Evaluating and Enhancing the Robustness of Code Pre-trained Models through Structure-Aware Adversarial Samples Generation
Authors: Nuo Chen
Qiushi Sun
Jianing Wang
Ming Gao
Xiaoli Li
Xiang Li
Venue: EMNLP 2023 Findings (2023)
Keywords: Neural Code Intelligence
Pre-trained Language Models
Adversarial Attack
TL;DR: We leverage the code structure to generate adversarial examples to attack code pre-trained models, and then enhance model robustness with adversarial training strategies by exploiting the structural information.

Abstract: Code pre-trained models (CodePTMs) have significantly advanced the field of neural code intelligence. Despite their capabilities, 
these models are susceptible to adversarial attacks that subtly modify the model inputs, resulting in incorrect outputs or predictions. Previous methods of robustness evaluation for CodePTMs primarily stem from a textual perspective, without explicitly taking into account the structure of the code. Furthermore, prior studies fail to encompass a broad enough spectrum of tasks and models. In this paper, we propose a set of novel robustness evaluation methods based on the intrinsic structure of the code. Specifically, we first launch adversarial attacks on crucial identifier tokens and sub-tree structures to explore the impact of imperceptible perturbation. Then, we perform global restructuring of the code using different traversal methods for abstract syntax trees, aiming to explore the model's sensitivity to input samples with equivalent information. Moreover, for each scenario, we employ adversarial training methods to explore the possibility of restoring the performance of perturbed models. For both code understanding and generation, our proposed method has demonstrated its effectiveness across a wide range of models and tasks, thereby allowing us to make one step forward in our understanding of the inner mechanisms of CodePTMs.

Evaluating and Enhancing the Robustness of Code Pre-trained Models through Structure-Aware Adversarial Samples Generation
Nuo Chen', Qiushi S Jianing Wang', Ming Gao', Xiaoli Li"; Xiang Li
East China Normal University, Shanghai, China
Institute for Infocomm Research, A STTA,, Singapore
National University of Singapore, Singapore nuochen@stu.c ecnu. www.:eww..u...c.....oo cn, qiushisun@u. nus, edu, lygwjn@gmail.cmm com x1li@i2r. a-star edu. sg, {xiangli, mgao edase. ecnu, edu. cn
Abstract
2017) have achieved great success in NLP, their counterparts trained on code (Feng et al., 2020; Guo et al., 2021) have also made remarkable strides in the field neural code intelligence (Xu and Zhu, 2022; Xu et al., 2022: Zan et al., 2023). Despite their impressive capabilities, CodePTMs still retain prevalent weaknesses inherent in language mod- els: they sensitive to the input sequence and are susceptible to adversarial attacks. The model's vulnerability to variations in input can impair its generalization (Wang et al., 2022: Baniecki and Biecek, 2023). Adversarial examples, though im- perceptible to humans, can deceive CodePTMs into generating incorrect predictions or code sequences in downstream tasks (e.g., clone detection, code summarization). Unlike similar attacks for images, audio, and natural languages, the structured nature of programming languages introduces distinct and novel challenges. While methods have been pro- posed by researchers as potential countermeasures against attacks (Szegedy et al., 2014; Goodfellow et al., 2015; Jia and Liang, 2017; Kang et al., 2018; Zhou et al., 2021), the construction of adversarial samples remains an ongoing concern. Adversar- ial training often involves exposing the model adversarial examples during training so that the model learns to defend itself against such examples when encounters them the future. However, for CodePTMs, an approach that incorporates code structure is yet to be substantially established.
Code pre-trained models (CodePTMs) have sig- nificantly advanced the field of neural code intelligence. Despite their capabilities, these models are susceptible to adversarial attacks that subtly modify the model inputs, result- ing incorrect outputs or predictions. Pre- vious methods of robustness evaluation for CodePTMs primarily stem from a textual per- spective, without explicitly taking into account the structure of the code. Furthermore, prior studies fail to encompass a broad enough spec- trum of tasks and models. In this paper, we propose set of novel robustness evaluation methods based on the intrinsic structure the first launch adversarial attacks on crucial identifier tokens and sub-tree structures to explore the impact of impercep- tible perturbation. Then, perform global restructuring of the code using different traver- sal methods for abstract syntax trees, aiming explore the model's sensitivity to input sam- ples with equivalent information. Moreover, for each scenario, we employ adversarial training methods to explore the possibility of restoring the performance perturbed models. For both pro-
code. Specifically,
code understanding and generation, posed method has demonstrated its effective- ness across wide range of models and tasks, thereby allowing us to make one step forward in our understanding of the inner mechanisms of CodePTMs. Our codes and data are publicly available https: / //g thub. com/nchen989/ CodeRobustness.
In representative works on robustness analysis targeting code scenarios, Yang et al. (2022) pio- neer an example generation method that balances both natural semantic and operational semantics. Recently, Jha and Reddy (2023) leverage the struc- ture of code to propose code-specific adversarial samples generation, which be used to evalu- ate the vulnerabilities of CodePTMs. While these studies concentrate on generating adversarial code samples, there is an absence of explicit modeling of the structure of code. Furthermore, the existing
1 Introduction
Pre-trained language models have revolutionized the landscape of natural language processing (NLP) (Devlin et al., 2019; Radford et al., 2019; Liu et al., 2019; Qiu et al., 2020, inter alia). While these transformer-based models (Vaswani al., Work done while interning Institute for Infocomm Rescarch, STAR. Equal advising.

---

analyses remain inadequate in examining differ- ent architectures of CodePTM and corresponding downstream tasks, which in turn, hampers the gen- eralizability of the conclusions drawn.
demonstrate the effectiveness of our method.
2 Related Works
2.1 Code Pre-trained Models
In this paper, propose comprehensive frame- work based the structural information of the code, which integrates sample generation and ad- versarial training, aiming to conduct thorough evaluation of the robustness of CodePTMs.
Following the success of pre-trained language mod- els (Qiu et al., 2020) in NLP, code pre-trained mod- els (CodePTMss) have recently demonstrated markable success in wide range of downstream tasks in the domain of neural code intelligence. By pretraining on massive code-based data (e.g. GitHub repositories), these models can learn rich contextual representations that can be transferred to code-related downstream tasks. Feng et al. (2020) use bimodal data from CodeScarchNet (Husain et al., 2019) to train CodeBERT that shares the same model architecture as RoBERTa (Liu et al., 2019). Then, GraphCodeBERT also uses the same architecture while additionally considering the in- herent structure code, specifically, the data flow graph. There are also models with encoder-decoder architectures, such as Code'T5 (Wang et al., 2021) and PLBART (Ahmad et al., 2021), which inherit the multi-task training strategies of T5 (Raffel et al.. 2020) and BART (Lewis al., 2020). UniX- coder (Guo al., 2022) harness the UniLM (Dong et al., 2019) architecture and is pre-tratee pre-trained on cross- modal data to support both code understanding and generation. Moreover, decoder-only CodePTMs are crafted to generate high-quality code sequences, which can be utilized for program synthesis (Chen et al., 2021) and even excel in programming com- petitions (Li et al., 2022).
We first conduct an assessment through the per- turbation of model inputs. Specificallyy, propose strategies: (1) Generating adversarial samples that are imperceptible humans launch adver- sarial attacks on the model. (2) Leveraging the syntax of the code, namely, the structural informa- tion of AST to reconstruct the input sequence into a new one that preserves equivalent information to probe models' sensitivity to input.
nu
entreraace
Non-loire
oxpression
Lana
compartiann
Figure 2: A Python code snippet with its parsed AST.
Then, inspired by adversarial training, we trained our model on samples constructed from code struc- tures, significantly enhancing the model's robust- ness in the face of structural attacks. Additionally, we conduct an in-depth analysis of the experimen- tal results and validate that the methods to counter various types of attacks are generalizable.
2.2 Adversarial Attacks for Language Models
Despite the remarkable achievements of language models existing literature reveals their suscepti- bility to adversarial samples, which involve sub- tle perturbations et al., 2018). In NLP, this technique was ini- tially employed evaluate the robustness of mod- els across different tasks (Jia and Liang, 2017; Tyyer et al., 2018; Belinkov and Bisk, 2018, in- ter alia). With the rise of pre-training, BERT- Attack (Li et al., 2020) is first proposed that uses pre-trained language models to generate adversar- ial samples. For the scenario of code-related tasks, methods for AST-based neural networks was first proposed (Yefet al., 2020; Zhang al., 2020).
initial inputs (Chakraborty
Our contributions can be summarized as follows:
By perturbing text while maintaining equiva- lent information, and leveraging adversarial attacks, unveil both the vulnerabilities and sensitivities of various CodePTMs.
We utilize a range of adversarial training ap- proaches to recover the performance of dis- turbed models and conduct an in-depth exam- ination the unique attributes displayed by different models across a spectrum of tasks.
Then, Yang et (2022) adversarially transform inputs to make victim CodePTMs produce wrong outputs while considering the natural semantics
Experiments on extensive code-related tasks across different programming languages

---

Golden Oulput
Returns the maximum of two integers.
Source Code der! max 2 @
Attacked Code
66) 76 8
Attack
der'
sum e 66 1 ,,8
bll 12 613 ,144 1 else 217
bll ir b ,,14 25 else 16
return 18 x119
return 19
Summarize
Summarize
Returns the maximum of two integers.
X
Sum of two Terms.
Figure Illustration of curating adversarial samples based on the structure of code to attack CodePTMs. For brevity, employ the CodeTS model backbone, showcasing the strategy of signature attack in code summarization tasks using Python code snippets from training sets.
code. Recently, CodeAttack (Jha and Reddy, 2023) utilizes code structure to generate adversar- ial samples for evaluating the vulnerabilities of CodePTMs. Zhang ct al. (2023) harnesses the un- certainty of CodePTMs' output, utilizing it to guide searching for adversarial examples through variable name substitution. Distinet from these methods, we have adapted various attack strategies fit the code scenarios. Moreover, we concurrently exam- ine the vulnerabilitics of both code generation and understanding tasks for CodePTMs across different architectures.
Algorithm 1 Subtree Attack
Input: Code snippet
Output: Modified code snippet d'
procedure DROPSUBTREE(C)
2: GeeAATT(())
3: leaf_parents + Getl (aaeenoodddPParets(T))
4:
if leaf peaf_ts # None then
5:
parent_to_drve + RandomChoose
(leaf_parents)
RemoveChildrens((1 (ppreenttttpprrt__ooo parent_lo_drop)
é' < ASTroCoe))TT)
return else
3 Method
10:
return c
3.1 Adversarial Attacks on Code Pre-trained Models
11:
end if
12:
end procedure
Subtree Attack. Randomly drop a non-leaf node and its descendants from code snippet's parsed AST. In the AST, non-leaf nodes typically repre- sent higher-level constructs of the code, such as conditional statements, function definitions, and so forth. Deleting non-leaf node along with all its child nodes may imply the disruption of part of the code, such as loop, a branch of conditional statement, or function call. Specifically, as shown Algorithm I, code snippet is first parsed into an AST with all non-leaf nodes identified. Then, one of them is randomly selected and dropped, along with all of its child nodes. Following this, the mod- ified AST is re-converted back into code snippets. In the cases where the AST has non-leaf nodes, the original code snippet is directly returned.
propose another approach to straightforwardly con- structing adversarial samples that involve randomly replacing the signature of an input function with an- other word from the vocabulary. Although altering the function signature does not change the intrin- sic logic of the function, it can modify the code snippets' context. This subtle change could present challenges to CodePTMs that seek to understand code at semantic level. For instance, suppose we have a function with the signature add b), which is used in the code to perform additional operations. If we change this function's 's signature to subtract(a, b), the intrinsic logic of the func- tion (performing addition operations) remains un- changed. However, the semantics of the function undergoes significant transformation. Sequential models would typically expect the subtract function to perform subtraction operations, not addition.
Signature Attack. Unlike natural language, the signature of a function often contains more infor- mation than other tokens in the sequence. Thus, we

---

Recotstraction BES mux def 77 7
return cle
4 Sourro reaee 7.
rctuna 18
1 al 21 15, g1
Pigh S. max
* 1010 (11 do 2 retors
Oulput:
Oulput:
Retume the maximum value of function..
Sum of two terms.
Original Octput:
Subtraa d -
deff sune? é 2 16
Return the maximum of two tokens.
2 x9 __00 glll 212 g33,14444 15 deg
__10 gll g122 3M1 ds retural 19 21
Output:
Returns the maximum of two integers.
Output:
Output:
function.
Figure 3: Schematic illustration of four different adversarial sample construction methods, which include strategies based subtrees of AST, function signatures, and two distinct methods of reconstruction derived from AST traversal. These newly generated samples all exert varying degrees of impact on the model's output (or prediction). However, compared the original output and golden data, their semantic accuracy inferior.
3.2 Reconstruction
Algorithm 2 Reconstruction By Traversal
To investigate the sensitivity of CodePTMs to in- puts, we considered framework for introducing perturbations to the code while maintaining an equivalent amount of information. The primary difference between the sequences generated from AST traversal and the original code lies in their structure and order. In the original code, tokens ap- pear in the order they are found the source code. However, in the sequence generated by traversing the AST using DFS or BFS, the order of the tokens reflects the structure of the code. In DFS traver- sal, the order of the tokens is closer to the actual execution order, while in BFS traversal, the or- der mainly reflects the hierarchical structure of the code. Furthermore, although the sequence gener- ated by traversing the AST contains all tokens from the original code, may not fully retain the seman- tic information of the original code due to the loss of original structural information. For instance, the condition of conditional statement and its body might be separated, making their relationship less apparent in the sequence.
Input: Code snippet c, Traversal mode Output: Modified code snippet é' procedure TRAVERSAL RECONSTRUC-
TION(e, m)
2:
T T-GeLAST(C
3:
token_list + list()
4:
for node in traverse(c, m) do if node.out oot_degrree = 0 and node.in fede.in_degree 1 then token Jist pnkee__irrappenddmddeellllll
5:
end if end for c
9:
LListoCooeettkeen_iin
10: return e
11: end procedure
training process, enabling the model to be robust enough to make reliable predictions generate correct sequences when confronted with these in- tentionally designed perturbations.
Previous work has repeatedly demonstrated that code models can capture structural information be- neath the textual level (Wan et al., 2022: Chen et al., 2022). Thus, we believe that robust models should be able to extract the necessary information from these "reconstructed" sequences. The procedure is demonstrated in Algorithm 2, where m indicates using BFS DFS for traversal. The details of AST traversal are shown in Algorithm 3.
We first denote the CodePTM as M. Given an input æ and corresponding target label or se- quence y. we define the loss function on original inputs as T.M,, x. y) and on adversarial examples as [,,,,,,,,.. x, y). The construction of adversarial ex- amples, e.g., the use of tueetree attack to generate samples, is represented by which transforms x into sample while keeping y unchanged. In the procedure of adversarial training, our goal is to find model parameters that minimize the sum of losses on the original inputs and the structured adversarial examples. This objective can be repre- sented as follows:
3.3 Adversarial Training
Following the algorithms proposed in section 3.1, we now introduce adversarial samples during the

---

Tasks
Clone
Defect
Code Translation
min(I[M, ( (M M
(1)
Language
Java
Java C#
Metrics
F1
Acc
BLEU
EM
The sum of these two losses signifies the total loss of the model under both normal and adver- sarial conditions, aiming to enhance the model's robustness against adversarial attacks. To enhance model robustness more effectively, we shuffle the generated adversarial samples randomly and then proceed with training, preventing them from form- ing dependencies with the original samples during the training process.
Full Fine-tuning
GruphCodeBERT
95.00
62.88
76.61
59.10
PLBART
93.60
63. 63.16
80.69
64.80
CodeT5
95.00
65.78
81.95
66.45
UniXcoder
91.36
62.34
76.59
63.45
Reconsiruction Attack: DFS
GraphCodeBERT
91.61
60.29
9.33
6.25
PLBART
93.32
59.37
3.36
0.35
CodeTS
91.66
56.88
8.70
0.75
UniXcoder
82.10
58.71
25.47
24.95
4 Experiments
Reconstruction Atacck: BFS
4.1 Experimental Setup
GraphCodeBERT
91.27
59.48
15.83
15.40
PLBART
94.12
59.41
1.76
0.10
Tasks and Datasets We conduct our experiments on four tasks related to code representation learn- ing, as part of the CodeXGLUE benchmark (Lu et al., 2021). In the realm of code generation, our first trial is on code summarization (Alon et al.. 2019), process aiming to generate natural lan- guage comments for given code snippet. The second one within code generation code transla- tion (Nguyen al., 2015), which involves translat- ing a code smippet from one programming language to another. For code understanding, we delve into Clone detection (Svajlenko et al., 2014; Mou et al., 2016), which quantifies the similarity between dif- ferent code snippets, and defect detection (Zhou et al., 2019), task focused predicting the pres- ence of vulnerabilities in the source code, with the potential to pose risks software systems.
CodeT5
92.37
57.39
11.94
12.95
UniXcoder
88.50
59.37
23.84
23.75
Subtree Attack
GraphCddeBERT
95.28
62.37
42.54
26.30
PLBART
93.98
62.26
10.53
6.85
CodeTS UniXcoder
95.29
62.77
47.69
31.85
89.75
60.72
37.59
25.90
Signature Attack
GraphCodeBERT
95.26
62.84
73.53
$7.50
PLBART
94.42
63.29
60.05
34.15
CodeTS UniXcoder
95.10
64.34
78.08
61.80
91.32
62.36
72.26
60.75
Table I: Comparative performance of different mod- els on the tasks of clone detection, defect detection, and code translation. Each model's performance is pre- sented under four different structural attacks. For Code Translation, we report the average performance on the tasks of C## Java and Java Cff translations.
Implementation Details In our experiments, utilized four representative code training models: GraphCodcBERT, PLBART, CodeT5, and UniX- coder. We employed Tree-sitter' to parse the source code into ASTs. The training procedure involved using the Adam optimizer (Kingma and Ba, 2015) with a warm-up period of 1,000 steps. Our exper- iments were conducted using PyTorch 1.5.1 on 4 interconnected NVIDIA RTX 3090 GPUs. The hyperparameters are listed in section B.
under full fine-tuning. However, when exposed to various attack strategies, all models experience decrease in performance. Interestingly. PLBART stands out by showing strong robustness, with its performance being particularly resilient under the bfs attack scenario.
From the perspective of attacking strategies, both two reconstruction attacks significantly impact all models in both tasks, indicating the models are hard to understand the sequences with equivalent information in other formats. While under the sub- tree attack, all models' performance in both tasks is negatively impacted but not severely the structural attacks. At last, the Signature attack has variable effects on models. For Clone Detection, GraphCodeBERT manages maintain a high per- formance. Notably, for defect detection, PLBART significantly outperforms other models under this
4.2
Main Results of Attack
Code Understanding As is shown in Table 1, for both clone detection and defect detection tasks, the models exhibit different behaviors under various scenarios. In clone detection, GraphCodeBERT and CodeTT5 demonstrate the highest performance
"githuh.com/tre-ssiteer

---

Languages
Ruby
JavaScript
Python
Java
PHP
Overall
Full Fine-tuning
GraphCodeBERT
11.94
15.05
18.43
19.27
18.72
25.37
18.13
PLBART
14.11
15.56
18.91
19.30
18.45
23.56
18.32
CodeT5
15.24
16.16
19.56
20.01
20.31
26.03
19.55
UniXcoder
14.87
15.65
19.07
19.13
20.31
26.54
19.26
Reconstruction Attack: DFS
GraphCodeBERT
9.35
9.54
8.97
12.43
11.61
12.47
10.73
PI PLBART
7.82
8.81
8.99
7.73
2.88
1.01
6.20
CodeT5
11.73
8.18
8.60
11.18
9.62
4.06
8,90
UniXcoder
8.97
8.30
6.92
11.86
12.02
11.43
9.92
Reconstruction Attack: BFS
GraphCodeBERT
10.06
11.26
11.40
14.23
11.46
12.49
11.82
PLBART
11.03
11.37
12.53
8.70
3.87
1.06
8.09
CodeTS
11.73
10.55
12.92
11.64
10.23
4.07
10.19
UniXcoder
9.97
11.15
12.77
13.55
11.47
11.93
Subtree Attack
GruphCodeBERT
12.09
14.64
18.20
18.03
15.76
24.81
17.26
PLBART
13.67
15.80
18.59
18.23
20.17
16.06
CodeT5
14.93
15.94
19.28
18.86
17.22
25.90
18.69
UniXeoder
14.45
15.43
19.12
18.59
16.45
25.31
18.23
Signature Attack
GruphCodeBERT
9.89
10.61
12.14
15.27
18.72
14.70
13.56
PLBART 10.77
11.25
12.24
15.43
19.17
14.26
13.85
CodeT5
12.13
11.91
13.44
15.84
20.34
15.36
14,84
UniXcoder 10.24
9.70
11.50
14.73
20.19
13.10
13.24
Table 2: Comparative analysis of code summarization performance across various attack strategies. Four representa- tive CodePTMs are evaluated over six programming languages: The performance variation underscores the diverse strengths and weaknesses of these models in the face of different adversarial strategies.
type of attack, achieving an accuracy of 94.42.
ness. Similarly, for the signature attack, CodeT5 maintains stable performance that holds the high- est scores. These results suggest that CodeT5 may have particular resistance to these types attacks in the context of code translation, likely due to its pre-training with dataflow information.
Code Generation In the task code translation for Java + C#,, CodeT5 performs best under nor- mal fine-tuning scenarios. While under different at- tack strategies, the performance of all models drops drastically, with UniXcoder often presents the high- est performance, especially under both BFS and DFS attacks. This suggests UniXcoder relatively more robust against these types of structural attacks for the code translation task.
In specific cases, it can be observed that the EM metric in the code translation task drops to near zero. Through case studies, we find that this occurs when the model confronted with a perturbed sequence, its output can be an empty string.
Structural attacks of DFS and BFS cause dras- tic decline in performance for all models. Despite this, UniXcoder exhibits relative resilience, manag- ing to maintain the highest performance among all models under these attack scenarios. This implic- itly suggests that the training procedure of UniX- coder, which models the AST directly is conducive to model robustness. For the subtree and signature attacks, all models see decrease in performance, but not drastic under the aforementioned DF- S/BFS attacks. Nevertheless, CodeT5 consistently outperforms other models under both these attack types. Under the subtree attack, CodeT5 achieves the highest performance, indicating strong robust-
The results of different attack strategies are given in Table 2. Across all programming languages, CodeT5 still consistently outperforms other mod- els in terms of BLEU scores, suggesting its steady performance under various scenarios. Interestingly, the models appear to have difficulties summarizing Ruby code compared to others, which might be attributed to the modest dataset size for this lan- guage. On the other hand, summarizing PHP codes is clear to be task in which all models excel under all kinds of perturbations, likely due to the larger volume of available data, offering models richer context for capturing the semantics.
Considering the viewpoint of attacking strate-

---

gies, traversal attacks, namely BFS and DF'S, in- fliet significant damage to the models' performance, with BFS attacks typically causing a more profound impact than DFS. This could be ascribed to the fact that the sequences obtained through DFS have an expression closer to the actual execution order of the code, which aligns more closely with the se- mantics of the code. Notwithstandinng the models exhibit increased robustness against subtree and signature attacks, maintaining higher performance under these conditions.
Tasks
Clone
Defect
Code Translation
Language
Java
Java C#
Metrics
F1
Acc
BLEU
EM
Full Fine-tuning
GruphCodeBERT
95.00
62.88
76.61
59.10
PLBART
93.60
63. 63.16
80.69
64.80
CodeT5 UniXcoder
95.00
65.78
81.95
66.45
91.36
62.34
76.59
63.45
Adversarial Training: Reconstruction Attack (DFS)
GraphCodeBERT
93.99
57.47
35.31
28.90
PLBART
93.28
59.33
27.73
29.70
CodeTS
94.25
54.80
46.94
38.10
UniXcoder
65.28
58.21
46.21
37.20
4.3 Main Results of Adversarial Training
Adversorial Training: Reconstruction Attack (BFS)
The results of adversarial training are demonstrated in Table 3 and Table 4. For code understanding tasks, it is clear that significant robustness enhance- ment can be observed for the tasks of clone detec- tion and defect detection. The post-training perfor- mance displays considerable resilience and recov- ery after structural attacks across all CodePTMs. CodeT5, GraphCodeBERT. and PLBART notably improved their performance in both tasks, with CodeT5 generally in the leading position. Although UniXcoder trailed behind in terms of performance, it still exhibited some improvement post-training.
GraphCodeBERT
94.07
60.61
24.76
13.45
PLBART
94.82
62.19
26.25
18.55
CodeT5 UniXcoder
95.01
60.51
34.94
20.50
84.88
61.35
37.16
33.55
Adversarial Training: Subtree Artack
GraphCodeBERT
94.63
62.99
56.52
32.60
PLBART
94.08
61.68
55.34
30.90
CodeTS UniXcoder
95.23
63.07
66.07
39.45
88.03
61.82
59.33
32.25
Adversarial Training: Signature Attack
GraphCodeBERT
94.38
62.63
78.10
60.50
PLBART
94.71
63.32
81.21
63.75
CodeTS UniXcoder
94.51
63.55
82.12
66.2
For the cases of enhancing the robustness of models performing the code translation task, all the models demonstrate substantial improvement after the adversarial training. The performance rebound especially sigmificant in the signature at- tack scenario where models like CodeT5 reach near fine-tuning results when being exposed to adver- sarial examples. Moreover, CodePTMs no longer churn out empty strings when faced with perturbed sequences, preventing the previous catastrophic performance decline.
90.21
62.52
76.63
63.35
Table 3: Results of adversarial training clone detec- tion, defect detection, and code translation task.
level of improvement, however, varies depending the model and the specific task. Despite these variations, the trend of enhanced performance post- training remains consistent across all models and tasks, highlighting the value of our method in the realm of programming language models.
4.4 Analysis
Finally, we can also observe notable improve- ments after comparing Table 2 and Table 4, show- casing the potential efficacy of adversarial train- ing in enhancing model robustness for the code summarization task. All four CodePTMs exhibit enhancement in robustness, and it is noteworthy that the improvements against the dfs and bfs at- tacks are significant. These two structural attacks can lead to more severe disruptions to the models, causing larger drops in performance. Therefore, when adversarial training is applied, the resulting improvements can appear more noticeable.
Transferability Adversarial examples con- structed through exploiting code structures can effectively enhance the robustness of the model. However, considering that the model may face a variety of adversarial examples concurrently, here we examine generalization capability. As is demonstrated in Table 5, we evaluate the model trained on adversarial examples constructed via BFS reconstruction on samples reconstructed by the DFS, and vice versa.
Learning Curve To validate the necessity of us- ing adversarial examples during the training pro- cess, this part, we set different proportions adversarial training data to observe how the model
In a nutshell, adversarial training serves as an effective approuch for strengthening model robust- ness and recovery from adversarial attacks. The

---

Languages
Ruby
JavaScript
Python
Java
PHP
Overall
Full Fine-tuning
GraphCodeBERT
11.94
15.05
18.43
19.27
18.72
25.37
18.13
PLBART
14.11
15.56
18.91
19.30
18.45
23.56
18.32
CodeT5
15.24
16.16
19.56
20.01
20.31
26.03
19.55
UniXcoder
14.87
15.65
19.07
19.13
20.31
26.54
19.26
Adversarial Training:
Reconstruction Attack (DFS)
GraphCodeBERT
11.54
12.98
14.91
17.18
15.78
22.28
15.78
PI PLBART
12.21
14.06
15,38
17.01
14.72
15.99
14.90
CodeT5
14.93
15.59
18.13
18.01
17.32
23.31
17.88
UniXcoder
13.51
14.63
16.69
18.03
16.65
22.78
17.05
Adversarial Training:
Reconstruction Attack (BFS)
GREphCodeBERT
10.37
10.94
12.78
14.79
14.66
19.57
13.85
PLBART
9.42
12.41
14.48
13.46
13.07
15.09
12.99
CodeTS
12.90
13.87
15.62
15.42
15.79
20.45
15.68
UniXcoder
11.34
13.33
14.91
15.46
19.53
14.02
Adversarial Training: Subtree Antack
GruphCodeBERT
11.77
15.23
17.81
18.02
24.59
17.28
PLBART
13.16
15.95
18.1
18.06
14.91
22.56
17.12
CodeT5
15.17
16.59
19.02
18.51
17.33
25.36
18.66
UniXeoder
14.46
15.14
18.59
18.40
16.95
25.20
18.12
Adversarial Training: Signature Attack
GruphCodeBERT
11.38
14.54
15.76
17.68
18.67
21.68
16.62
PLBART
11.68
14.00
15.68
17.66
18.66
20.38
16.34
CodeT5
14.34
15.79
17.08
18.17
20.44
22.16
18.00
UniXcoder
13.23
12.66
15.66
15.27
20.30
21.17
16.38
Table 4: Results of adversarial training on code summarization task.
Tasks
Clone
Defect
Translation
Summarization
with the increase in the number of adversarial exam- ples, the robustness can be significantly improved for both generative and understanding tasks. This further validates the rationality of approach constructing samples based on code structure.
Metrics
F1
Acc
BLEU
BLEU
BFS
DFS
CodeT5
93.45
61.02
67.55
17.94
UniXcoder
80,99
61.31
61.07
16.60
DFS BFS
CodeT5
94.56
61.02
41.64
Conclusion
UniXeoder
88.86
61.72
44.27
16.35
In this paper, we propose multiple novel attack methods targeting source code from the perspec- tive of code structure. By leveraging the AST of the code, we not only consider constructing adversarial samples that are imperceptible to humans but also create perturbed sequences that preserve the same information as the original samples through their traversal. Then we validate its effectiveness on several mainstream CodePTMs, covering both rep- resentative code generation and code understanding tasks. Subsequently, we enhance the model's ro- bustness using adversarial training and investigate the generalizability of performance recovery un- der different scenarios. Based our extensive experiments and observations, provide a com- prehensive analysis of the performance of different CodePTMs across various tasks, considering both the vulnerability to attacks, the potential for perfor- mance recovery, and the impact on input sensitivity.
Table 5: Comparing the generalization capability with adversarial examples generated based on code structure.
learns from the adversarial examples.
Code Summartsatioo
Defect Datection
14.4
16.2
Unikcuder
42.0
1..8
51.
15.4
41.0
13.2
30.3
80
100
40
160
Data Percentaage
Cala Percentage (5g
Figure 4: Learning curves of two CodePTMs with dif- ferent ratios of adversarial examples.
We employ code summarization (Ruby) and de- fect detection tasks. As clearly shown Figure 4,

---

Limitations
tions of code. International Conference on Learn- ing Representations.
Metrics like BLEU (Papineni et al., 2002; Lin and Och, 2004) and CodeBLEU (Ren et al., 2020) predominantly rely on n-gram match- ing and hence may not adequately consider se- mantic similarity. Consequently, when evalu- ating the code sequences generated by models under attack, these metries could potentially underestimate their semantic correctness.
Hubert Baniecki and Przemyslaw Biecek. 2023, Adver- sarial attacks and defenses in explainable artificial intelligence: A survey.
Yonatan Belinkov and Yonatan Bisk. 2018. Synthetie and natural noise both break neural machine transla- tion. In International Conference on Learning Rep- resentations.
Anirban Chakraborty, Manaar Alam, Vishal Dey, Anu- pam Chattopadhyay, and Debdeep Mukhopadhyay, 2018. Adversarial attacks and defences: A survey.
Due to the constraints of resources, we con- fine our backbone models four representa- tive CodePTMs. While other models (Kanade et al., 2020; Ding et al., 2022) might exhibit slight variance, we hold the view that our cur- rent experiments sufficiently encapsulate the most representative scenarios.
Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde, Jared Kaplan, Harri Edwards, Yura Burda, Nicholas Joseph, Greg Brockman, et al. 2021. Evaluating large language models trained on code. arXiv preprint arXiv:2107.033:
Nuo Chen, Qiushi Sun, Renyu Zhu, Xiang Li, Xucsong Lu, and Ming Gao. 2022. CAT CAT-probing: A metric- based approach interpret how pre-trained mod- els for programming language attend code structure. In Findings of the Association for Computational Linguistics: EMNLP 2022, pages 4000-40008 Abu Dhabi, United Arab Emirates. Association for Com- putational Linguistics.
Ethics Statement
The models and data we utilize are all publicly available; our method will not introduce additional model bias and does not involve misuse of code and natural language comments. By designing var- ious attack methods based on code structure, we quantitatively tested the robustness of CodePTMs. Furthermore, we utilize adversarial training to re- cover the performance of perturbed models and also investigated the correlation between their per- formance and the number of adversarial samples. We hold the view that these contributions will ben- efit the NLP research community.
Jacob Devlin, Ming-Wei Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. BERT: Pre-trant Pre-training of deep bidirectional transformers for language under- standing. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Tech- nologies, Volume (Long and Short Papers), pages 4171-48 1-786, Minneapolis, Minnesota. Association for Computational Linguistics.
A Acknowledgement
Yangruibo Ding, Luca Buratti, Saurabh Pujar, Alessan- dro Morari, Baishakhi Ray, and Saikat Chakraborty. 2022. Towards learning simillaity of source code from program contrasts. In Proceedings of the 60th Annual Meeting of the Association for Compu- tational Linguistics (Volume 1: Long Papers), pages 1300-6312 Dublin, Ireland. Association for Compu- tational Linguistics.
This work has been supported by the National Natural Science Foundation of China under Grant No.U191 1203, and the National Natural Science Foundation of China under Grant 20.72277 And the authors would like to thank all the anony- mous reviewers for their constructive and insightful comments on this paper.
Li Dong, Nan Yang, Wenhui Wang, Furu Wei, Xi- aodong Liu, Yu Wang, Jianfeng Gao, Ming Zhou, and Elsiao-Wuer Hon. 2019. Unified language model pre-training for natural language understanding and generation. In Advances in Neural Information Pro- cessing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, December 8-14, 2019, Vancouver, BC, Canada, pages 13042-13054.
References
Wasi Ahmad. Saikat Chakraborty, Baishakhi Ray, and Kai-Wei Chang. 2021. Unified pre-training for pro- gram understanding and generation. In Proceedings of the 2021 Conference of the North American Chap- ter of the Association for Computational Linguistics: Human Language Technologies, pages 2655-2668, Online. Association for Computational Linguistics.
Zhangyin Feng. Daya Guo, Duyu Tang, Nan Duan. Xi- aocheng Feng, Ming Gong, Linjun Shou, Bing Qin, Ting Liu, Daxin Jiang, and Ming Zhou. 2020. Code- BERT: pre-trained model for programming and natural languages. In Findings of the Association
Uri Alon, Omer Levy, and Eran Yahav. 2019. code2seq: Generating sequences from structured representa-

---

for Computational Linguistics: EMNLP 2020. pages 1336-1547,0 Online. Association for Computational Linguisties.
Dongyeop Kang, Tushar Khot, Ashish Sabharwal, and Eduard Hovy. 2018. AdvEntuRe: Adversarial train- ing for textual entailment with knowledge-gun amples. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Vol- ume I: Long Pupers), pages 2418-281 18-2428, Melhourne, Australia. Association for Computational I Linguistics.
ex-
Tan Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and harnessing adver- sarial examples.
Daya Guo, Shuai Lu, Nan Duan, Yanlin Wang, Ming Zhou, and Jian Yin. 2022. UniXcoder: Unified cross- modal pre-training for code representation. In Pro- ceedings of the 60th Annual Meeting of the Associa- tion for Computational Linguistics (Volume 1: Long Papers), pages 721 1212-7225, Dublin, Ireland. Associa- tion for Computational Linguisties.
Diederik P. Kingma and Jimmy Ba. 2015. Adam: A method for stochastic optimization. In 3rd Inter- national Conference on Learning Representations ICLR 2015, San Diego, CA. USA, May 7-9, 2015, Conference Track Proceedings.
Mike Lewis, Yinhan Liu, Naman Goyal, Marjan Ghazvininejad, Abdelrahman Mohamed, Omer Levy. Veselin Stoyanov, and Luke Zettlemoyer. 2020. BART: Denoising sequence-to-see to-seueenc pre-training for natural language generation, translation, and com- prehension. In Proceedings of the 58th Anmual Meet- ing of the Association for Compulational Linguistics, pages 787 1-780, Online, Association for Computa- tional L Linguistics.
Daya Guo, Shuo Ren, Shuai Lu, Zhangyin Feng. Duyu Tang, Shujie LIU, Long Zhou, Nan Duan, Alexey Svyatkovskiy, Shengyu Fu, Michele Tufano, Shao Kun Deng. Colin Clement, Dawn Drain, Neel Sundaresan, Jian Yin, Daxin Jiang. and Ming Zhou. 2021. GraphCodeBERT: Pre-training code represen- tations with data flow. In International Conference on Learning Representations.
Linyang Li, Ruotian Ma, Qipeng Guo, Xiangyang Xue, and Xipeng Qiu. 2020. BERT-ATTACK: Adversar- ial attack against BERT using BERT. In Proceed- ings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 6193-6202, Online. Association for Computational Linguistics.
Hamel Husain, Ho-Hsiang Wu, Tiferet Gazit, Miltiadis Allamanis, and Mare Brockschmidt. 2019. Code- searchnet challenge: Evaluating the state of semantic code search. arXiv preprint arXiv: 100iv::99900000 999909936.
Srinivasan Iyer, Ioannis Konstas, Alvin Cheung, and Luke Zettlemoyer. 2018. Mapping language to code in programmatic context. In Proceedings of the 2018 Conference on Empirical Methods in Natural Lan- guage Processing, pages 1643-1652, Brussels, Bel- gium. Association for Computational Linguistics.
Yujia Li, David Choi, Junyoung Chung, Nate Kush- man, Julian Schrittwieser, Rémi Leblond, Tom Ec- cles, James Keeling, Felix Gimeno, Agustin Dal Lago, Thomas Hubert, Peter Choy, Cyprien de Mas- son d' Autume, Igor Babuschkin, Xinyun Chen, Po- Sen Huang, Johannes Welbl, Sven Gowal, Alexey Cherepanov, James Molloy, Daniel Mankowitz, Esme Sutherland Robson, Pushmeet Kohli, Nando de Freitas, Koray Kavukcuoglu, and Oriol Vinyals. 2022. Competition level code generation with alpha- code. Science, 378(6624) 1092-00010000000 1097.
Mohit lyyer. John Wieting, Kevin Gimpel, and Luke Zettlemoyer. 2018. Adversarial example generation with syntactically controlled paraphrase networks. In Proceedings of the 2018 Conference of the North American Chapter of the Association for Computa- tional Linguistics: Human Language Technologies, Volume 1 (Long Papers), pages 1875-1885, New Or- leans, Louisiana. Association for Computational Lin- guistics.
Chin- Yew Lin and Franz Josef Och. 2004. ORANGE: a method for evaluating automatic evaluation metrics for machine translation. In COLING, pages 501-507.
Akshita Jha and Chandan K Reddy. 2023. Codeat- tack: Code-based adversarial attacks for pre-trained programming language models. Proceedings of the AAAI Conference Artificial Intelligence.
Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Man- dar Joshi, Danqi Chen, Omer Levy. Mike Lewis, Luke Zettlemoyer. and Veselin Stoyanov. 2019. RoBERTa: A robustly optimized BERT pretraining approach. arXiv preprint arXiv:1907. 1692.
Robin Jia and Percy Liang. 2017. Adversarial exam- ples for evaluating reading comprehension systems. In Proceedings of the 2017 Conference on Empiri- cal Methods in Natural Language Processing, pages 2021-2031. Copenhagen, Denmark. Association for Computational Linguistics.
Shuai Lu, Daya Guo, Shuo Ren, Junjie Huang, Alexey Svyatkovskiy, Ambrosio Blanco, Colin B. Clement, Dawn Drain, Daxin Jiang, Duyu Tang, Ge Li, Li- dong Zhou, Linjun Shou, Long Zhou, Michele Tu- fano, Ming Gong, Ming Zhou, Nan Duan, Neel Sun- daresan, Shao Kun Deng, Shengyu Fu, and Shujie Liu. 2021. Codexglue: A machine learning bench- mark dataset for code understanding and generation. CoRR, abs/2102.04664.
Aditya Kanade, Petros Maniatis, Gogul Balakrishnan, and Kensen Shi. 2020. Learning and evaluating con- textual embedding of source code. In Proceedings of the 37th International Conference on Machine Learn- ing. volume 119 Proceedings of Machine Learning Research, pages 51 10-5121. PMLRR
Lili Mou, Ge Li, Lu Zhang, Tao Wang, and Zhi Jin. 2016. Convolutional neural networks over tree structures

---

for programming language processing. In Proceed- ings of the Thirtieth AAAI Conference on Artificial Intelligence, pages 1287-1293.
Xuezhi Wang, Haohan Wang, and Diyi Yang. 2022. Measure and improve robustness in NLP models: A survey. In Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguisties: Human Language Tech- nologies, pages 4569-4586, Seattle, United States. Association for Computational Linguisties.
Anh Tuan Nguyen, Tung Thanh Nguyen, and Tien N Nguyen. 2015. wwide-and-conquer approach for
multi-phase statistical migration for source code (t). In ICASE, pages 585-5 596. IEEE.
Yue Wang, Weishi Wang, Shafiq Joty, and Steven C.H. Hoi. 2021. CodeTT: Identifier-aware unified pre- trained encoder- models for code understand- ing and generation. In Proceedings of the 2021 Conference on Empirical Methods in Natural Lan- guage Processing. pages 8696 8708, Online and Punta Cana, Dominican Republic. Association for Computational Linguistics.
Kishore Papineni, Salim Roukos, Todd Ward, and Wei- Jing Zhu. 2002. Bleu: method for automatic evalu- ation of machine translation. In Proceedings of the 40th Annual Meeting of the Association for Compu- national Linguistics, pages 31 1-3118, Philadelphia, Pennsylvania, USA. Association for Computational Linguistics.
Xipeng Qiu, TianXiang Sun. Yige Xu, Yunfan Shao, Ning Dai, and Xuanjing Huang. 2020. Pre-trained models for natural language processing: sur- vey. SCIENCE CHINA Technological Sciences, 63110))1872-1897
Frank F. Xu, Uri Alon, Graham Neubig, and Vincent Jo- sua Hellendoorn. 2022. A systematic evaluation of large language models of code. In Proceedings the 6th ACM SIGPLAN International Symposium on Ma- chine Programming, MAPS 2022. page 1-10, New York, NY, USA. Association for Computing Machin- ery.
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. 2019. Language models are unsupervised multitask learners. OpenAl blog.
Yichen Xu and Yanqiao Zhu, 2022. survey on pre- trained language models for neural code intelligence.
Colin Raffel, Noam Shazeer, Adam Roberts, Kather- ine Lee. Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J. Liu. 2020. Exploring the limits of transfer learning with unified text-to-text trasffrmer. Journal of Machine Learning Research, 21(140):1-67.
Zhou Yang. Jieke Shi, Junda He, and David Lo. 2022. Natural attack for pre-trained models of code. In Proceedings of the 44th International Conference on Software Engineering, ICSE '22, page 1482-1493, New York, NY, USA. Association for Computing Machinery.
Shuo Ren, Daya Guo, Shuai Lu, Long Zhou, Shujie Liu, Duyu Tang. Ming Zhou, Ambrosio Blanco, and Shuai Ma. 2020. Codebleu: a method for auto- matic evaluation of code synthesis. arXiv preprint arXiv:2009. 10297.
Noam Yefet, Uri Alon, and Eran Yahav. 2020. Ad- versarial examples for models of code. Proc. ACM Program. Lang., 4(0OPSLA).
Daoguang Zan, Bei Chen, Fengji Zhang, Dianjie Lu, Bingchao Wu, Bei Guan, Yongji Wang, and Jian- Guang Lou. 2023. Large language models meet n12code: A survey.
Jeffrey Svajlenko, Judith F Islam, Iman Keivanloo, Chanchal K Roy, and Mohammad Mamun Mia. 2014. Towards a big data curated benchmark of inter- inter-project code clones. In 2014 IEEE International Conference on Software Maintenance and Evolution, pages 476- 480. IEBE.
Huangzhao Zhang, Zhuo Li, Ge Li, Lei Ma, Yang Liu, and Zhi Jin. 2020. Generating adversarial exam- ples for holding robustness of source code processing models. Proceedings of the AAAI Conference on Artificial Intelligence, (600)):116-1111
Christian Szegedy, Wojeiech Zaremba. Ilya Sutskever. Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2014. Intriguing properties of neural networks.
Jie Zhang, Wei Ma, Xiaofei Xie, Qiang Hu, and Yang Liu. 2023. Black-box adversarial attack guided by model behavior for programming pre-trained lan- guage models.
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, E ukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. In Advances in Neural Information Pro- cessing Systems, volume 30, pages 5998-6008. Cur- ran Associates, Inc.
Yaqin Zhou, Shangqing Liu, Jingkai Siow, Xiaoning Du, and Yang Liu. 2019. Devign: Effective vulnerability identification by learning comprehensive program semantics via graph neural networks. In Advances in Neural Information Processing Systems, volume 32. Curran Associates, Inc
Yao Wan, Wei Zhao, Hongyu Zhang, Yulei Sui, Guan- dong Xu, and Hai Jin. 2022. What do they capture? a structural analysis of pre-trained language models for source code. In Proceedings of the 44th Inter- national Conference on Sofware Engineering, page 2377-2388.
Yi Zhou, Xiaoqing Zheng, Cho-Jui Hsieh, Kai- Kei Chang, and Xuanjing Huang. 2021. Defense against synonym substitution-bass based adversarial attacks via Dirichlet neighborhood ensemble. In Proceedings

---

of the 59th Annual Meeting the Association for Computational Linguistics and the 1ith International Joint Conference Natural Language Processing (Volume I: Long Papers), pages 5482-5492, Online. Association for Computational Linguistics.
Hyperparameter
value
Batch Size
8,16.32
Learning Rate
[8e-6, 2e-5, 5e-5]
Source Length
[130, 240, 256, 320, 512) (3. 120, 150, 240, 256. 512)
Max Target Length
Epoch
(2. 30, 120]
A Task Overview and Dataset Statisties
Table 9: Hyperparameters for CodePTM fine-tuning
A.1 Defect Detection& & Clone Detection
Tasks
Defect
Code Translation
Language
Java
C
Java C#
CA Java
Dataset
Language
Training
Dev
Testing
Metries
F1
Acc
BLEU
EM
BLEU
EM
BigCloneBench
Java
900K
416K
416K
Fall Fine-tuming
Devign
21K
2.7K
2.7K
GrppCodeBERT
95.00
62.88
80.58
72.64
58.80
PLBART
93.60
63.16
83.02
64.60
78.35
65.00
Table 6: BigCloneBench (Svajlenko et al., 2014) and Devign (Zhou et al., 2019) datasets statistics for Clone detection and Defect Detection tasks.
CodeTS
UniXeoder
91.36
62.34
78.95
63.30
74.22
63.60
Reconstraction Aflock: DFS
GrapCCodeBERT
PLBART
93.32
59.37
6.52
0.70
0.20
0.00
CodeTS
91.66
56.88
15.38
0.60
2.02
0.90
UniXeodker
82.10
58.71
32.32
24.40
18.62
25.50
A.2
Code Generation Translation
Reconstruction
GraphCodeBERT
91.27
59.48
24.39
8.80
7.27
22.00
PLBART
94.12
59.41
3.43
0.20
0.09
0.00
Dataset
Language
Training
Dev
Testing
CodeT5
92.37
$7.39
17.97
14.90
5.91
11.00
UniXeoder
22.40
CodeTrans
Java C#
10,300
500
1,000
Subtree Attack
GraphC MdeBERT
95.28
62.37
50.13
24.90
34.95
27.70
Table 7: CONCODE (Iyer et al., 2018) and Code- Trans (Nguyen et al., 2015) datasets statistics for code generation and code translation tasks.
Code
95.29
62.77
63.20
33.20
32.17
30.50
UniXcodkr
21.70
Signature Attock
GraphColeBERT
95.26
62.84
76.10
56.80
70.96
$8.20
PLBAKT
34.40
CodeTS
64.34
95.10
80.92
62.70
75.23
60.90
A.3 Code Summarization
UniXeodker 91.32
62.36
76.92
60.40
67.59
61.10
Table 10: Comparative performance of different models on tasks of clone detection, defect detection, code translation. Each model's performance is presented under four different structural attacks.
Language
Training
Dev
Testing
Go
167,288
7,325
8,122
Java
164,923
5,183
10,955
JavaScript
58,025
3,885
3,291
PHP
241,241
12,982
14,014
D Detailed Algorithm for Reconstruction Attack
Python 251,820
13,914
14,918
Ruby 24,927
1,400
1,261
Due to the space constraints, we put simplified version of the reconstruction attack in section 3.2. Algorithm 3 is more detailed version.
Table 8: CodeSearchNet (Husain et al., 2019) data statis- ties for the code summarization task.
E
Case Studies
B Hyperparameters for Fine-tuning
To better understand the effect of adversarial sam- ples generated through exploiting code structure specific tasks, we present a series of case studies in Table 12, Table 13, and Table 14 for subtree attack, signature attack. and reconstruction attack respectively.
The hyperparameters for tuning CodePTMs by both gold data and adversarial examples are listed in Table 9.
C Additional Experimental Results
We include additional experimental results in Ta-
ble 10 and Table I1.

---

Algorithm 3 Traverse Tree
Input:
Code snippet c, Traversal mode m
Output:
Modified code snippet c
Tasks
Clome
Code Trunslation
1: procedure TRAVERSAL m)
Langunge
Java
Java
Ch
C# Java
Metries
F1
Acc
BLEU
EM
BLEU
EM
2:
node sipee_tppeePPe list()
T GetAST(())
Full Fine-tuning
PLBAKT'
93.60
63.16
83.02
64.60
78.35
queue list() awt.aapeendete.rrro while queue do if m "DFS" then current_node + queue.pop( else if m "BFS" then curremi_node queue.pop(U) end if node seadee_tpeaappend(_. carpppeeddcrrreetnodddeeeo
CodeTS
95.00
65.78
84.03
65.90
79.87
66,90
GrapbCodeBERT
95.00
UniXcoder
91.36
62.34
78.95
63.30
74.22
63.60
Adversarial Training: Reconstruction Atlack (DFS)
7:
8:
CodeT5
94.25
$4,80
54.88
42,00
39.00
34.20
GraphCodeERRT
93.99
57.47
43.20
30.6
27.41
27.20
9:
UniXcoder
65.28
58.21
55.37
41.00
37.05
33,40
10:
Training: Reconstruction
(RFS)
PLBART
94.82
62.19
42.89
34,80
9.60
2,30
11:
CodeTS
95.01
60.51
49.04
36.90
20.84
4.10
12:
GrophCodeBERT
94.07
60.61
39.49
25.90
10.02
1,00
UniXcoder
46.25
37.80
13:
if m "DFS" then
Adversorial Training: Subrree Atrack
14:
for child E current noddechildren[[:-I1 do
PLBART
94.08
61.68
55.83
30.8
54.84
31,00
GraphCodeBERT
94.63
62.99
61.17
31.20
$1.87
34,00
15:
arreueeapeendcchlll
UniXcoder
88.03
63.36
34.30
16:
end for else if m "BFS" then for child E surrent_node.chiiee
Adversorial Training: Signature Atlack
17:
PLBART Code 15
94.71
63.32
82.34
61.00
80.07
66.50
94.51
02.55
84.77
66.7
79.46
65.70
18:
GraphCodeBERT
94.38
62.63
80.61
60.20
75.58
60.80
do
UniXcnder 90.21
62.52
78.78
63.60
74.48
63.10
19:
queue.append(chhll.
Table 11: Comparative performance of adversarial train- ing of different models on the tasks clone detection, defect detection, and code translation.
20:
end for end if
21:
22:
end while
23: return queue
24:
end procedure

---

Original
After Attack
public entteeetttttt
incliipkkeennteeuuuuttiiictnnooo ( String
String functionName,
FunctionName
NotImplementee wwweeeeeeeeeeeeiieoeoeoo cause) {
Bec_mp.eeenteeexxeptiioo cause {
2 super (functionName cause);
super ( FunctionName cause )
3
this. FunctionName FunctionName;
functionName
Code 1: Original input.
Code 2: Input under subtree attack.
FunctionException (string functionName, Nott_mplementeeExxxppti cause) (afennffooonanne cause)
NotImpl inni (Stiing
functionName
NotImpl emen tedException cause )
2 super ( FunctionNane cause )
-FunctionName functionName;
1
FunctionName.
4
Code 4: Generated codes based on input under sub- tree attack.
Code 3: Generated codes based on original input.
Table 12: Case studies of code translation under subtree attack.
Original
After Attack
def [tllyymotion_dowllloddde output_dire
def (url, output_dir='.' merge=True, info_only=False, **kwargs):
'.', merge=True, info_only=False, x* kwargs):
html (rrecconnettreeuullt.uu (url))
2 html (rnteentrrebllttturl
info json. (machh
r'
3 info (matchh (html,
qualities": ((.+))))) "!))
qualities": ({.+?)),
title matchl (html, r' r'"video_title" ([="s""[[""]++"
4 title = match1 (html, r'"'ideo_ title"\
match1 (html, r'"title\ss* \s*""(=****""""""""""""""">""""" title unicodizettitle)
"<: or match1 (html, ""=ttl"""s::ts""(("""""
title = unicodize(title)
for quality 1080''' '720', '480', 388' '240 '144', 'auto'
for quality in ['1080', '720', '480', 380' 240', '14', 'auto']: try:
try:
real
real_url -url info[quality][111" url"]
real_ur1 url info[quality][11 ur1"]
if real_url:
10
if real_url:
break
11
break
except KeyError: pass
12
except KeyError: pass
15
14
mime, size ur]_info(real__r)) print_info(site_inff title, mime, size)
15
mime, ext, size = ur]_info(real_ur] ciint_info(site_info title, mime, size)
16
17
18 if not info_anly:
info_only
download [ur]] title,
download download.urls(rreal.... wrls([reeal_uI]] title, ext, size, output_dir= output_dir, merge=merge)
ext, size, output_dir= output_dir, merge=merge)
Code 6: Input under signature attack.
Code 5: Original input.
# Download a website
Summarize a URL
Code 7: The summarization for original code.
Code 8: The summarization for the attacked code.
Table 13: Case studies of code summarization Python under signature attack.

---

Original
After Attack
end
def bigight.eettessiieetttesiioooo unless extension. is_a?(String)
wix wix_light.extension def extension (
2
extension << wix_Lligttextenssinn end
3 raise InvalidValue. new(:
wix_light_extensiiee "be_an, String")
unless is_a? extension raise) String
4 end
new InvalidValue
5 mii__light_extension extension
wix_Lighttextensionn ( "_be_an__ String_"
end
Code 9: Original input.
Code 10: Input under reconstruction attack.
f Adds Wix Light Extension
wix_liigt__xtensson
Code 11: The summarization for original code.
Code 12: The summarization for the attacked code.
Table 14: Case studies of code summarization on Ruby under reconstruction attack (BFS).

---

Original Input1
Original Input2
private void download(String address, String localFileName) throws Ur.NeotoounExceptionn, Exception String ext E.FFile.getExennaaee address);
if (ext. (qxateeuals("ssp") {
throw Exception( ""trooo.n..........
baixar_pagina..3 ptt.ppannnn....iippppp tiip...
negado." " address);
File temp File(IocalFiLeNam FllName :.tm""):
(temp.exists() temp. del OutputStream out null; LRLConnection
null;
InputStream in null; try
try
URL url new URL (address; conn :pt)opppooonn))iin(()
conn :.n.getInputttreem)):
catch (fileNotFoundExxeptiinn e2)
private static void copyFile(File sre, File dst) throws I0Exception { FileChannel new FileInputStream src) (rc)).geCChanne)))
{
throw new Ur-NiatFoundException
O:
}
FileChannel out new FiLe@utputStreem(ddt .geChhnnel ();
out new BufferedduutputStream
new (lle@utputStreemm(emm)
byte[] buffer new byte[1024];
in. transferTo(e, in. sizeiz, out);
int numRead;
in. close();
long numWritten 8; while ((numRead in. read((f)))fr))
out. out.close();
!= -1) { out. wut..wittebbuffer o, numRead); numWrritte += numRead;
Code 14: Original input.
} catch (UrINottroudEExcettion exception) {
throw exception;
catch (Exception exception) throw exception;
finally
try {
if (in != null) in.close();
if (out I= null) {
cut.close();
catch (I0Exception ioe) {
}
Code 13: Original input.
Table 15: Case studies of clone detection under reconstruction attack (DFS), where model accurately judge the relation between two code snippets.

---

After Attack
}
{ ioe IdException catch }
close
( null != out if
: ) close
10
() null != in if
{ try
12
finally
13
exception throw
Exception catch }
15
; exception throw
16
) Funddettound ( catch }
17
18
numRead numWrritten
19
) numRead 0 buffer ( write out != ) buffer ( read in numRead ( ( while
50
(
21
numWrritte long
22
numRead int
23
1824 [ byte new = buffer [ byte temp ( FileoutputStream ( BuffereddutputStreem
24
new out
25
} Ur-NottoounEExeetioon new throw () Fil MeleeNoooottee Fondfcctundt catch } )) getInputStream conn = in openConnection url conn address URL new = url URL
36
28
{ try
[ try
null in InputStream null conn URLConnection
null out OutputStream
delete ) ( exists temp ( if
localFileName File new temp File
}
address httpoaaobbaxarr_aagina.. tipooooeed..
EExeeption new throw "_" equals ext if address getExtensao G_File ext String
Un Foundxxception throws localFileName address download void private
Code 15: Input under reconstruction attack (DFS)
Table 16: Case studies of clone detection under reconstruction attack (DFS). The prediction of the model is altered after the attack, generating a wrong prediction for semantic similarity.


Reviews:
[{"review_id": "RFkUkcx036", "reviewer": "Reviewer_H95H", "summary": "", "questions": "Question A:\nWhat are the experimental results of the unstructured method？\n\nQuestion B:\nCan samples obtained through significant changes in sample structure and content still be called adversarial samples?\n\nQuestion C:\nWhy is code summarization classified as a task in the field of code generation?\n\nQuestion D:\nWhat is the composition of the data used for adversarial training?\n\nQuestion E:\nThe adversarial training enhances the robustness of the model when facing corresponding attacks, but will there be any changes in performance when dealing with other attacks?", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks a lot for your insightful comments, and we hope our rebuttal can address your concerns.\n\n> Question A: What are the experimental results of the unstructured method？\n\nThank you for your question and the feedback provided in the \"reason to reject\" section. Our work covers both code generation and code understanding scenarios and proposes four different strategies for sequence-level attack and adversarial training, making it challenging to find a comparable baseline (e.g., previous attacks mainly focus on token-level substitution). Specifically, methods in NLP like BERT-ATTACK[1] don't utilize code structure / syntactic information for attacks, and one recent code-related baseline CodeAttack[2] uses \"a small modification\" to create adversarial samples that also do not match our scenario.\n\n[1] BERT-ATTACK: Adversarial Attack Against BERT Using BERT EMNLP 2020\n\n[2]  CodeAttack: Code-Based Adversarial Attacks for Pre-trained Programming Language Models AAAI 2023\n\n> Question B: Can samples obtained through significant changes in sample structure and content still be called adversarial samples?\n\nYes, we believe so. In terms of reconstruction, the samples we constructed using methods like DFS and BFS retain most of the original structural information of the code. Previous works, as referenced in Line 242-244, have demonstrated that CodePTMs can capture such information.\n\n> Question C: Why is code summarization classified as a task in the field of code generation?\n\nThe code summarization task is sourced from the CodeXGLUE[1] Benchmark, specifically under the Code2NL task. This task involves writing comments for given code snippets, so it is classified into code generation task in [1]. We will clarify this issue in the next version.\n\n[1] CodeXGLUE: A Machine Learning Benchmark Dataset for Code Understanding and Generation\n\n> Question D: What is the composition of the data used for adversarial training?\n\nThank you for your interest in our experimental design. In the specific adversarial training process, we used an equal number of two types of samples, namely the original code and the reconstructed code after our adversarial modifications.\n\n> Question E: The adversarial training enhances the robustness of the model when facing corresponding attacks, but will there be any changes in performance when dealing with other attacks?\n\nThank you for raising the question regarding the strategy of attacks. We have addressed the generalization of different attacks in the analysis section, specifically in Figure 4. We will try to further analyze the changes when dealing with other attacks.\n\n> Responses to Reasons To Reject\n\nThank you for your thorough review and comments. We acknowledge that due to page constraints, certain details were unfortunately omitted, and we sincerely apologize for any confusion caused. With respect to the PLBART conclusion, we regret the oversight, and it pertains to clone detection. The accuracy for clone detection in PLBART is 94.42 (as indicated in the third-to-last row), while the accuracy for defect detection is 63.29. Corrections will be made accordingly in the next revision. \n\nFor other points you've raised, please refer to our earlier responses to address your questions. We will ensure that more comprehensive experimental details are included in our next version to enhance the clarity and quality of the paper. \n\nOnce again, thank you for your valuable feedback and efforts towards improving our manuscript.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "1. The proposed method is intuitive.\n\n2. The experimental results are promising.", "reasons_to_reject": "1.\tLack of comparative experiments with traditional methods.\n\nThe paper conducted comparative experiments and analysis on the proposed structured adversarial attack methods, but did not compare them with other unstructured adversarial attack methods, which cannot effectively reflect the specificity and effectiveness of structured information. \n\n\n2.\tThis work may have soundness issues.\n\n(1)\tAs mentioned in Section 4.1, code summarization is a process aiming to generate natural language comments for a given code snippet. This undertaking necessitates the model to comprehend the input code and generate an appropriate natural language summary. It is important to note that this process does not involve code generation per se, but rather leans towards code comprehension. Nevertheless, the authors classify it within the domain of code generation, which is unreasonable.\n\n(2)\tSome of the conclusions do not match the experimental results provided. The authors claimed that “Notably, for defect detection, PLBART significantly outperforms other models under this type of attack, achieving an accuracy of 94.42.” However, Table 1 shows that the accuracy of the PLBART model in this attack is only 63.29, which is not consistent with the 94.42 mentioned in the paper and does not have an advantage compared to other models.\n\n(3)\tAdversarial samples are usually obtained by adding small perturbations. Can samples obtained through significant changes in sample structure and content still be called adversarial samples? The adversarial samples produced by the Reconstruction Attack and Subtree Attack will significantly modify the source code, leading to numerous conspicuous flaws in the generated code. So, when dealing with tasks such as code summarization and defect detection, is it reasonable to expect the model to return Golden Output?\n\n3.\tImportant details are missing.\nThe authors conducted adversarial training on the models, but many important details of the training were not provided. For example, what is the composition of the data used for adversarial training?\n\n4.\tThe adversarial training enhances the robustness of the model when facing corresponding attacks, but will there be any changes in performance when dealing with other attacks?", "questions_to_authors": "Question A:\nWhat are the experimental results of the unstructured method？\n\nQuestion B:\nCan samples obtained through significant changes in sample structure and content still be called adversarial samples?\n\nQuestion C:\nWhy is code summarization classified as a task in the field of code generation?\n\nQuestion D:\nWhat is the composition of the data used for adversarial training?\n\nQuestion E:\nThe adversarial training enhances the robustness of the model when facing corresponding attacks, but will there be any changes in performance when dealing with other attacks?", "paper_topic_and_main_contributions": "This paper proposes a new attack method to attack the models in field of neural coding intelligence and reveals the vulnerabilities of such models. Specifically, the author proposes several attack methods based on the structured of the code. These methods mainly use the signature of function, abstract syntax trees, and logic structure for input perturbation. By the way, the author shows the performance of purposed methods through experiments. In addition, the author demonstrated the transferability of the proposed method and the necessity of relevant adversarial training through experiments .", "excitement": 4, "reproducibility": 3, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "po0fLYaLj5", "reviewer": "Reviewer_BNiS", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for providing your review, and hope our responses can address your concerns:\n\n> Missing comparison with other baseline models that attack pre-trained models of code.\n\nThank you for raising concerns regarding the baselines. Our work covers both code generation and code understanding scenarios and introduces four different strategies for attacks and adversarial training. Finding similar baselines can be challenging due to this scope. Specifically, methods like BERT-ATTACK[1] don't exploit code structure for attacks, and the attack is conducted under token level, while ours mainly relies on sequence level. Moreover, one recent code-related baseline CodeAttack[2] uses \"a small modification\" to create adversarial samples that also do not match our cases.\n\n[1] BERT-ATTACK: Adversarial Attack Against BERT Using BERT EMNLP 2020\n\n[2] CodeAttack: Code-Based Adversarial Attacks for Pre-trained Programming Language Models AAAI 2023\n\n> Questions in \"Missing References\"\n\nWe interpret the \"compilation rate\" you mentioned as the ratio of two types of samples. In the specific adversarial training process, we used an equal number of samples. For code generation tasks, there will indeed be an impact, as both our attack and the reconstruction method are based on structural information that changes the original form of the code. We appreciate your query and will clarify these details in the next revisions.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "+ The generated adversarial code is imperceptible to humans.\n+ Generate adversarial samples that attack identifier tokens and sub-tree structures.\n+ Extensive experiments on code understanding and code generation tasks.", "reasons_to_reject": "- Missing comparison with other baseline models that attack pre-trained models of code.", "questions_to_authors": "", "paper_topic_and_main_contributions": "The authors propose a set of novel evaluation techniques for attacking pre-trained models of code. They generate adversarial samples that are imperceptible to humans by attacking identifier tokens, sub-trees and use AST structures to generate an adversarial attack.", "excitement": 4, "reproducibility": 3, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {"Missing_References": "Did the authors conduct experiments to check the compilation rate of the adversarial code (both before and after the attack)? And as a result if the compilation rate of the generated code is impacted in case of code generation tasks?\n"}}, {"review_id": "iBZv5nDttW", "reviewer": "Reviewer_xnBH", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": 2, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for reviewing our paper, we hope that our answers can address your concerns.\n\n> R1: The authors state that their work is motivated by a disregard for code structure in existing methods of generating adversarial code attacks. However, the necessity and advantage of considering code structure are not explicitly articulated.\n\nLeveraging code structure to assist downstream task learning is relatively common in the neural code intelligence field. In this paper, we utilize one such form, namely the AST (Abstract Syntax Tree), to construct adversarial code attack samples. Without considering structure, one can only construct samples from a textual perspective. Such samples would merely impact the model's discriminative performance at the textual level.\n\n> R2: In the experiments, there are no comparisons against current approaches, so it remains unclear whether the proposed attacks offer any advantages.\n\nWe chose to compare with full fine-tuning to better explore the performance difference before and after the attacks. This matches better for our case that the attack is conducted at the sequence level. Other methods like BERT-ATTACK[1] don't exploit code structure for attacks, and the attack is conducted under token level, while ours mainly relies on sequence level. Additionally, one code-related baseline CodeAttack[2] uses \"a small modification\" to construct adversarial samples that also do not match our cases, since the rate of \"tokens\" being modified varies too much.\n\n[1] BERT-ATTACK: Adversarial Attack Against BERT Using BERT EMNLP 2020\n\n[2] CodeAttack: Code-Based Adversarial Attacks for Pre-trained Programming Language Models AAAI 2023\n\n> R3: The manuscript lacks clarity and does not have proper references to some figures and appendix\n\nThank you for raising concerns about the quality of the manuscript. Due to space constraints, we had to condense some descriptions and details. In subsequent revisions, we will strive to address these issues and, if necessary, add additional descriptions to the appendices.\n\n> Typos Grammar Style And Presentation Improvements\n\nWe deeply appreciate your meticulous review of our paper. The reconstruction task is specifically designed for the structure of the code, using different traversal methods to measure the model's robustness while retaining most of the code information. Additionally, we thank you for pointing out the oversight regarding Figure 2 and Figure 3 not being referenced in the main text. We will address this in our next revisions.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "- The authors propose several novel attacks that consider the structure of the code\n\n- The authors present an extensive evaluation of the robustness of code models to adversarial attacks, considering various code models and associated downstream tasks.\n", "reasons_to_reject": "- The authors state that their work is motivated by a disregard for code structure in existing methods of generating adversarial code attacks. However, the necessity and advantage of considering code structure is not explicitly articulated. \n\n- In the experiments there are no comparisons against current approaches, so it remains unclear whether the proposed attacks offer any advantages.\n\n- The manuscript lacks clarity and does not have proper references to some figures and appendix", "questions_to_authors": "", "paper_topic_and_main_contributions": "This paper studies code models' resilience to adversarial attacks. The authors propoe a series of new attacks that consider code structure, noting current attacks overlook this aspect. They evaluate these attacks on multiple code models and tasks, demonstrating that adversarial training strengthens model robustness against these attacks.", "excitement": 3, "reproducibility": 4, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {"Typos_Grammar_Style_and_Presentation_Improvements": "- It is not clear what the authors would like to achieve with the reconstruction task\n\n- Figure 2 and Figure 3 are not referenced in the main text\n\n- The material in the appendix lacks referencing in the main body of the text"}}]

Author rebuttal:

Meta-review: The reviewers were enthusiastic about the paper and agreed that the methodology was intuitive and sufficiently novel, and the presentation of the results were clear. The rebuttal phase helps clarify some of the confusion and answer outstanding questions. As one reviewer pointed out, the paper may need additional work to situate it against existing work and choosing appropriate comparators. The authors response indicates that this merits some discussion in the revised version. There is strong interest in this line of work and the excitement on the proposed approaches is high.
Decision: Accept-Findings