Backdoor attack method and system for classification task in code model
Disclosure are a backdoor attack method and system for a classification task in a code model, the method includes: S1. collecting and preprocessing clean samples to obtain importance variable names; S2. classifying the variable names of the clean samples according to label categories to obtain a plurality of trigger sets; and selecting target labels from the clean samples; S3. performing score calculation on the variable names in the trigger sets corresponding to the target labels; replacing one importance variable name with the variable name having a maximum C score in the clean samples to obtain poisoned samples, and repeating the above process until the labels are changed into the target labels; and S4. randomly inserting the triggers in the poisoned samples into the clean samples to form negative samples; and performing an attack by using an attack model obtained based on the negative, poisoned and clean samples.
1 . A backdoor attack method for a classification task in a code model, comprising the following steps:
S1. collecting and preprocessing clean samples comprising a plurality of code segments to obtain an importance variable name;
S2. classifying variable names of the clean samples according to label categories to obtain a plurality of trigger sets; and selecting a target label from the clean samples at the same time;
S3. performing C score calculation on the variable names in the trigger sets corresponding to the target label; replacing the importance variable name with the variable name having a maximum C score in the clean samples, predicting labels of the label categories after replacement based on a model, and deleting the variable name with the maximum C score from the trigger sets; and repeating above process of the step S 3 until labels are changed into the target label, in which case, the clean samples after the replacement are poisoned samples, and the variable names generated by replacing in the poisoned samples are used as triggers; and
S4. randomly inserting the triggers of the poisoned samples into the clean samples to form negative samples; and performing a backdoor attack for the classification task in the code model by using a backdoor module trained based on the negative samples, the poisoned samples and the clean samples,
wherein the C score calculation is performed using a following formula:
C
var
=
f
t
a
r
get
[
var
]
-
f
non
-
target
[
var
]
f
[
var
]
n
t
a
r
g
e
t
n
*
n
n
o
n
-
t
a
r
g
e
t
n
f
[
var
]
in the formula, n target represents a number of the target label appearing in the clean samples; n represents a total number of the labels appearing in the clean samples; f target [var] represents a number of the variable names appearing in the target label; f non-target [var] represents a number of the variable names in a non-target label; f[var] represents a number of the variable names in the clean samples; and non-target represents a number of the non-target label appearing in the clean samples.
2 . The backdoor attack method for a classification task in a code model according to claim 1 , wherein each of the code segments comprises the variable names, and each of the code segments corresponds to one of the labels.
3 . The backdoor attack method for a classification task in a code model according to claim 1 , wherein in the S1, the clean samples are preprocessed based on a masked language model; and the preprocessing comprises processing the clean samples into corresponding data forms according to different downstream tasks, and finding the importance variable names therefrom.
4 . The backdoor attack method for a classification task in a code model according to claim 3 , wherein the downstream tasks comprise a defect detection task, a clone detection task, and an authorship attribution.
5 . The backdoor attack method for a classification task in a code model according to claim 4 , wherein the data form corresponding to the defect detection task is an open-source C language project, the data form corresponding to the clone detection task is a JAVA project, and the data form corresponding to the authorship attribution is a Python file.
6 . The backdoor attack method for a classification task in a code model according to claim 1 , wherein the S2 further comprises processing the trigger sets: deleting a function name, a keyword, a special symbol, and content in quotation marks after each of the trigger sets is formed, and then performing frequency statistics on remaining variable names, and sorting according to a frequency of the remaining variable names.
7 . The backdoor attack method for a classification task in a code model according to claim 1 , wherein in the S4, data augmentation is performed on the poisoned samples and the clean samples before the triggers are inserted randomly.
8 . The backdoor attack method for a classification task in a code model according to claim 7 , wherein in the S4, the data augmentation involves permutation and combination of the poisoned samples, and sampling the clean samples.
9 . The backdoor attack method for a classification task in a code model according to claim 2 , wherein in the S1, the clean samples are preprocessed based on a masked language model; and the preprocessing comprises processing the clean samples into corresponding data forms according to different downstream tasks, and finding the importance variable names therefrom.
10 . The backdoor attack method for a classification task in a code model according to claim 2 , wherein the S2 further comprises processing the trigger sets: deleting a function name, a keyword, a special symbol, and content in quotation marks after each of the trigger sets is formed, and then performing frequency statistics on remaining variable names, and sorting according to a frequency of the remaining variable names.
11 . The backdoor attack method for a classification task in a code model according to claim 2 , wherein in the S4, data augmentation is performed on the poisoned samples and the clean samples before the triggers are inserted randomly.
12 . A backdoor attack system for a classification task in a code model, comprising:
a memory storing instructions; and
a processor connected to the memory, and configured to execute the instructions to perform following steps:
S1. collecting and preprocessing clean samples comprising a plurality of code segments to obtain an importance variable name;
S2. classifying variable names of the clean samples according to label categories to obtain a plurality of trigger sets and selecting a target label from the clean samples at the same time;
S3. performing C score calculation on the variable names in the trigger sets corresponding to the target label; replacing the importance variable name with the variable name having a maximum C score in the clean samples, predicting labels of the label categories after replacement based on a model, and deleting the variable name with the maximum C score from the trigger sets; and above process of the step S 3 is repeated until labels are changed into the target label, in which case, the clean samples after the replacement are poisoned samples, and the variable names generated by replacing in the poisoned sample are used as triggers; and
S4. randomly inserting the triggers of the poisoned samples into the clean samples to form negative samples; and performing a backdoor attack for the classification task in the code model by using a backdoor module trained based on the negative samples, the poisoned samples and the clean samples,
wherein the C score calculation is performed using a following formula:
C
var
=
f
t
a
r
get
[
var
]
-
f
non
-
target
[
var
]
f
[
var
]
n
t
a
r
g
e
t
n
*
n
n
o
n
-
t
a
r
g
e
t
n
f
[
var
]
in the formula, n target represents a number of the target label appearing in the clean samples; n represents a total number of the labels appearing in the clean samples; f target [var] represents a number of the variable names appearing in the target label; f non-target [var] represents a number of the variable names in a non-target label; and f[var] represents a number of the variable names in the clean samples; and nnon-target represents a number of the non-target label appearing in the clean samples.