector to three tasks, including defect detection, clone detection, and code repair. The results show that (1) CodePoisoner achieves a high attack success rate (max: 100%) in misleading models to targeted erroneous behaviors. It validates that existing deep source code processing models have a strong vulnerability to the poison attack. (2) CodeDetector effectively defends against multiple poison attack approaches by detecting (max: 100%) poison samples in the training data. We hope this work can help practitioners notice the poison attack and inspire the design of more advanced defense techniques.
