一句话：提出 CausalVul，用 do-演算消除虚假特征，提升深度学习漏洞检测的准确率、鲁棒性与分布外泛化能力。
深度学习漏洞检测近年表现良好，但模型对扰动不鲁棒，且在分布外（OOD）数据上泛化差，例如应用于真实未见项目时性能下降。作者假设这是因为模型学到了变量名等与标签存在虚假相关的非鲁棒特征，一旦扰动或 OOD 数据不再具备相同虚假特征，预测就会失败。为此，论文将因果性引入深度学习漏洞检测，提出 CausalVul，包含两个阶段：首先设计新颖扰动以发现模型可能依赖的虚假特征；然后在已有深度学习模型之上应用因果学习算法，特别是 do-演算，系统性地移除对虚假特征的使用，从而促进基于因果的预测。实验表明，在所用全部最先进模型与数据集上，CausalVul 一致提升了准确率、鲁棒性与 OOD 性能。据作者所知，这是首个将基于 do-演算的因果学习引入软件工程模型并证明其有效性的工作。
Deep learning vulnerability detection has shown promising results in recent years. However, an important challenge that still blocks it from being very useful in practice is that the model is not robust under perturbation and it cannot generalize well over the out-of-distribution (OOD) data, e.g., applying a trained model to unseen projects in real world. We hypothesize that this is because the model learned non-robust features, e.g., variable names, that have spurious correlations with labels. When the perturbed and OOD datasets no longer have the same spurious features, the model prediction fails. To address the challenge, in this paper, we introduced causality into deep learning vulnerability detection. Our approach CausalVul consists of two phases. First, we designed novel perturbations to discover spurious features that the model may use to make predictions. Second, we applied the causal learning algorithms, specifically, do-calculus, on top of existing deep learning models to systematically remove the use of spurious features and thus promote causal based prediction. Our results show that CausalVul consistently improved the model accuracy, robustness and OOD performance for all the state-of-the-art models and datasets we experimented. To the best of our knowledge, this is the first work that introduces do calculus based causal learning to software engineering models and shows it's indeed useful for improving the model accuracy, robustness and generalization. Our replication package is located at https://figshare.com/s/0ffda320dcb96c249ef2.
@inproceedings{paperbot11403,
title = {Towards Causal Deep Learning for Vulnerability Detection},
author = {Md Mahbubur Rahman and Ira Ceka and Chengzhi Mao and Saikat Chakraborty and Baishakhi Ray and Wei Le},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3639170}
}