PaperlayerView exact revision on arXiv

Source-linked AI summary

Natural Code Transformation Confuses Agents in Vulnerability Analysis

Jie Zhu, Ronik Bhaskar, Heather Zheng, Ben Y. Zhao, Kexin Pei

arXiv:2610.14350v2cs.CRcs.AIcs.LG

TL;DR

Agents can produce different vulnerability-analysis results across commits that preserve functionality and the vulnerability, raising questions about robustness and defensive use. The paper mines real-world development patterns into code transformations and finds that these transformations reduce agent success, while noting practical and evaluation boundaries.

  • Problem

    It is unclear whether strong vulnerability-analysis performance transfers across program variants, while attackers may use agents to discover and exploit vulnerabilities at scale.

    Source: §1 · p. 1

  • Method

    The authors mine recurring real-world commit patterns into reusable transformation skills, apply and compose them on target code, and evaluate agents on transformed repositories.

    Source: §1 · p. 2, §3 · p. 5

  • Results

    GPT-5.6 Sol with Codex falls from 63.3% to 36.8% mean success under natural transformations (−42%), compared with 49.7% (−21%) under synthetic obfuscations.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The study validates the feasibility of mining natural transformations to protect code from vulnerability-scanning agents and expands research on resisting unauthorized AI code scanning.

    Source: §1 · p. 2, §5 · p. 9

    The study mines one dataset of 700+K commits and evaluates agents only in CyberGym’s hardest level-0 setting.

    Source: §5 · p. 9

Abstract

from arXiv · show

Having demonstrated a strong potential for automating vulnerability discovery, AI agents can also be used to attack software systems at scale. Today's software systems need mechanisms to level the playing field by slowing down potential attacks, giving them time to patch vulnerabilities and strengthen software. Along this line, our study of agent trajectories in vulnerability analysis shows a surprising finding: agents produce dramatically different results across real-world code commits that carry the same functionality and the same vulnerability. This phenomenon appears consistently in multiple code domains and vulnerability categories. It motivates us to study natural and functionality-preserving code transformations derived from real-world software development, and their potential as a defense against attacker agents. We build a corpus of natural transformations by mining recurring development patterns from real-world code commits, and apply them to evaluate impact on agentic vulnerability analysis. Our results show that even a single form of transformation can effectively "confuse" frontier agents, e.g., Codex with GPT-6 Sol, reducing successes in vulnerability discovery. We also study different agent failures, whether transformations can be composed to provide stronger protection, and adaptive attackers who seek to reverse them. Overall, our study of natural code transformation significantly expands the research space of using code transformations to defend against malicious agents.

1 INTRODUCTION

The paper argues that vulnerability-analysis agents can vary sharply across commits preserving functionality and vulnerabilities, and proposes mining natural code transformations as a defense that may slow attacker agents. It reports reduced agent success under these transformations while identifying practical challenges for a robust hardening toolkit.

1 INTRODUCTION

  • Across adjacent commits with the same functionality and vulnerability, agent success fluctuates, with the pattern observed across multiple code domains and vulnerability categories.Failures include exhausting the budget or generating PoCs that cannot trigger the vulnerability.Source: §1 · p. 1
  • Natural, functionality-preserving transformations derived from real development may be harder for agents to recognize and reverse than fixed obfuscations.Prior fixed rewrites are described as limited in diversity and impact, and some are easily identifiable and trivially reversible.Source: §1 · pp. 1–2
  • The study mines recurring commit patterns into reusable skills, composes them into code-specific transformations, validates preserved functionality and vulnerabilities, and evaluates frontier agents.The authors identify translating the concept into a practical, robust hardening toolkit as an open challenge.Source: §1 · p. 2
  • GPT-5.6 Sol with Codex falls from 63.3% to 36.8% mean success under natural transformations (−42%), versus 49.7% (−21%) under synthetic obfuscations.The paper also reports that 80% of failures involve a wrong PoC and 20% involve budget exhaustion.Source: §1 · p. 2

2 SURPRISING OBSERVATIONS FROM REAL-WORLD CODE COMMITS

The section situates the work amid questions about whether vulnerability-analysis performance transfers across program variants, then shows that small, functionality-preserving changes can alter agent outcomes. It presents real-world software evolution as a source of potentially useful defensive transformations.

2.1 RELATED WORKS AS CONTEXT

  • Prior work leaves unclear whether strong agent performance transfers across variants, while code-model robustness studies often use local, context-agnostic rewrites that are recognizable and removable.This paper instead studies transformations arising naturally during software development.Source: §2.1 · p. 3

2.2 AGENTIC VULNERABILITY ANALYSIS IS SUSCEPTIBLE TO CODING ACTIVITIES

  • The study tests neighboring commits where the ground-truth vulnerability is retained, replaying the PoC to verify it and asking agents to detect that vulnerability.The evaluation samples versions before and after a CyberGym target commit on which the agent had succeeded.Source: §2.2 · p. 3
  • Across commits of the same codebase, agent results vary significantly despite the versions carrying the same functionality and vulnerability.The agent may exhaust its budget or produce a PoC that does not trigger the vulnerability.Source: §2.2 · p. 3
  • In Mongoose, separating two function calls into different files makes them harder for the agent to link, leading it toward false leads and budget exhaustion.The adjacent commits are described as functionally identical and containing the same vulnerability.Source: §2.2 · p. 4
  • Because normal software evolution creates broad structural and semantic changes that are difficult to identify or reverse, the authors see it as a potential defense against attacker agents.The transformations are presented as a wider and less predictable alternative to fixed syntax changes.Source: §2.2 · p. 4

3 MINING AND APPLYING NATURAL CODE TRANSFORMATIONS

The authors mine recurring development patterns and turn them into reusable skills that agents instantiate in target repositories. They check transformed code against tests and vulnerability PoCs, and evaluate agent success under the resulting transformations.

Mining transformation categories from existing codebases

  • The mining uses 702,062 CommitPackFT commits across 14 development tasks, retaining 1,196 C commits and 851 C++ commits after filtering for transformation extraction.The corpus is focused on C and C++ because vulnerability-analysis agents primarily target memory-unsafe languages.Source: §3 · p. 4

From transformations to skills

  • The resulting catalog contains 48 transformations—25 structural, 15 robustness, and 8 performance—and the 21 most frequent cover 84% of the analyzed commits.Figure 3 presents representative before-and-after snippets for the selected transformations as skills.Source: §3 · p. 5, Figure 3 · p. 5
  • Mined categories abstract away commit-specific names and locations, while stochastic skill applications and sequential compositions add variation that can make transformations harder to detect or reverse.The authors describe the abstract representation as expanding the search space for adaptive attackers.Source: §3 · p. 5

Instantiating transformations for a specific codebase

  • The team rebuilds transformed code, runs repository tests, and replays the ground-truth PoC to check functionality and vulnerability preservation modulo the tests.Failed checks are fed back to the agent for iterative reapplication.Source: §3 · p. 5
  • Figure 4 compares success rates under each transformation with original success rates for six model–harness combinations, using dashed lines for the untransformed baselines.All panels share a scale; detailed rates and relative changes are listed in Appendix B.Source: Figure 4 · p. 6

4 EVALUATION

Across evaluated agents, natural code transformations reduced vulnerability-discovery success, while composition further lowered success and the effect persisted across sensitivity tests. Failures were usually invalid proof-of-concept inputs rather than budget exhaustion.

4 EVALUATION

  • The evaluation used CyberGym level 0, selecting tasks GPT-5.6 Sol with Codex could solve within 20 minutes and six frontier LLMs paired with three agent harnesses.The selected subset was designed to resemble the original dataset across PoC size, crash depth, and other features.Source: §4 · p. 6

4.1 IMPACT OF CODE TRANSFORMATIONS

  • 32.8% to 20.4%: mean success across LLM agents and transformations fell; for GPT-5.6 Sol with Codex, natural transformations yielded 36.8% versus 49.7% for synthetic obfuscations, from 63.3%.The largest relative drop reported was Claude Sonnet 5 with Claude Code under R4, from 16.7% to 0.0%.Source: §4.1 · pp. 6–7
  • Table 1 compares synthetic obfuscations: identifier renaming and loop-to-recursive were exceptions, misleading agents but becoming ineffective when adaptive attackers proactively rewrote the code.Natural transformations reduced GPT-5.6 Sol with Codex success to 36.8%, compared with 49.7% under synthetic obfuscations.Source: Table 1 · p. 7, §4.1 · p. 7
  • Composing transformations lowered GPT-5.6 Sol with Codex mean success from 34.4% for constituents alone to 26.7% for pairs and 20.0% for a triple; pairs also made individually weak transformations effective.The composed transformations degraded performance by 3.3 to 13.3 points beyond their most effective constituent.Source: Table 2 · p. 7, §4.1 · p. 7

4.2 SENSITIVITY ANALYSIS

  • With four times the default budget, transformed repositories plateaued around 41.7%, below the original codebase’s 63.3%; results were stable across repeat counts, with the success-rate gap staying between 32.8 and 34.8 points.Original-task success stayed between 62% and 65%, and individual transformations fluctuated by no more than 6 percentage points.Source: §4.2 · pp. 7–8
  • At a fixed $2 budget, high reasoning reached 63.3% on original tasks, but transformed codebases peaked at only 33.2% with max effort.For original tasks, high reasoning exceeded no reasoning by 43.3 points; max effort reached 58.3%.Source: §4.2 · p. 8
  • Natural transformations remained effective against adaptive attackers at all three knowledge levels, and reversing four edits across all three families suggested degradation depended more on the edit than its direction.The attacker was given $8 to rewrite transformed code before vulnerability analysis; the reverse-edit results covered four selected tasks.Source: §4.2 · p. 8, Figure 6 · p. 8, Table 3 · p. 9

4.3 FAILURE MODE ANALYSIS

  • In analyzed failures, 80% involved a completed but invalid PoC and 20% budget exhaustion; failed runs averaged 7,091 output tokens versus 8,685 for successful runs.The trajectory analysis covered six tasks, with six successful original-codebase trajectories and 109 failed transformed-codebase trajectories.Source: §4.3 · p. 9

5 OPEN CHALLENGES AND FUTURE WORK

The authors identify limits in interpretability, dataset and evaluation scope, and semantic guarantees, alongside open questions about transformation mechanisms and defenses against adaptive agents.

5 OPEN CHALLENGES AND FUTURE WORK

  • The study mines patterns and applies transformations with code agents, limiting interpretability; its mining uses one dataset of 700+K commits and evaluation focuses on CyberGym level 0.The authors suggest human involvement, larger C/C++ codebases, and broader evaluation settings as future directions.Source: §5 · p. 9
  • The mechanisms underlying transformations and their efficacy against diverse agents remain open research questions.The study expands research on using code transformations to resist unauthorized AI-agent code scanning.Source: §5 · p. 9
  • Repository-derived transformations are less vulnerable to automated identification and removal than fixed transformations such as loop unrolling, while randomized one-way transformations are proposed as a direction for resisting reversal.The authors describe one-way transformations as a promising direction for greater robustness against adaptive agents.Source: §5 · p. 9
  • Deeper analysis of failures under specific transformations may reveal limitations in agent reasoning and inform better control of offensive agents and defenses.Source: §5 · p. 9
  • More powerful agent countermeasures are needed beyond simply informing agents about defensive transformations; data-driven approaches such as augmentation are described as ineffective against code-commit susceptibility.Source: §5 · p. 9
  • Stronger guarantees that transformations preserve program semantics by construction could improve their usability and deployability in realistic software development.The current validation establishes functionality preservation only modulo ground-truth tests.Source: §5 · p. 9

A DATA SAMPLING STATS

The appendix constructs a representative 186-task subset from CyberGym, balancing project and task characteristics while retaining broad coverage of crash types.

A DATA SAMPLING STATS

  • CyberGym contains 1,507 repo-level vulnerability-detection tasks from 188 open-source projects, but 151 tasks were excluded for zero-byte PoCs or repeated crash-site reports.The remaining tasks came from 186 projects.Source: A DATA SAMPLING STATS · p. 14
  • The subset contains 186 tasks from 186 projects and covers 26 crash types, with project source, codebase size, crash type, PoC size, crash-stack depth, and SCARINESS score used for balance.Source: A DATA SAMPLING STATS · p. 14
  • The subset shifts the task mix: heap-buffer-overflow tasks fall from 38.8% to 25.3%, while UndefinedBehaviorSanitizer reports rise from 6.6% to 13.4%.The authors characterize this as a reasonable change given the balancing goal and use of only three sanitizers.Source: A DATA SAMPLING STATS · p. 14

B DETAILED SUCCESS RATES

The appendix compares success-rate changes across transformation families, individual transformations, and model–harness combinations, and reports how transformation size is measured.

B DETAILED SUCCESS RATES

  • 38.0%, 36.0%, and 31.8% are the mean relative drops for structure, robustness, and performance transformation families, respectively.Table 4 reports success rates under each natural transformation, with absolute rates and signed relative changes.Source: B DETAILED SUCCESS RATES · p. 14, Table 4 · p. 14
  • Table 5 reports transformation size using median line changes and quartiles, plus the median number of files changed.Source: Table 5 · p. 15
  • Raw Pointer to RAII, Fixed Buffer to Container, and Extract Abstract Base have the largest mean relative drops at 62.7%, 57.9%, and 55.7%, while Lock Shared State has the smallest at 4.0%.Four transformations raise at least one combination's success rate, all under Claude Code; gains include Claude Sonnet 5 rising from 16.7% to 26.7% under Lock Shared State.Source: Table 4 · p. 14, B DETAILED SUCCESS RATES · p. 15
  • GPT-5.6 Sol with Codex leads both before and after transformation, at 63.3% and 36.8%, but harness and model effects are confounded because each model uses one harness.The two strongest baselines retain the smallest fractions of their original performance: 58.2% for GPT-5.6 Sol and 60.4% for GPT-6 Sol.Source: B DETAILED SUCCESS RATES · p. 15

C TRANSFORMATION SIZE ANALYSIS

Transformation size was measured by code changes, but the analysis finds that larger changes do not determine effectiveness; modified-file timestamps were also reset to prevent a possible side channel.

C TRANSFORMATION SIZE ANALYSIS

  • Size is measured by lines added or deleted and files modified, with medians reported in Table 5.Source: C TRANSFORMATION SIZE ANALYSIS · p. 16
  • Transformation size is not strongly correlated with effectiveness, and sheer size is not the determining factor.The most effective transformations by relative change had relatively few line changes compared with other transformations.Source: C TRANSFORMATION SIZE ANALYSIS · p. 16
  • Because changing file modification times could expose a side channel, the authors reset modified files' timestamps to their original values.Source: C TRANSFORMATION SIZE ANALYSIS · p. 16

D PROMPTS

The appendix gives the CyberGym evaluation prompt and the instructions for labeling developer actions in single-file C/C++ diffs. Actions are generic code-change patterns, with repository-specific details abstracted away and incidental edits excluded.

D PROMPTS

  • The CyberGym prompt directs agents to generate and test an exploit PoC, stopping once it triggers a crash.It points agents to the workspace README and submission script for PoC testing.Source: D PROMPTS · p. 16
  • Commit-labeling instructions define an action as a generic, reusable code-change pattern that describes the shape of a change rather than its application domain.Action names should use a verb, concrete code element, and purpose, without repository-specific names.Source: D PROMPTS · p. 16
  • The labeling prompt excludes incidental edits such as renames, whitespace changes, tests, and new features without restructuring existing code.It also excludes typos, comment wording, version or constant bumps, and string-literal changes.Source: D PROMPTS · p. 16
  • The response format is JSON with zero to three actions ordered by significance, or an empty list when none qualify.Source: D PROMPTS · p. 16
Loading 2610.14350v2…