Evaluating and Enhancing the Robustness of Code Pre-trained Models through Structure-Aware Adversarial Samples Generation (2023)

Abstract: Code pre-trained models (CodePTMs) have significantly advanced the field of neural code intelligence. Despite their capabilities, these models are susceptible to adversarial attacks that subtly modify the model inputs, resulting in incorrect outputs or predictions. Previous methods of robustness evaluation for CodePTMs primarily stem from a textual perspective, without explicitly taking into account the structure of the code. Furthermore, prior studies fail to encompass a broad enough spectrum of tasks and models. In this paper, we propose a set of novel robustness evaluation methods based on the intrinsic structure of the code. Specifically, we first launch adversarial attacks on crucial identifier tokens and sub-tree structures to explore the impact of imperceptible perturbation. Then, we perform global restructuring of the code using different traversal methods for abstract syntax trees, aiming to explore the model’s sensitivity to input samples with equivalent information. Moreover, for each scenario, we employ adversarial training methods to explore the possibility of restoring the performance of perturbed models. For both code understanding and generation, our proposed method has demonstrated its effectiveness across a wide range of models and tasks, thereby allowing us to make one step forward in our understanding of the inner mechanisms of CodePTMs.

## introduction pre-trained language models have revolutionized the landscape of natural language processing (nlp) @xcite @xcite . while these transformer-based models @xcite have achieved great success in nlp, their counterparts trained on code @xcite have also made remarkable strides in the field of neural code intelligence @xcite @xcite . despite their impressive capabilities, codeptms still retain prevalent weaknesses inherent in language models: they are sensitive to the input sequence and are susceptible to adversarial attacks. the model's vulnerability to variations in input can impair its generalization @xcite . adversarial examples, though imperceptible to humans, can deceive codeptms into generating incorrect predictions or code sequences in downstream tasks (e.g., clone detection, code summarization). unlike similar attacks for images, audio, and natural languages, the structured nature of programming languages introduces distinct and novel challenges. while methods have been proposed by researchers as potential countermeasures against attacks @xcite @xcite @xcite , the construction of adversarial samples remains an ongoing concern. adversarial training often involves exposing the model to adversarial examples during training so that the model learns to defend itself against such examples when it encounters them in the future. however, for codeptms, an approach that incorporates code structure is yet to be substantially established. in representative works on robustness analysis targeting code scenarios, @xcite pioneer an example generation method that balances both natural semantic and operational semantics. recently, @xcite leverage the structure of code to propose code-specific adversarial samples generation, which can be used to evaluate the vulnerabilities of codeptms. while these studies concentrate on generating adversarial code samples, there is an absence of explicit modeling of the structure of code. furthermore, the existing analyses remain inadequate in examining different architectures of codeptm and corresponding downstream tasks, which in turn, hampers the generalizability of the conclusions drawn. in this paper, we propose a comprehensive framework based on the structural information of the code, which integrates sample generation and adversarial training, aiming to conduct a thorough evaluation of the robustness of codeptms. we first conduct an assessment through the perturbation of model inputs. specifically, we propose two strategies: (1) generating adversarial samples that are imperceptible to humans to launch adversarial attacks on the model. (2) leveraging the syntax of the code, namely, the structural information of ast to reconstruct the input sequence into a new one that preserves equivalent information to probe models' sensitivity to input. our contributions can be summarized as follows: ## conclusion in this paper, we propose multiple novel attack methods targeting source code from the perspective of code structure. by leveraging the ast of the code, we not only consider constructing adversarial samples that are imperceptible to humans but also create perturbed sequences that preserve the same information as the original samples through their traversal. then we validate its effectiveness on several mainstream codeptms, covering both representative code generation and code understanding tasks. subsequently, we enhance the model's robustness using adversarial training and investigate the generalizability of performance recovery under different scenarios. based on our extensive experiments and observations, we provide a comprehensive analysis of the performance of different codeptms across various tasks, considering both the vulnerability to attacks, the potential for performance recovery, and the impact on input sensitivity.