一句话：提出 AdvPrompt-MIA，利用代码对抗提示诱导输出差异构造特征，训练分类器实现代码补全模型的训练集成员推断。
针对代码补全模型的成员推断攻击可用于评估隐私风险，但现有黑盒与灰盒方法依赖昂贵的代理模型或人工启发式规则，难以捕捉过参数化代码语言模型展现的细粒度记忆模式。本文提出 AdvPrompt-MIA，将代码特定的对抗扰动与深度学习相结合：设计一系列对抗提示以诱导受害代码模型输出发生变化，并将这些输出与真实补全结果进行比较，构造特征向量以训练分类器，从而自动区分训练集成员与非成员样本。该设计能捕获更丰富的记忆模式并准确推断训练集成员关系。作者在 Code Llama 7B 等广泛使用的模型以及 APPS、HumanEval 基准上进行了全面评估，结果表明该方法持续优于最先进的基线，AUC 提升最高达 102%，并展现出跨模型与跨数据集的强迁移性，体现了其实用性与泛化能力。
Membership inference attacks (MIAs) on code completion models offer an effective way to assess privacy risks by inferring whether a given code snippet was part of the training data. Existing black- and gray-box MIAs rely on expensive surrogate models or manually crafted heuristic rules, which limit their ability to capture the nuanced memorization patterns exhibited by over-parameterized code language models. To address these challenges, we propose AdvPrompt-MIA, a method specifically designed for code completion models, combining code-specific adversarial perturbations with deep learning. The core novelty of our method lies in designing a series of adversarial prompts that induce variations in the victim code model’s output. By comparing these outputs with the ground-truth completion, we construct feature vectors to train a classifier that automatically distinguishes member from non-member samples. This design allows our method to capture richer memorization patterns and accurately infer training set membership. We conduct comprehensive evaluations on widely adopted models, such as Code Llama 7B, over the APPS and HumanEval benchmarks. The results show that our approach consistently outperforms state-of-the-art baselines, with AUC gains of up to 102%. In addition, our method exhibits strong transferability across different models and datasets, underscoring its practical utility and generalizability.
DOI 原文 ·
@inproceedings{paperbot9351,
title = {Effective Code Membership Inference for Code Completion Models via Adversarial Prompts},
author = {Yuan Jiang and Zehao Li and Shan Huang and Christoph Treude and Xiaohong Su and Tiantian Wang},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00191}
}