Source Code is a Graph, Not a Sequence: A Cross-Lingual Perspective on Code Clone Detection (2024)

Abstract: Code clone detection is challenging, as sourcecode can be written in different languages, do-mains, and styles. In this paper, we arguethat source code is inherently a graph, not asequence, and that graph-based methods aremore suitable for code clone detection thansequence-based methods. We compare the per-formance of two state-of-the-art models: Code-BERT (Feng et al., 2020), a sequence-basedmodel, and CodeGraph (Yu et al., 2023), agraph-based model, on two benchmark data-sets: BCB (Svajlenko et al., 2014) and PoolC(PoolC, no date). We show that CodeGraphoutperforms CodeBERT on both data-sets, es-pecially on cross-lingual code clones. To thebest of our knowledge, this is the first work todemonstrate the cross-lingual code clone detec-tion showing superiority on graph-based meth-ods over sequence-based methods

## introduction existing methods for code clone detection can be broadly classified into two categories: sequencebased and graph-based. sequence-based methods rely on textual similarity of the code, such as token sequences. graph-based methods rely on structural similarity of the code, such as abstract syntax tree (asts), or control flow graphs (cfgs) or code property graphs (cpgs). sequence-based methods are fast and scalable, but they may fail to detect clones that have different syntax or structure. graph-based methods are more accurate and robust, but they may be slow and complex, especially for large-scale or cross-language code clone detection. a python source code clone pair is presented in listing @xcite . the two code snippets have the same semantic behavior: they print 'a' or 'a' depending on the case of the input. however, they differ in their syntactic forms. further such examples can be viewed in appendix c. in this paper, we argue that source code is naturally a graph, not a sequence, and that graph-based methods are more suitable for code clone detection than sequence-based methods. we compare the performance of sequence-based and graph-based methods for code clone detection on two benchmark data-sets: bcb @xcite and @xcite . bcb is a data-set of java code snippets where as poolc is a data-set of python code snippets. we use codebert @xcite as a representative sequence-based modelling approach, and codegraph @xcite as a representative graph-based modeling approach. codebert is a bimodal pre-trained model for programming language (pl) and natural language (nl) that learns general-purpose representations that support downstream nl-pl applications. codegraph is a graph-based model for semantic code clone detection based on a siamese graphmatching network that uses attention mechanisms to learn code semantics from dfgs and cpgs. @xmath0. isupper () : print ( "a ") else : print ( "a ") listing 1: python code 1 @xmath1. upper () : print ( "a ") elif @xmath2. lower () : print ( "a ") listing 2: python code 2 we conduct various experiments to evaluate the accuracy, recall, precision, and f1-score of code-bert and codegraph on three experimental setups: (i) in-domain static source code analysis , (ii) cross-lingual generalization and semantic extraction, and (iii) zero-shot source code clone classification. we show that codegraph outperforms codebert across experimental setups and metrics. the main contributions of this paper are as follows: ## methods in this section, for the source code representations, two methods are employed: byte pair tokenization @xcite and code property graphs (cpgs). byte pair tokenization is used to sequence source code into tokens using codebert's bpe tokenizer, while cpgs represent source code as graphs, combining abstract syntax trees (asts) and data flow graphs (dfgs) into a unified graph. treesitter, a lexical parser, generates asts for various languages, and microsoft's dfg generator @xcite adds data flow edges to these asts. the cpgs are then standardized across languages by pruning non-essential nodes and standardizing node type labels. this standardization allows for consistent recognition of code structures across languages, proving advantageous for code clone detection. we use two models for source code clone detection: codebert, a sequence-based model, and codegraph, a graph-based model. codebert is fine-tuned on a binary classification task to determine if a pair of source codes are clones, capturing syntactic and semantic information through pre-training on multiple languages. more details in appendix b.3. codegraph employs a trained word2vec model @xcite to generate token embeddings, maintaining consistency with codebert. both models process code pairs to produce representations used for binary classification, with codegraph utilizing an lstm layer for graphlevel representation analysis. more details in appendix b.4. ## experimental design based on our proposed methodology, we conduct experimentation on the following research questions (rqs): please note, within our scope, "multi-lingual" pertains to experiments conducted across a range of programming languages. "cross-lingual", on the other hand, denotes the concurrent utilization of two programming languages, where the dataset comprises a blend of both languages. this allows the model to process and interpret the mixed language data in tandem. ## future research some possible directions for the future research based on the limitations g.1 are as follows: ## conclusion in this paper, we have shown that graph-based methods are superior to sequence-based methods for source code clone detection. we have used the state-of-the-art models codebert @xcite and codegraph @xcite to conduct various experiments on two benchmark data-sets: bcb @xcite and poolc (poolc, no date). we have demonstrated that graph models can better capture the structural and semantic information of the source code than sequence models in a series of 3 experimental setups, and that they can generalize better across different source code languages and domains. we have also provided efficient and scalable code for generating standard cpg representations of source code, along with the re-implemented code for the sequence and graphbased models. our work has important implications for future research on source code analysis, as it suggests that representing source code as a graph rather than a sequence is a promising direction for enhancing the performance and generalization of static source code analysis models.