Abstract:State-of-the-art source code classification models exhibit excellent task transferability, in which the source code encoders are first pre-trained on a source domain dataset in a self-supervised manner and then fine-tuned on a supervised downstream dataset. Recent studies reveal that source code models are vulnerable to adversarial examples, which are crafted by applying semantic-preserving transformations that can mislead the prediction of the victim model. While existing research has introduced practical black-box adversarial attacks, these are often designed for transfer-based or query-based scenarios, necessitating access to the victim domain dataset or the query feedback of the victim system. These attack resources are very challenging or expensive to obtain in real-world situations. This paper proposes the cross-domain attack threat model against the transfer learning of source code where the adversary has only access to an open-sourced pre-trained code encoder. To achieve such realistic attacks, this paper designs the Code Transfer learning Adversarial Example (CodeTAE) method. CodeTAE applies various semantic-preserving transformations and utilizes a genetic algorithm to generate powerful identifiers, thereby enhancing the transferability of the generated adversarial examples. Experimental results on three code classification tasks show that the CodeTAE attack can achieve 30% % attack success rates under the cross-domain cross-architecture setting. Besides, the generated CodeTAE adversarial examples can be used in adversarial fine-tuning to enhance both the clean accuracy and the robustness of the code model. Our code is available at https://github.com/yyl-github-1896/CodeTAE/.

CDTA: A Cross-Domain Transfer-Based Attack with Contrastive Learning.

Channel-augmented Joint Transformation for Transferable Adversarial Attacks

Exploiting Pre-Trained Models and Low-Frequency Preference for Cost-Effective Transfer-based Attack

Adversarial Attack Method Based on Dual- Frequency Domain Transformation

FACL-Attack: Frequency-Aware Contrastive Learning for Transferable Adversarial Attacks

Improving Transferability of Adversarial Examples With Input Diversity

Enhancing the Adversarial Transferability with Channel Decomposition

Exploiting the Adversarial Example Vulnerability of Transfer Learning of Source Code

Downstream Transfer Attack: Adversarial Attacks on Downstream Models with Pre-trained Vision Transformers

Delving into Transferable Adversarial Examples and Black-box Attacks

Adaptive Multi-scale Degradation-Based Attack for Boosting the Adversarial Transferability

A Data-free Black-box Attack for Generating Transferable Adversarial Examples.

CAMA: Class Activation Mapping Disruptive Attack for Deep Neural Networks

Detecting Adversarial Examples Via Prediction Difference for Deep Neural Networks.

Beyond ImageNet Attack: Towards Crafting Adversarial Examples for Black-box Domains.

A Target-oriented Approach to Enhancing the Transferability of Targeted Adversarial Attacks

Towards Transferable Targeted Attack.

Blurred-Dilated Method for Adversarial Attacks.

Enhance Domain-Invariant Transferability of Adversarial Examples via Distance Metric Attack

Understanding and Enhancing the Transferability of Adversarial Examples

Crafting Transferable Adversarial Examples Via Contaminating the Salient Feature Variance