Scholarlink

<p>Pre-trained Code Models (PCMs) play a significant role in enabling software engineers to develop Software Vulnerability Prediction (SVP) models. Recent studies have shown that these seemingly robust models can be manipulated using adversarial attacks crafted by semantics-preserving transformations. Prior code-based adversarial attacks are often constrained by either high query costs or reduced code naturalness. To overcome these challenges, this paper proposes a novel Learning-To-Rank-based Transferable Adversarial Attack (LTR-TAA). It uses limited queries to train a ranking model with a cost-sensitive ListMLE loss, selecting optimal semantics-preserving transformations based on code semantics. Additionally, it leverages the open-source large language model Gemma 2 to generate context-aware adversarial examples. Empirical results on two large-scale datasets (Devign and PyTraceBugs) demonstrate that, compared to state-of-the-art adversarial attacks, LTR-TAA achieves more natural and effective transferable adversarial attacks with minimal token-level perturbations across six PCM-based SVP models. Moreover, these adversarial examples can be utilized to adversarially fine-tune SVP models, improving both their robustness and predictive performance.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Learning-to-rank-based transferable adversarial attacks for software vulnerability prediction models

  • 期刊论文

  • 发表日期：

    2026年3月30日

查看全文
  • Xuanye Wang,
  • Lu Lu

摘要

Pre-trained Code Models (PCMs) play a significant role in enabling software engineers to develop Software Vulnerability Prediction (SVP) models. Recent studies have shown that these seemingly robust models can be manipulated using adversarial attacks crafted by semantics-preserving transformations. Prior code-based adversarial attacks are often constrained by either high query costs or reduced code naturalness. To overcome these challenges, this paper proposes a novel Learning-To-Rank-based Transferable Adversarial Attack (LTR-TAA). It uses limited queries to train a ranking model with a cost-sensitive ListMLE loss, selecting optimal semantics-preserving transformations based on code semantics. Additionally, it leverages the open-source large language model Gemma 2 to generate context-aware adversarial examples. Empirical results on two large-scale datasets (Devign and PyTraceBugs) demonstrate that, compared to state-of-the-art adversarial attacks, LTR-TAA achieves more natural and effective transferable adversarial attacks with minimal token-level perturbations across six PCM-based SVP models. Moreover, these adversarial examples can be utilized to adversarially fine-tune SVP models, improving both their robustness and predictive performance.