Source-linked AI summary
Learning to Repair Software Vulnerabilities with Generative Adversarial Networks
Jacob Harer, Onur Ozdemir, Tomo Lazovich, Christopher P. Reale, Rebecca L. Russell, Louis Y. Kim, Peter Chin
TL;DR
Repairing software vulnerabilities is difficult when paired vulnerable and fixed examples are unavailable. The paper uses adversarial learning to train a generator without paired data, and reports performance reasonably close to a paired-data seq2seq baseline. It also identifies a challenge in training with soft outputs for discrete sequences.
Problem
The paper addresses automatic repair of vulnerable source code when paired examples of vulnerable code and its repair are difficult to obtain.
Source: §1 · pp. 1–2Method
A GAN trains an NMT generator against a discriminator without paired examples, with generator losses to enforce input-to-repair correspondence.
Source: §1 · p. 2Results
The Base + Cur + Freq GAN performs reasonably close to the seq2seq baseline, and results on unpaired data are fairly close to paired-data results, particularly for the Base model despite using half the training data.
Source: §5.3 · p. 8Takeaways & Limitations
The approach can use data without paired examples and is presented as applicable to other sequence-correction tasks, including grammar correction and sentiment translation.
Source: §6 · pp. 8–9Soft generator outputs lie inside the probability simplex while real tokens are one-hot, so their distributions have disjoint supports and a theoretically trivial discriminator can separate them.
Source: §3.2 · p. 4
Abstract
from arXiv · showhide
Motivated by the problem of automated repair of software vulnerabilities, we propose an adversarial learning approach that maps from one discrete source domain to another target domain without requiring paired labeled examples or source and target domains to be bijections. We demonstrate that the proposed adversarial learning approach is an effective technique for repairing software vulnerabilities, performing close to seq2seq approaches that require labeled pairs. The proposed Generative Adversarial Network approach is application-agnostic in that it can be applied to other problems similar to code repair, such as grammar correction or sentiment translation.
1 Introduction
The paper frames automatic vulnerability repair as translating vulnerable code into corrected code, a task where labeled vulnerable-to-fixed pairs can be difficult to obtain. It proposes adversarial learning to train without pairs while addressing discrete outputs and non-bijective mappings.
1 Introduction
- Software vulnerabilities can let attackers crash programs or expose sensitive information, and thousands are reported publicly each year.Source: §1 · p. 1
- Vulnerability repair resembles grammatical error correction, but paired vulnerable and repaired code can be costly to obtain or unavailable.Static analyzers and machine-learning methods can label code as vulnerable or not without pairing the labeled sets.Source: §1 · pp. 1–2
- The proposed GAN approach trains an NMT generator against a discriminator without paired examples, using soft outputs and generator losses to address discrete outputs and input-to-repair correspondence.The generator losses are designed to enforce useful repairs even when source and target domains are not bijective; the approach is also proposed for grammar correction and sentiment translation.Source: §1 · p. 2
2 Related Work
Prior software-repair systems commonly use test cases to rank and validate fixes, while a seq2seq repair approach most closely resembles this work but requires paired training data. Prior GAN work addresses discrete sequence generation and conditionality in other ways; the paper motivates self-regularization for correction domains that are not bijective.
2.1 Software Repair
- Most prior data-driven repair approaches use test cases to rank and validate fixes; Gupta et al.’s seq2seq repair most closely resembles this work but requires paired training data.Other approaches reuse mined bug-fix patterns, rank candidate fixes probabilistically, or generate rule-based repairs ranked by a neural network.Source: §2.1 · p. 2
2.2 GANs
- For discrete sequences, prior GAN methods include reinforcement-learning rewards, MMD-based stabilization, and Wasserstein GANs, which this paper adopts.The sequence-level reward approach can slow convergence because it does not identify which output tokens the discriminator considers incorrect.Source: §2.2 · pp. 2–3
- Prior conditional GAN approaches use paired examples or dual generators for round-trip consistency, but the paper argues correction domains are not bijective and proposes generator self-regularization instead.A single mapping from correct to incorrect sequences cannot cover the many ways a correct sequence may be broken.Source: §2.2 · p. 3
3 Formulation
The framework maps unpaired samples between discrete vulnerable-code and corrected-code domains using adversarial learning. Its formulation addresses discrete outputs and constrains repairs to remain close to their inputs.
3 Formulation
- The mapping problem translates unpaired samples from a discrete vulnerable-code domain to a discrete corrected-code domain.GANs frame generation as a generator–discriminator minimax game.Source: §3 · p. 3
3.1 Adversarial Loss
- The original GAN loss can become unstable with nonoverlapping distribution supports and can cause mode collapse; WGAN instead uses Earth-Movers distance and is used for more stable training.The WGAN discriminator is constrained to be 1-Lipschitz.Source: §3.1 · p. 4
3.2 GANs with Discrete Data
- Because discrete sampling is nondifferentiable, the discriminator receives softmax probability vectors, with argmax-sampled prior tokens feeding subsequent generator steps.The soft vectors are expectations of one-hot vectors under the conditional distribution.Source: §3.2 · p. 4
- Soft outputs and real one-hot tokens have disjoint supports, so a discriminator could exploit token-wise differences; the authors conjecture simple networks avoid this shortcut.Their experiments found relatively shallow networks performed better than deeper ones.Source: §3.2 · p. 4
- A 1-layer CNN with the original Wasserstein loss provides better generator-training signal, while discriminator complexity trades off spurious token cues against modeling the data.The authors recommend tuning discriminator complexity for each application.Source: §3.2 · p. 5
- The authors report that embedding-only and Gumbel-softmax alternatives did not improve performance, while clipped-weight WGAN worked better than WGAN-GP after tuning.The proposed explanation is that weight clipping encourages simpler discriminators that attend to token dependencies.Source: §3.2 · pp. 4–5
3.3 Domain Mapping with Self-Regularization
- Autoencoding correct sequences encourages correct content to remain unchanged and indirectly encourages repaired sequences to stay close to their inputs.This regularizer directly targets unchanged correct inputs and indirectly targets input proximity.Source: §3.3 · pp. 5–6
- Token-frequency matching constrains generated outputs to preserve input token frequencies but permits arbitrary reordering; GAN loss penalizes such outputs as unlike the target distribution.The frequency regularizer compares each vocabulary token’s frequency in the input and generated sequences.Source: §3.3 · p. 6
4 Putting It All Together - Proposed GAN Framework
The proposed framework combines an attention-based NMT generator, convolutional discriminators, and optional regularizers. It pre-trains generators as denoising autoencoders and uses curriculum learning to manage sequence-generation instability.
4 Putting It All Together - Proposed GAN Framework
- The framework uses an attention-based NMT generator with multilayer LSTM encoder and decoder, convolutional discriminators, and regularized or unregularized loss variants.The unregularized variant sets λ = 0.Source: §4 · p. 6
4.1 Autoencoder Pre-Training
- Generators are pre-trained as denoising autoencoders on desired data, with training inputs corrupted by token dropping and random insertions and deletions.Tokens are dropped with probability 0.2; insertion and deletion count is 0.03 times sequence length.Source: §4.1 · p. 6
4.2 Curriculum Learning
- Curriculum learning gradually increases generated sequence length to limit error propagation when adversarial training cannot use teacher forcing.All sequences are clipped to a predefined maximum length at each step; the discriminator is briefly retrained after updates.Source: §4.2 · pp. 6–7
5 Experiments
Experiments progress from controlled sorting and grammar tasks to C/C++ vulnerability repair, evaluating GANs with paired data while also testing unpaired training. The SATE IV results show the strongest GAN variant performs reasonably close to the seq2seq upper bound, and unpaired results remain fairly close to paired results despite using half the training data.
5.1 Sorting
- Auto or Freq regularization significantly improves Sequence Accuracy over the vanilla GAN, which often produces valid orderings without respecting the input sequence.The experiments also measure Order Accuracy, which counts valid orderings even when the input-to-output mapping is incorrect.Source: §5.1 · p. 7
5.2 Simple Grammar
- The GAN achieves high CFG accuracy on error-injected grammar sequences, despite non-bijective mappings that contribute to slightly lower BLEU scores.The authors report that such many-to-one repair patterns also occur frequently in real-world repair datasets.Source: §5.2 · pp. 7–8
5.3 SATE IV
- SATE IV contains vulnerable C/C++ functions from 116 CWE classes, and its paired and unpaired datasets support comparison with seq2seq and unpaired GAN training.The paired GAN data uses sampled repairs, while the unpaired split separates vulnerable functions from candidate repairs and reduces training data by half.Source: §5.3 · p. 8
- On SATE IV, Base + Cur + Freq performs reasonably close to the seq2seq upper bound, while unpaired results are fairly close to paired results despite using half the training data.Adding curriculum training and either LAUTO or LFREQ regularization progressively improves GAN results.Source: §5.3 · p. 8, Table 1 · p. 8
6 Conclusions
The paper presents a GAN-based NMT approach for discrete domain mapping that can train without paired data. It introduces generator losses for accurate mapping without requiring bijective domains, while noting that handling discrete GAN outputs remains an open challenge.
6 Conclusions
- The GAN-based approach trains an NMT system for discrete domain mapping without requiring paired data.The authors identify this as a major advantage because it makes previously unusable datasets available for sequence correction.Source: §6 · p. 8
- Two novel generator loss functions enforce accurate domain mapping without requiring multiple generators or bijective source and target domains.Source: §6 · p. 9
- Handling discrete outputs with GANs remains far from solved, and the approach is proposed as applicable to grammar correction and sentiment translation as well as code correction.Source: §6 · p. 9
Appendix A Network and Training Details
The appendix supplies network and training details for reproducing the experiments, with architectures sharing a general design but varying in layer number and size.
Appendix A Network and Training Details
- Experimental networks share a similar architecture but vary in the number and size of layers.The appendix presents these network and training details for replication.Source: Appendix A · p. 11
A.1 Network Architecture
The GAN and seq2seq baseline use identical generator networks, while the GAN discriminator uses convolution, temporal max pooling, and fully connected layers.
A.1 Network Architecture
- The generator architecture is shared by the GAN and seq2seq baseline, while the discriminator is specific to the GAN architecture shown alongside it.Source: §A.1 · p. 11, Figure 2 · p. 12
- The generator encodes the input with an RNN and decodes outputs one at a time, using global dot-product attention over encoder states.Sorting and CFG use 3-layer, 512-neuron RNNs; SATE4 uses 4-layer, 512-neuron RNNs.Source: §A.1 · p. 11, Figure 2 · p. 12
- The discriminator applies convolutional filters of sizes 3, 7, and 11, aggregates their outputs with sequence-wide max pooling, then uses two fully connected layers.The fully connected layers have 512 neurons and one output neuron, respectively.Source: §A.1 · p. 11
A.2 Training
Training combines denoising-autoencoder pretraining, adversarial optimization, and curriculum learning, with different training schedules for the reported experiment types.
A.2 Training
- The generator is pretrained as a denoising autoencoder with Adam at a 10^-4 learning rate, and the same pretrained network initializes GAN and seq2seq generators.Source: §A.2 · p. 12
- GANs use RMSprop, train the discriminator 15 times per generator update, and initialize it with 10 epochs of discriminator-only training.The discriminator and generator learning rates start at 5 × 10^-4 and 10^-5, respectively; training lasts 200, 400, and 1,000 epochs for sorting, CFG, and SATE4.Source: §A.2 · p. 12
- GAN training uses clipped Wasserstein GAN with a 0.05 threshold; lower thresholds reduced discriminator accuracy, while higher thresholds led to the discrete-domain issues described for WGAN-I.Source: §A.2 · p. 12
- Curriculum length increases when discriminator accuracy falls below 55% or after 40 epochs, whichever comes first.Sorting and CFG start at length 5 and add 2; SATE4 starts at 75 and adds 5.Source: §A.2 · p. 12
Appendix B Context Free Grammar
The appendix specifies a simple context-free grammar and explains how its productions and terminals are written.
Appendix B Context Free Grammar
- Each CFG line is a production rule, alternatives are separated by |, and symbols in quotes are terminals.Source: Appendix B · p. 12
- The start production expands S into SOS, NP, VP, and EOS, with SOS and EOS mapped to terminals '1' and '2'.Source: Appendix B · p. 13
- NP expands to Det Nom, while VP expands to V NP or V NP PP; the grammar also lists alternatives for the component categories.Source: Appendix B · p. 13
Appendix C Repair Examples
The repair examples include successful fixes and failures, illustrating both targeted code changes and cases where the generated repair remains incorrect.
Appendix C Repair Examples
- The GAN adds an upper-bound check to vulnerable code that already checks the lower bound before using a socket-derived array index.Source: Table 3 · p. 13
- For a socket used before binding, the GAN reorders bind, listen, and accept into the correct order.Source: Table 4 · p. 14
- When a buffer is too small for the resulting write, the GAN increases the allocated memory.Source: Table 5 · p. 14
- For an sprintf call missing its second string argument, the GAN supplies a second string.Source: Table 6 · p. 15
- One incorrect repair fully initializes a variable but then uses a variable identifier instead of the appropriate function call.Source: Table 7 · p. 15
- In an integer-underflow example, the GAN modifies rand in an unknown way and frees data instead of printing it, rather than making the golden repair.Source: Table 8 · p. 15