代码漏洞模型在语义保持变换下的嵌入漂移
原标题：Embedding Drift in Code Vulnerability Models Under Intended Behaviour-Preserving Transformations
AI 摘要
该研究基于 Big-Vul 构建了 7,500 对 C/C++ 漏洞-补丁函数（共 15,000 个函数），对两类样本施加四种保持语义的变异（删注释、插入死代码、重命名变量与重写循环、以及全部组合），并用冻结的 microsoft/codebert-base 嵌入配合六种分类器评估。结果显示组合变异下基线 Vulnerable Flip Rate（VFR）达 35.55%–42.15%，即原本正确检出的漏洞被误判为安全。作者提出一种仅用训练集的投影防御，将平均 VFR 从 22.60% 降至 11.32%，但会带来误报上升的权衡，无法完全消除预测不稳定。
正文节选
Embedding Drift in Code Vulnerability Models Under Intended Behaviour-Preserving Transformations Abstract Code edits designed to preserve intended behaviour can shift frozen code embeddings across classifier decision boundaries, causing correctly detected vulnerabilities to be predicted as benign. This instability is important because harmless changes such as removing comments, adding code that never runs, renaming variables, or rewriting a loop should not alter a model’s security judgment. We s