[Paper Review] STRATA: Building Robustness with a Simple Method for Generating Black-box Adversarial Attacks for Models of Code.

Jacob M. Springer, Bryn Marie Reinstadler+1 more|arXiv (Cornell University)|Sep 28, 2020

Adversarial Robustness in Machine Learning40 references4 citations

TL;DR

This paper proposes STRATA, a simple and efficient black-box method for generating adversarial examples in code models that preserve semantic meaning. It outperforms gradient-based methods with less computational cost and enables robustness via adversarial training, reducing code2seq's F1 score by 42% on attacks and restoring it to 99% of baseline through defense.

ABSTRACT

Adversarial examples are imperceptible perturbations in the input to a neural model that result in misclassification. Generating adversarial examples for source code poses an additional challenge compared to the domains of images and natural language, because source code perturbations must adhere to strict semantic guidelines so the resulting programs retain the functional meaning of the code. We propose a simple and efficient black-box method for generating state-of-the-art adversarial examples on models of code. Our method generates untargeted and targeted attacks, and empirically outperforms competing gradient-based methods with less information and less computational effort. We also use adversarial training to construct a model robust to these attacks; our attack reduces the F1 score of code2seq by 42%. Adversarial training brings the F1 score on adversarial examples up to 99% of baseline.

Motivation & Objective

• To address the challenge of generating adversarial examples in code models that maintain functional semantics while evading detection.
• To develop a black-box attack method requiring minimal model information and computational resources.
• To improve model robustness against adversarial examples through effective adversarial training.
• To evaluate the effectiveness of the attack and defense in real-world code model scenarios.

Proposed method

• STRATA generates adversarial examples by applying small, semantically valid perturbations to source code, preserving the original program's functionality.
• The method operates in a black-box setting, requiring only model predictions and no gradient access to the target model.
• It uses a search-based approach over syntactic and semantic code transformations to find perturbations that cause misclassification.
• The attack supports both untargeted and targeted variants, enabling flexible evaluation of model robustness.
• Adversarial training is applied using the generated adversarial examples to fine-tune the model and improve resilience.
• The approach is designed to be efficient, minimizing computational overhead while maximizing attack success rate.

Experimental results

Research questions

• RQ1 Can a black-box adversarial attack be designed for code models that maintains semantic correctness while achieving high success rates?
• RQ2 How does the proposed method compare to gradient-based approaches in terms of attack effectiveness and computational cost?
• RQ3 To what extent can adversarial training defend code models against the proposed attack?
• RQ4 What is the impact of the attack on model performance, and how well can robustness be recovered through defense?

Key findings

• STRATA achieves state-of-the-art attack performance on code models with significantly less computational effort than gradient-based methods.
• The attack reduces the F1 score of the code2seq model by 42% on adversarial examples, demonstrating high effectiveness.
• Adversarial training using STRATA-generated examples restores the model's F1 score to 99% of its original baseline performance.
• The method is effective in both untargeted and targeted attack scenarios, showing broad applicability.
• The attack remains effective despite the semantic constraints of code, proving its robustness and practicality.
• The defense via adversarial training maintains high model accuracy while significantly improving resilience to adversarial inputs.