Abstract:Program authorship attribution has implications for the privacy of programmers who wish to contribute code anonymously. While previous work has shown that complete files that are individually authored can be attributed, we show here for the first time that accounts belonging to open source contributors containing short, incomplete, and typically uncompilable fragments can also be effectively attributed. We propose a technique for authorship attribution of contributor accounts containing small source code samples, such as those that can be obtained from version control systems or other direct comparison of sequential versions. We show that while application of previous methods to individual small source code samples yields an accuracy of about 73% for 106 programmers as a baseline, by ensembling and averaging the classification probabilities of a sufficiently large set of samples belonging to the same author we achieve 99% accuracy for assigning the set of samples to the correct author. Through these results, we demonstrate that attribution is an important threat to privacy for programmers even in real-world collaborative environments such as GitHub. Additionally, we propose the use of calibration curves to identify samples by unknown and previously unencountered authors in the open world setting. We show that we can also use these calibration curves in the case that we do not have linking information and thus are forced to classify individual samples directly. This is because the calibration curves allow us to identify which samples are more likely to have been correctly attributed. Using such a curve can help an analyst choose a cut-off point which will prevent most misclassifications, at the cost of causing the rejection of some of the more dubious correct attributions.

Code Authors Hidden in File Revision Histories: An Empirical Study

A Study on Identifying Code Author from Real Development

Why is My Code Change Abandoned?

Git Blame Who?: Stylistic Authorship Attribution of Small, Incomplete Source Code Fragments

Assessing Code Authorship: The Case of the Linux Kernel

Who Made This Copy? An Empirical Analysis of Code Clone Authorship

I still know it's you! On Challenges in Anonymizing Source Code

Recognizing and Imitating Programmer Style: Adversaries in Program Authorship Attribution

Code stylometry vs formatting and minification

SHIELD: Thwarting Code Authorship Attribution

A3Ident: A Two-phased Approach to Identify the Leading Authors of Android Apps

Authorship Attribution of Source Code: A Language-Agnostic Approach and Applicability in Software Engineering

Integration of Static and Dynamic Code Stylometry Analysis for Programmer De-anonymization

A Practical Black-Box Attack on Source Code Authorship Identification Classifiers

A3Ident: A Two-phased Approach to Identify the Leading Authors of Android Apps.

An empirical study of code reuse between GitHub and stack overflow during software development

A Study of Bug Resolution Characteristics in Popular Programming Languages

Whodunit: Classifying Code as Human Authored or GPT-4 Generated -- A case study on CodeChef problems

OCEAN: Open-World Contrastive Authorship Identification

An Exploratory Study on Codes in Heterogeneous Software Documents

Dynamics of Open-Source Software Developer's Commit Behavior: An Empirical Investigation of Subversion