# LEO: An Innovative Information-theoretic Learning-based Approach for Out-of-
distribution Source Code Vulnerability Detection

Anonymous Author(s)

###### Abstract

Software vulnerabilities (SVs) have become a common, serious, and crucial
concern to safety-critical security systems. That leads to significant
progress in the use of AI-based methods for software vulnerability detection
(SVD). Although achieving promising performances for SVD and other domain
applications (e.g., speech recognition or image classification), AI-based
methods are well-known to fail against input data (often referred to as out-
of-distribution (OOD) data) lying far away from the training data distribution
(i.e., in-distribution). This drawback leads to serious issues where the
models fail to indicate when they are likely mistaken. To address this
problem, OOD detectors have been applied before feeding the input data to the
downstream AI-based modules. While OOD detection has been widely designed for
computer vision and medical diagnosis applications, automated AI-based
techniques for OOD vulnerability detection have not yet been well studied. To
this end, in this paper, we propose an innovative deep learning-based
framework for OOD vulnerability detection. Our method is derived from an
information-theoretic perspective with the use of cluster-contrastive learning
to effectively learn and leverage source code characteristics, enhancing data
representation learning for solving the OOD source code vulnerability
detection problem. The rigorous and comprehensive experiments on real-world
source code vulnerabilities show the effectiveness and advancement of our
approach compared to state-of-the-art baselines by a wide margin on three
primary measures. In short, our method achieves around 0% for the FPR measure
and over 90% for both the AUROC and AUPR measures in almost all cases of the
used in-distribution and OOD vulnerabilities.

##  1 Introduction

Software vulnerabilities (SVs), known as specific flaws or oversights in
software programs allowing attackers to exploit the code base and potentially
undertake dangerous activities (e.g., exposing sensitive information or taking
control of a computer system) [Dowd2006], have become a common, serious, and
crucial issue to safety-critical security. There have been many approaches
proposed for software vulnerability detection (SVD) ranging from open-source
to commercial tools, and from manual to automatic methods [Neuhaus:2007:PVS,
shin2011evaluating, yamaguchi2011vulnerability, Grieco2016, Li2016:VAV,
KimWLO17, VulDeePecker2018, Duan2019, Cheng2019, nguyen2019deep, Zhuang2020,
van-dual-dan-2020, van-ijcnn2021, ReGVD2022] have been proposed and
implemented based on machine learning and deep learning approaches.

Although achieving significant performances for SVD and other domain
applications (e.g., autonomous driving and biometric authentication), machine
learning-based and deep learning-based methods are well known to fail against
input data (i.e., referred to as OOD data) lying far away from the training
data distribution (i.e., in-distribution). This drawback causes serious
problems where the models fail to indicate when they are likely mistaken. Deep
learning-based classifiers have been shown to incorrectly classify such out-
of-distribution data samples into in-distribution classes with high confidence
[goodfellow-2014, NguyenYC14]. That can limit their adoption as well as cause
unexpected crucial accidents in safety-critical systems such as medical and
security domains. This problem is extremely serious in the cyber security
domain. Hackers can create vulnerabilities (with the assistance of domain
experts and AI-based tools, e.g., generative large language models) and
exploit unknown (or out-of-distribution) vulnerabilities to compromise
computer or network systems until appropriate measures are taken to address
and mitigate the issue.

The problems of out-of-distribution (also known as anomaly or outlier) result
in rapid progress in the use of advanced machine learning and deep learning
for out-of-distribution (OOD) detection before feeding input data samples to
the downstream AI-based modules. However, though achieving significantly
promising performance for OOD detection, almost all existing methods are
mainly based on or applicable to images in computer vision (e.g.,
[HendrycksG16c, Hendrycks18, Lee18a, Lee18b, Sehwag21,
sun2022outofdistribution]) or genomics sequences in medical diagnosis (e.g.,
[Ren19]), automated deep learning-based techniques for OOD source code
vulnerability detection have not yet been well studied and explored.
Furthermore, we observed that these methods cannot be straightforwardly
applied in the context of out-of-distribution source code vulnerability
detection due to the difference in the nature of source code data compared
with images and genomics sequences. Motivated by this problem, in this paper,
we study the research questions:

"How to derive an effective method for out-of-distribution (OOD) source code
vulnerability detection where we aim to detect if an input source code data is
from an out-of-distribution vulnerability? What are the main challenges and
key characteristics of source code data to be considered?"

We notice that various instances of vulnerable source code data, associated
with different vulnerability types (e.g., buffer overflow error or resource
management error), frequently originate from distinct vulnerability patterns.
In each source code data sample (i.e., a function or a program), the
vulnerability pattern emerges from the intricate semantic relationships
between vulnerability-relevant source code statements. Therefore, to be able
to figure out the difference between source code data from various
vulnerabilities to facilitate OOD vulnerability detection, the corresponding
method definitely should have the capability of learning and figuring out the
important source code statements that form the vulnerability patterns of the
associated vulnerable source code data.

When it comes to source code data, we observed some key characteristics as
follows: (i) source code data (i.e., functions or programs) are complicated
and different from texts or images due to consisting of complex semantic and
syntactic relationships between code statements and code tokens forming the
corresponding vulnerability, (ii) different source code data can share a lot
of common background information (e.g., non-vulnerable code sentences) while
there are only a few sentences causing the data to be different and
vulnerable. This problem requires an appropriate solution to learn and figure
out vulnerable parts inside vulnerable data for being able to distinguish non-
vulnerable and vulnerable source code data samples, and (iii) although having
the same vulnerability label (e.g., vulnerability type, i.e., buffer overflow
error, or vulnerable one in general), there are still many different hidden
vulnerability patterns causing the source code data samples vulnerable.
Therefore, an elegant mechanism for automatically figuring out and separating
the vulnerable source code samples consisting of different vulnerability
patterns is also needed to have robust data representation learning for OOD
source code vulnerability detection.

To this end, in this paper, we propose a novel deep learning-based approach
that can learn and leverage the characteristics of source code data to
automatically figure out the important and vulnerability-relevant code
statements, forming the corresponding hidden vulnerability patterns of
vulnerable source code data. In addition, our approach can also utilize the
semantic relationships of hidden vulnerability patterns inside and between
source code data samples to boost the data representation learning for OOD
source code vulnerability detection. Via this paper, we demonstrate that the
ability to capture the characteristics of source code data as well as figure
out and leverage the relationships of hidden vulnerability patterns inside and
between source code data samples for boosting the data representation learning
play a key role for OOD source code vulnerability detection.

In particular, our approach consists of two phases. In the training phase, we
propose an elegant training principle based on information theory and cluster-
contrastive learning for effectively learning and leveraging the
characteristics of source code data to boost the data representation learning
process. During the training phase, our proposed approach enhances the
learning of semantic relationships inside and between source code data samples
for forming clear boundaries between source code data consisting of different
hidden vulnerability patterns (i.e., note that in the latent space, the
representations of vulnerable source code data sharing the same hidden
vulnerability pattern tend to form a corresponding cluster) in the latent
space for the training set of the in-distribution data ($D_{in}$). In the
testing (inference) phase, inspired by [Lee18b, Winkens2020, Sehwag21], we use
the cluster-conditioned detection method (using the Mahalanobis distance
[Mahalanobis]) to calculate the outlier score $s(X)$ for each testing input
data sample $X$ in the latent space with respect to the training data set
(i.e., $D_{in}$). Based on the outlier score $s(X)$, we determine whether $X$
is out-of-distribution. Please refer to Section 3 for a comprehensive
explanation, visualization, and algorithm of our proposed method.

In summary, our key contributions are as follows:

  * •

We study an important problem of out-of-distribution source code vulnerability
detection. Automated machine learning and deep learning-based techniques for
this problem have not yet been well studied and explored.

  * •

We propose an innovative end-to-end deep learning-based framework derived from
an information-theoretic perspective integrated with innovative cluster-
contrastive learning for automatically learning the characteristics of source
code data. Our framework can also figure out and leverage the semantic
relationships of hidden vulnerability patterns inside and between source code
data (e.g., functions or programs) to boost the data representation learning
for OOD source code vulnerability detection. To the best of our knowledge, our
work is one of the first methods proposed to solve the problem.

  * •

We comprehensively evaluate and compare our proposed approach with different
state-of-the-art baselines on real-world source code datasets. Our extensive
experiments show that our proposed approach obtains a significantly higher
performance than the baselines in three main measures including FPR (at TPR
95%), AUROC, and AUPR, used in almost all of the out-of-distribution detection
methods, notably [Hendrycks18, Ren19, Sehwag21].

##  2 Related Work

##### OOD detection

There have been many AI-based methods (i.e., machine learning-based and deep
learning-based approaches) introduced for out-of-distribution detection widely
applied to computer vision and medical diagnosis applications. While
traditional methods, e.g., one-class SVMs [Scholkopf1999], have been revisited
with deep representations [pmlr-v80-ruff18a], yielding improvements to complex
data, the vast majority of deep learning existing efforts toward developing
efficient detection solutions have studied threshold-based detectors
[HendrycksG16c, LiangLS17, GuoPSW17, Lakshminarayanan-2016] using the
confidence (or entropy) of the predictive distribution $p(Y|X)$ (where $Y$
denotes the label of the corresponding data $X$) of (or assembles of)
discriminative classifiers trained on in-distribution data. Lee et al.[Lee18a]
and Hendrycks et al. [Hendrycks18] further introduced confidence losses that
use an auxiliary dataset (i.e., a generative adversarial network (GAN)
[goodfellow-2014] for generating the most effective samples from $P_{out}$
(out-of-distribution) or a dataset entirely disjoint from test-time data) to
teach the network better representations for anomaly detection. Lee et al.
[Lee18b] proposed a method that is applicable to any pre-trained softmax
neural classifier (without re-training) for detecting abnormal test samples
including OOD and adversarial ones. In particular, the idea is to measure the
probability density of the test sample on feature spaces of DNNs utilizing the
concept of a generative (distance-based) classifier.

Recently, Hendrycks et al. [Hendrycks2019] proposed a method using self-
supervised learning with image rotation prediction for enabling the detection
of out-of-distribution examples while Winkens et al. [Winkens2020] introduced
a contrastive training (in addition to supervised classification losses) on
image data for out-of-distribution detection. Sehwag et al. [Sehwag21]
proposed an outlier detector using self-supervised representation learning
[TingChen-2020, YonglongTian-2020] followed by a Mahalanobis distance-based
detection in the feature space.

An alternative for out-of-distribution detection is to use generative model-
based methods, which are appealing as they do not require labeled data and can
directly model the input data distribution. Specifically, these methods fit a
generative model to the input data and then evaluate the likelihood of new
inputs under that model. However, some later works (e.g., [Nalisnick18] and
[Choi18]) have highlighted significant issues with this approach for OOD
detection on images, showing that deep generative models such as Glow
[Kingma18] and PixelCNN [OordKK16, SalimansKCK17] sometimes assign higher
likelihoods to OOD than in-distribution inputs. Ren et al. [Ren19] proposed a
likelihood ratio method that uses a background model to correct the background
statistics and enhances the in-distribution specific features for OOD
detection applied to images and genomics sequences data.

Although most of the existing methods have achieved promising results for out-
of-distribution detection, they are mainly based on or only applicable to
computer vision applications or medical diagnosis. Automated deep learning-
based techniques for out-of-distribution source code vulnerability detection
have not yet been well studied. In our paper, we adapt some state-of-the-art
out-of-distribution detection methods (e.g., [Hendrycks2017dnn, Hendrycks18,
Sehwag21]) to the out-of-distribution source code vulnerability detection and
compare these model’s performance to our proposed method. Please refer to the
Experiment section (Section 4) for details.

##### Software vulnerability detection

AI-based approaches have been proposed for software vulnerability detection
(SVD). Most previous work in SVD, such as [yamaguchi2011vulnerability,
shin2011evaluating, Li2016:VAV, Grieco2016, KimWLO17], was based primarily on
handcrafted features manually chosen by knowledgeable domain experts with
possibly outdated experience and underlying biases. In many situations, these
handcrafted features do not generalize well. For example, features that work
well in a certain software project may not perform well in other projects
[Zimmermann2009]. To alleviate the dependency on handcrafted features, the use
of automatic features in SVD has been studied recently [VulDeePecker2018,
jun_2018, Dam2018, Li2018SySeVR, Duan2019, Cheng2019, Zhuang2020, ReGVD2022].
These methods show the advantages of employing automatic features over
handcrafted features for SVD.

Although achieving significant performances in many domain applications (e.g.,
autonomous driving, biometric authentication, and cyber security), AI-based
methods are well-known to fail against the input data lying far away from the
training data distributions. In our paper, we want to investigate if effective
work in SVD can produce a good performance on out-of-distribution source code
vulnerability detection.

Additional baselines of our proposed method are some effective and state-of-
the-art methods for software vulnerability detection including
[VulDeePecker2018, ReGVD2022, CodeBERT2020]. As mentioned, we aim to
investigate how these methods perform for out-of-distribution source code
vulnerability detection. VulDeePecker [VulDeePecker2018] is considered one of
the most effective deep learning-based software vulnerability detection
methods leveraging the power of bi-directional long-short-term memory (LSTM)
networks. CodeBERT [CodeBERT2020] is a pre-trained model (based on the
Transformer’s encoder framework [transformers-Vaswani17]) that specializes in
the programming language. Via CodeBERT, we aim to investigate how large
language models work in the context of out-of-distribution vulnerability
detection. ReGVD [ReGVD2022] is a simple yet effective graph neural network-
based model for the software vulnerability detection problem.

##  3 The proposed LEO approach

###  3.1 The problem statement

We denote $D_{in}$ as a source code vulnerability type dataset consisting of
$\\{(X_{1},Y_{1}),\dots,(X_{N_{D_{in}}},Y_{N_{D_{in}}})\\}$ where $X_{i}$ is a
data sample (i.e., a function or a program) comprised of $L$ code statements
from $\boldsymbol{x}_{1}$ to $\boldsymbol{x}_{L}$ while $X_{i}$’s
vulnerability label $Y_{i}\in\\{0,1\\}$ (i.e., $0$: non-vulnerable and $1$:
vulnerable). From the dataset $D_{in}$, we can build AI-based (machine
learning or deep learning) approaches to detect the vulnerability (i.e.,
benign or vulnerable) of the source code data sampled from the distribution
$D_{in}$; however, they are known to fail against the data samples (outliers
or out-of-distribution) that lie far away from the training data distribution
$D_{in}$ with high confidence. Advanced machine learning and deep learning
approaches for OOD detection have been widely introduced, notably based on and
applicable in computer vision and medical applications. These methods
determine whether input data samples belong to the in-distribution or out-of-
distribution category before they are input to downstream neural network
modules.

The ability to identify anomalous (out-of-distribution) data plays a crucial
role in ensuring the safety and dependability of predictions. In the cyber
security domain, by doing this, we help the security analysts detect the new
potential vulnerabilities existing in the input samples. That helps harden the
software or network systems defense. In our paper, we focus on the task of
detecting whether an input source code data sample is from a learned
distribution $D_{in}$ or from an out-of-distribution $D_{out}$ vulnerability.

###  3.2 Methodology

In what follows, we present the details of how our proposed LEO method works
and addresses the out-of-distribution vulnerability detection problem. We
first describe the process of our LEO method taking into account the source
code characteristics and working to automatically learn and figure out the
important and vulnerability-relevant source code statements, forming the
corresponding hidden vulnerability patterns in vulnerable source code data,
contributing to robust source code data representation learning for
facilitating out-of-distribution source code vulnerability detection. We then
present our effective solution for leveraging the semantic relationships of
hidden vulnerability patterns inside and between the source code samples
(i.e., functions or programs) by utilizing innovative cluster-contrastive
learning to further improve the source code data representation learning
process.

---
Figure 1: A visualization of our proposed LEO method for effectively improving
the source code data representation learning process for OOD vulnerability
detection.

####  3.2.1 Important feature selection and hidden vulnerability patterns
learning

As depicted in Figure 1, our LEO method starts with a selection network
$\zeta$ for automatically learning and figuring out the important and
vulnerability-relevant code statements in each source code data, forming the
corresponding vulnerability patterns in vulnerable source code, leading to
robust source code data representation learning and facilitating out-of-
distribution source code vulnerability detection.

##### Motivation

In reality, to real-world image or text data, only some parts of the data are
important and lead to the corresponding label. To illustrate, images can be
modeled as backgrounds plus objects while text can be considered as a
combination of high-frequency stop words plus semantic words. We witness the
same property for source code data. In particular, in source code data, there
are some code statements much more important than others in contributing to
the vulnerability of the data, especially to vulnerable source code data
samples. The core important code statements usually form the corresponding
vulnerability patterns of the vulnerable source code data (i.e., please refer
to Figure 4 for examples where the core vulnerable statements are highlighted
in red color) while the vulnerability-irrelevant code statements can be shared
between different vulnerable data and potentially compromise the model
capability in learning the data representations of vulnerable source code
samples.

##### Selection network

Giving a source code data sample $X$ consisting of $L$ code statements from
$\mathbf{x}_{1}$ to $\mathbf{x}_{L}$ (i.e., in practice, each code statement
$\mathbf{x}_{i}$ is represented as a vector using a learnable embedding
method, please refer to the data processing and embedding in the appendix,
Section 6.1, for details), our selection network $\zeta$ aims to select the
important and vulnerability label-relevant code statements $\tilde{X}$ in $X$
by learning a set of independent Bernoulli latent variables
$\mathbf{z}\in\\{0,1\\}^{L}$. That represents the importance of the sentences
to the corresponding vulnerability $Y$ of $X$. Specifically, each element
$z_{i}$ in $\mathbf{z}=\\{z_{i}\\}_{i=1}^{L}$ indicates if $\mathbf{x}_{i}$ is
related to the vulnerability $Y$ (i.e., if $z_{i}$ is equal to $1$, the
statement $\mathbf{x}_{i}$ plays an important role causing the vulnerability
$Y$). Note that for the vulnerable source code data, the selected statements
represent those that make the data vulnerable.

To construct $\mathbf{z}=\\{z_{i}\\}_{i=1}^{L}$, we model
$\mathbf{z}\sim\mathrm{MultiBernoulli}(\mathbf{p})=\prod_{i=1}^{L}\text{Bernoulli}(p_{i})$,
which indicates $\mathbf{x}_{i}$ is related to the vulnerability $Y$ of $X$
with probability $p_{i}$ where $p_{i}=g_{i}\left(X;\alpha\right)$ with $g$ is
a neural network parameterized by the parameter $\alpha$. It is worth noting
that the neural network $g$ takes $X$ as input and outputs corresponding
$\mathbf{p}=\\{p_{i}\\}_{i=1}^{L}$. With $\mathbf{z}$, we construct
$\tilde{X}=\zeta\left(X\right)$ (i.e., the subset code statements that lead to
the vulnerability $Y$ of the function $X$) by $\tilde{X}=X\odot\mathbf{z}$,
where $\odot$ represents the element-wise product. Note that we can view the
selection model as a distribution $q_{sel}(\mathbf{z}|X;\alpha)$ over a
selector variable $\mathbf{z}$ which indicates the important features (i.e.,
code statements) for a given sample of $X$.

Figure 2: A visualization for the selection network $\zeta$ which works as a
feature selection model for robust data representation learning. Assuming that
we have a source code data sample
$X=[\mathbf{x}_{1},\mathbf{x}_{2},\mathbf{x}_{3},\mathbf{x}_{4},...,\mathbf{x}_{L}]$
going through the selection network (i.e., it learns a set of independent
Bernoulli latent variables $\mathbf{z}\in\\{0,1\\}^{L}$ representing the
importance of the sentences to the corresponding vulnerability $Y$ of $X$) to
obtain $\mathbf{z}=[0,1,1,0,...,1]$. From $X$ and $\mathbf{z}$, we construct
$\tilde{X}$ by $X\odot\mathbf{z}$. At the end, we obtain
$\tilde{X}=[\mathbf{0},\mathbf{x}_{2},\mathbf{x}_{3},\mathbf{0},...,\mathbf{x}_{L}]$.

To make the selection process (i.e., the process consists of sampling
operations from a Multi-Bernoulli distribution) continuous and differentiable
during training, we apply the Gumbel-Softmax trick [jang2016categorical,
MaddisonMT16] for relaxing each Bernoulli variable $z_{i}$. Specifically, we
sample
$z_{i}\left(X;\alpha\right)\sim\text{Concrete}(g_{i}(X;\alpha),1-g_{i}(X;\alpha))$:

$z_{i}\left(X;\alpha\right)=\frac{\exp\\{(\log
g_{i}+a_{i})/\nu\\}}{\exp\\{(\log
g_{i}+a_{i})/\nu\\}+\exp\\{(\log\left(1-g_{i}\right)+b_{i})/\nu\\}}$

where we denote $g_{i}\left(X;\alpha\right)$ as $g_{i}$ while $\nu$ is a
temperature parameter (i.e., controlling how closely a continuous
representation from a Gumbel-Softmax distribution approximates this from the
corresponding discrete representation from a discrete distribution (e.g., the
Bernoulli distribution)), random noises $a_{i}$ and $b_{i}$ independently
drawn from Gumbel distribution $G=-\log(-\log u)$ with $\
u\sim\textbf{Uniform}(0,1)$.

##### Mutual information for guiding the selection process

Here, we present how to use mutual information for guiding the selection
network in obtaining the most meaningful $\tilde{X}$ (i.e., $\tilde{X}$ can
predict the vulnerability $Y$ of $X$ correctly).

In information theory [TheoryofC, EofIT2006], mutual information is used to
measure the mutual dependence between two random variables. In particular, it
quantifies the information obtained about one random variable by observing the
other. Leveraging this property of mutual information and inspired by
[learning-to-explain-l2x, van-ijcnn2021], we maximize the mutual information
between $\tilde{X}$ and $Y$ as mentioned in Eq. (1) with the intuition is that
by using the information from $Y$, the selection process $\zeta$ will be
learned and enforced to obtain the most meaningful $\tilde{X}$ (i.e.,
$\tilde{X}$ can predict the vulnerability $Y$ of $X$ correctly).

By viewing $\tilde{X}$ and $Y$ as random variables, the selection process
(model) $\zeta$ is learned by maximizing the mutual information between
$\tilde{X}$ and $Y$ as follows:

$\max_{\zeta}\,I(\tilde{X},Y).$ (1)

Following [EofIT2006], we expand Eq. (1) further as the Kullback-Leibler
divergence (i.e., it measures the difference in the information of two
distributions) of the product of marginal distributions of $\tilde{X}$ and $Y$
from their joint distribution:

$\displaystyle I(\tilde{X},Y)=$ $\displaystyle\int
p(\tilde{X},Y)\log\frac{p(\tilde{X},Y)}{p(\tilde{X})p(Y)}d\tilde{X}dY$
$\displaystyle\geq$ $\displaystyle\int
p(Y,\tilde{X})\log\frac{q(Y|\tilde{X})}{p(Y)}dYd\tilde{X}$ (2)

In practice, estimating mutual information is challenging as we typically only
have access to samples but not the underlying distributions. Therefore, in the
above derivation, we apply to use a variational distribution $q(Y|\tilde{X})$
to approximate the posterior $p(Y|\tilde{X})$, hence deriving a variational
lower bound of $I(\tilde{X},Y)$ for which the equality holds if
$q(Y|\tilde{X})=p(Y|\tilde{X})$. This can be further expanded as:

$\displaystyle I(\tilde{X},Y)\geq$ $\displaystyle\int
p(Y,\tilde{X},X)\log\frac{q(Y|\tilde{X})}{p(Y)}dYd\tilde{X}dX$
$\displaystyle=$ $\displaystyle E_{X,Y}E_{\tilde{X}|X}[\log
q(Y|\tilde{X})]+\text{const}$ (3)

To model the conditional variational distribution $q(Y|\tilde{X})$, we
introduce a classifier implemented with a neural network $f(\tilde{X};\beta)$,
which takes $\tilde{X}$ as input and outputs its corresponding label $Y$
(i.e., we view the classifier model as a distribution
$q_{class}(Y|\tilde{X};\beta)$). Our objective is to learn the selection
process (model) as well as the classifier to maximize the following objective
function:

$\underset{\alpha,\beta}{\text{max}}\left\\{E_{X,Y}E_{\mathbf{z}\sim
q_{sel}(\mathbf{z}|X;\alpha)}[\text{log}q_{class}(Y|X\odot\mathbf{z};\beta)]\right\\}$
(4)

The mutual information facilitates a joint training process for the classifier
and the selection process (model). The classifier learns to identify a subset
of features leading to a data sample’s label while the selection process is
designed to select the best subset according to the feedback of the
classifier.

Figure 3: A visualization of the joint training process of the classifier and
the selection model process guided by maximizing mutual information between
$\tilde{X}$ and $Y$.

The joint training process between the classifier $f(.,\beta)$ and the
selection network $g(.,\alpha)$ brings benefits for selecting the important
and label-relevant features from the corresponding data. However, this joint
training process can cause a potential limitation. In particular, the
predictions of the classifier $f(.,\beta)$ can be based more on the features
selected from the selection network $g(.,\alpha)$ than the underlying
information contained in the features. In this case, the selected information
(i.e., sentences) can be any subsets of the entire sentences, not the
meaningful ones from the data.

To solve this problem and ensure the learnable selection process respecting
the data distribution in order to select both the meaningful and label-
relevant information of the data, in addition to learning the classifier
jointly with the selection network as mentioned in Eq. (4), inspired by
[realx2021], we propose to learn the classifier model $f(.,\beta)$ disjointly
to approximate the ground truth conditional distribution of $Y$ given subsets
of $X$ denoted by $X_{R}$ where $X_{R}=X\odot\mathbf{r}$ with
$\mathbf{r}\sim\text{MultiBernoulli}(0.5)$ (denoted by
$\mathbf{r}\sim\text{B}(0.5)$ for short). This procedure helps adjust the
classifier to let it not just only be affected by the information obtained
from the selection network but also based on the underlying information from
the data to update its parameters. We name this procedure as a data-
distribution mechanism. This procedure is then expressed as learning
$q_{class}(.;\beta)$ to maximize:

$\displaystyle
E_{X,Y}E_{\mathbf{r}\sim\text{B}(0.5)}\\{\text{log}q_{class}(Y|X\odot\mathbf{r};\beta)\\}$
(5)

To make this procedure (i.e., it consists of sampling operations from a Multi-
Bernoulli distribution) continuous and differentiable during training, we
apply the Gumbel-Softmax trick [jang2016categorical, MaddisonMT16] for
relaxing each Bernoulli variable $r_{i}\in\mathbf{r}$ using RelaxedBernoulli
distribution function from [RelaxedBernoulli].

####  3.2.2 Innovative cluster-contrastive learning for improving source code
data representation learning

##### Motivation

Using contrastive learning [Khosla2020] for improving data representations has
been widely applied to computer vision domain applications from vision
classification, detection, and segmentation [NEURIPS2020_Kim, Wang_2021_ICCV,
Sun_2021_CVPR, Du_2022_CVPR, Wang_2021_CVPR] to vision data out-of-
distribution detection [Sehwag21]. Its main idea is to encourage the data
having the same label to share the close representations. We also consider if
contrastive learning can help improve the source code data representation
learning process. However, via our observations, it seems to be overdoing and
not appropriate when straightforwardly applying contrastive learning to the
source code data because even from the same vulnerability, source code data
can often consist of different hidden vulnerability patterns causing them
vulnerable (in our experiment in Section 4, we demonstrate this observation by
comparing our LEO method with one of the most effective OOD approaches using
contrastive learning, namely SSD [Sehwag21]).

As illustrated in Figure 4, although having the same vulnerability $Y$ label
(e.g., vulnerability type, i.e., buffer overflow error), there are still
different hidden vulnerability patterns causing the source code data samples
vulnerable. Therefore, although in the same vulnerability $Y$ label, the
vulnerable source code samples formed from different vulnerability patterns
need to have different representations. Otherwise, when they are from the same
vulnerability patterns, their representations should be close or similar. To
ensure these properties and leverage the power of contrastive learning to
further improve the data representation learning process, we apply to use of
innovative cluster-contrastive learning in the representation learning process
of source code data.

Figure 4: An example of different vulnerability patterns causing buffer
overflow error. The left-hand figure is an example of the buffer copy without
checking the size of the input. This function allocates a buffer of 64 bytes
to store the hostname; however, there is no guarantee that the hostname will
not be larger than 64 bytes. If an attacker specifies an address that resolves
to a very large hostname, then the function may overwrite sensitive data or
even relinquish control flow to the attacker. The right-hand figure is an
example of the improper validation of an array index. This method only
verifies that the given array index is less than the maximum length of the
array but does not check for the minimum value. This will allow a negative
value to be accepted as the input array index which will result in an out-of-
bounds read and may allow access to sensitive memory.

##### Innovative cluster-contrastive learning.

We notice that vulnerable source code data samples originating from the same
vulnerability pattern tend to have similar $\tilde{X}$ and form the
corresponding cluster in the latent space. Therefore, we use clustering
analysis (e.g., $k$-means) on the representations $\tilde{X}$ of the
vulnerable source code samples in the latent space to group vulnerable samples
with the same vulnerability patterns into clusters before employing
contrastive learning to force vulnerable data to become more similar in the
same clusters and to be pushed far way in different clusters as follows:

$\mathcal{L}_{ccl}=\sum_{i\in
I}1_{Y_{i}=1}\frac{-1}{\left|C(i)\right|}\sum_{c\in
C(i)}\log\frac{\exp(\text{sim}({\tilde{X}_{i}},{\tilde{X}_{c}})/\tau)}{\sum\limits_{a\in
A(i)}\exp(\text{sim}({\tilde{X}_{i}},{\tilde{X}_{a}})/\tau)}$ (6)

where $I\equiv\\{1...m\\}$ is a set of indices of input data in a specific
mini-batch. $A(i)\equiv I\setminus\\{i\\}$ while $C(i)\equiv\\{c\in
A(i):\bar{Y}_{c}=\bar{Y}_{i}$ and $Y_{i}=1\\}$ is the set of indices of
vulnerable source code samples (labeled $1$) which are in the same cluster as
$F_{i}$ except $i$, and $\left|C(i)\right|$ is its cardinality. Here, we apply
$k$-means for each mini-batch and denote $\bar{Y}_{i}$ as the cluster label of
the data sample $\tilde{X}_{i}$. For the $sim(.,.)$ function, we apply cosine
similarity (please refer to the appendix, Section 6.5.8, for details). Note
that to form the corresponding vector for each $\tilde{X}_{i}$ in the latent
space for calculating the cosine similarity, we simply concatenate all vectors
where each vector stands for a representation of a code statement in
$\tilde{X}_{i}$).

It is worth noting that cluster-contrastive learning described in Eq. (6)
helps to enforce important properties of the source code data including (i)
the vulnerable and non-vulnerable source code samples should have different
representations, (ii) the vulnerable source code samples from different hidden
vulnerability patterns are also encouraged to have different representations
while (iii) the vulnerable source code samples in the similar hidden
vulnerability patterns are trained to have close representations. Ensuring
these properties definitely helps improve the selection process. That helps
boost the data representation learning facilitating out-of-distribution
vulnerability detection.

####  3.2.3 A summary of our proposed method

Please refer to Algorithm 1 for the details of our LEO method in both the
training and testing phases. After the training phase, we aim to obtain the
optimal selection network for the source code data representation learning.
That can select the most meaningful and label-relevant features (i.e., source
code statements), forming the corresponding vulnerability pattern to the
vulnerable source code, for each source code data to facilitate out-of-
distribution vulnerability detection.

##### The inference phase

Inspired by [Lee18b, Winkens2020, Sehwag21], we use the cluster-conditioned
out-of-distribution detection method (i.e., applying the Mahalanobis distance
to calculate the outlier score $s(X)$ for each testing source code input
sample $X$) in the latent space for out-of-distribution vulnerability
detection. The intuition is that an effective model will produce a high-
quality data representation learning process (model) for obtaining robust data
representations. Therefore, in the latent space, via the data representation
learning model, the representations of the in-distribution data and OOD data
should be separated.

The procedure for a cluster-conditioned detection method is as follows: We
first partition the features of in-distribution training data into $K$
clusters equal to the number of clusters used in cluster-contrastive learning.
We then compute the outlier score $s(X)$ of each testing input $X$ as
$s(X)=min_{k}(\tilde{X}-\mu_{k})^{\mathrm{\top}}\Sigma_{k}^{-1}(\tilde{X}-\mu_{k})$
where $\mu_{k}$ and $\Sigma_{k}$ are the sample mean and sample covariance of
each cluster $k$ in $K$ clusters. We finally compare this outlier score with a
threshold value to decide if the corresponding input sample is out-of-
distribution.

Input: An in-distribution source code data
$D_{in}=\left\\{\left(X_{1},Y_{1}\right),\dots,(X_{N_{D_{in}}},Y_{N_{{D_{in}}}})\right\\}$
where each source code data sample $X_{i}$ consisting of $L$ code statements
from $\mathbf{x}_{1}$ to $\mathbf{x}_{L}$ while its vulnerability
$Y_{i}\in\left\\{0,1\right\\}$ (i.e., $1$: vulnerable and $0$: non-vulnerable)
will be used during the training phase. An out-of-distribution vulnerability
source code data $D_{out}$ is used at the inference (testing) phase, denoted
as $X_{test}$.
We denote the number of training iterations $nt$; the mini-batch size $m$; the
trade-off hyper-parameter $\lambda$; and the number of clusters used in
cluster-contrastive learning $K$.
We randomly partition $D_{in}$ into the training set $D_{train}$ and the
validation set $D_{val}$.

1 We initialize the parameters $\alpha$ and $\beta$ of the selection model
$\zeta$ parameterized by $g(.,\alpha)$ and the classifier model $f(.,\beta)$,
respectively. Training Phase for  _$t=1$ to $nt$_ do

2 Choose a mini-batch of source code data samples denoted by
$\\{(X_{i},Y_{i})\\}_{i=1}^{m}$. Update the classifier parameter $\beta$ via
minimizing the following cross-entropy loss $\mathcal{L}_{ce}$
$E_{X,Y}E_{\mathbf{r}\sim
B(0.5)}[\mathcal{L}_{ce}(Y,f_{\beta}(X\odot\mathbf{r})]$ using the Adam
optimizer [KingmaB14]. Note that minimizing this function is equivalent to
maximizing the objective function mentioned in Eq. (5).

3 Update the classifier’s parameter $\beta$ and the selection model
parameter’s $\alpha$ via minimizing the following objective function
$E_{X,Y}E_{\mathbf{z}\sim
q_{sel}(\mathbf{z}|X;\alpha)}[\mathcal{L}_{ce}(Y,f_{\beta}(X\odot\mathbf{z}))+\lambda\mathcal{L}_{ccl}]$
using the Adam optimizer. The $\mathcal{L}_{ccl}$ is described in Eq. (6).

4

5 end for

6

7Note that after the training phase, we obtain the optimal selection network
for the source code data representation learning. The selection network can
select the most meaningful and label-relevant source code statements, forming
the vulnerability pattern to vulnerable data, for each source code data to
facilitate out-of-distribution vulnerability detection.

8Testing Phase We partition $D_{train}$ into $K$ clusters. In particular, we
use $k$-means to cluster the whole training data representations in the latent
space into $K$ clusters equal to the number of clusters used in cluster-
contrastive learning (mentioned in Eq. (6)). $\forall X_{i}\in X_{test}$
(denoted as $X_{i\\_test}$). We use Mahalanobis distance to calculate the
outlier (out-of-distribution) score for each testing data sample
$X_{i\\_test}$ as follows
$s(X_{i\\_test})=min_{k}(\tilde{X}_{i\\_test}-\mu_{k})^{\mathrm{\top}}\Sigma_{k}^{-1}(\tilde{X}_{i\\_test}-\mu_{k})$
where $\mu_{k}$ and $\Sigma_{k}$ are the sample mean and sample covariance of
cluster $k^{th}\in K$. In short,
$s_{X_{test}}=score(\tilde{X}_{test},\mu_{X_{train}},\Sigma_{X_{train}})$
$\forall X_{i}\in X_{val}$ (denoted as $X_{i\\_val}$). We use Mahalanobis
distance to calculate the outlier (out-of-distribution) score for each
validation data sample $X_{i\\_val}$ as follows
$s(X_{i\\_val})=min_{k}(\tilde{X}_{i\\_val}-\mu_{k})^{\mathrm{\top}}\Sigma_{k}^{-1}(\tilde{X}_{i\\_val}-\mu_{k})$
where $\mu_{k}$ and $\Sigma_{k}$ are the sample mean and sample covariance of
cluster $k$-th $\in K$. In short,
$s_{X_{val}}=score(G_{X_{val}},\mu_{X_{train}},\Sigma_{X_{train}})$ Calculate
$s_{X_{val}}$ (threshold) at $TPR=95\%$. (Note that the threshold value is
chosen at $TPR=95\%$ as commonly used in almost all OOD methods) if  _(
$s(X_{i\\_test})>s_{X_{val}}$)_ then

9 $X_{i\\_test}$ is an out-of-distribution data.

10else

11 $X_{i\\_test}$ is an in-distribution data.

12 end if

Output: $\forall X_{i}\in X_{test}$ (denoted as $X_{i\\_test}$) whether
$X_{i\\_test}$ is out-of-distribution data sample.

Algorithm 1 The algorithm of our proposed LEO method for out-of-distribution
source code vulnerability detection.

##  4 Experiments

###  4.1 Experimental Designs

The fundamental goal of our experiments is to evaluate our LEO method and
compare it with state-of-the-art baselines for out-of-distribution source code
vulnerability detection. Below, we present the research questions of our
paper.

(RQ1) Can our method successfully detect out-of-distribution source code
vulnerabilities? How effective is it compared to baselines?

For AI-based systems, being able to detect data that is out-of-distribution
can be critical to maintaining safe and reliable predictions. Although
achieving promising performances, current state-of-the-art out-of-distribution
(OOD) methods are mostly applied to computer vision and medical diagnosis
applications. Automated deep learning-based approaches for OOD detection to
the source code data have not yet been well studied and explored. To this end,
we propose one of the first methods for out-of-distribution source code
vulnerability detection. We demonstrate that by taking into account source
code characteristics and leveraging the correlations of the hidden
vulnerability patterns inside and between the source code data samples, we can
significantly improve the source code data representation learning for
boosting out-of-distribution source code vulnerability detection.

(RQ2) How does our method perform in different cases of the in-distribution
data when the in-distribution data consists of more than one different type of
vulnerability?

In reality, in-distribution source code data can consist of one or many
different types of vulnerabilities. Therefore, in this research question, we
investigate the performance of our proposed LEO method in various cases
regarding the different number of vulnerability types (i.e., without loss of
generality, we assume there are two and three different vulnerability types)
existing in the in-distribution source code data and observe how the model
performs compared to the baselines.

(RQ3) Do the cluster-contrastive learning and the data-distribution mechanism
help improve the code data representation learning for boosting the model
performance of out-of-distribution vulnerability detection?

We aim to investigate the effectiveness of innovative cluster-contrastive
learning (taking into account source code characteristics and semantic
relationships) and the data-distribution mechanism in learning the true hidden
vulnerability patterns existing in the vulnerable source code data. We prove
that these terms significantly improve data representation learning, helping
to boost the out-of-distribution source code vulnerability detection of the
model.

####  4.1.1 Studied datasets

We conducted experiments on many different real-world vulnerability (CWE)
types extracted from a well-known and big C/C++ dataset, namely Big-Vul
provided by [Bigdata2020] which contains many types of vulnerabilities such as
CWE119 (Improper Restriction of Operations within the Bounds of a Memory
Buffer), CWE20 (Improper Input Validation), and CWE125 (Out-of-bounds Read).
The Big-Vul data set was collected from 348 open-source Github projects from
2002 to 2019. It consists of 188,636 C/C++ source code functions spanning 91
different vulnerability types.

In the scope of our paper, we focus on conducting our experiments on the top
five popular (CWE) vulnerability types [Bigdata2020] including CWE-119
(Improper Restriction of Operations within the Bounds of a Memory Buffer with
$26,497$ source code functions), CWE-20 (Improper Input Validation with
$20,501$ source code functions), CWE-125 (Out-of-bounds Read with $7,717$
source code functions), CWE-200 (Exposure of Sensitive Information to an
Unauthorized Actor with $8,636$ source code functions), and CWE-264
(Permissions, Privileges, and Access Controls with $12,487$ source code
functions). Please refer to the appendix, Section 6.1, for the details of the
data processing and embedding.

####  4.1.2 Baseline methods

The main baselines of our proposed LEO method are some effective and state-of-
the-art methods for out-of-distribution detection including Standard DNN
[Hendrycks2017dnn], Outlier Exposure [Hendrycks18], and SSD [Sehwag21]. These
methods were originally applied to computer vision data applications. To make
these methods able to be applied to the source code data, we keep the
principles and make some modifications on the network for data representation
learning as used in our method. There are other methods, e.g., [Hendrycks2019,
Winkens2020, Tack2020], recently introduced for out-of-distribution detection.
However, these methods were operated based on the nature of the vision data,
so they are not applicable to the source code data.

Other additional baselines of our LEO method are some state-of-the-art methods
for software vulnerability detection (SVD) including VulDeePecker
[VulDeePecker2018], CodeBERT [CodeBERT2020], and ReGVD [ReGVD2022]. We
investigate how these effective SVD methods perform for out-of-distribution
vulnerability detection.

We briefly summarize the baselines as follows:

  * •

Standard DNN [Hendrycks2017dnn]. It is a baseline utilizing probabilities from
softmax distributions for detecting misclassified and out-of-distribution
examples in neural networks.

  * •

Outlier Exposure [Hendrycks18]. It is used for enabling out-of-distribution
(anomaly) detectors to generalize and detect unseen anomalies by training
anomaly detectors against an auxiliary dataset of outliers disjoint from the
testing dataset (i.e., out-of-distribution data).

  * •

SSD [Sehwag21]. An outlier detector method utilizes contrastive representation
learning followed by a Mahalanobis distance-based detection in the feature
space for outlier (out-of-distribution) detection.

  * •

VulDeePecker [VulDeePecker2018]. It is one of the most effective deep
learning-based software vulnerability detection methods leveraging the power
of bi-directional long-short-term memory (LSTM) networks [hochreiter1997long-
short].

  * •

CodeBERT [CodeBERT2020]. A pre-trained model (based on the Transformer’s
encoder framework [transformers-Vaswani17]) specializes in the programming
language. Via CodeBERT, we aim to investigate how large language models work
in the context of out-of-distribution vulnerability detection.

  * •

ReGVD [ReGVD2022]. It is an effective Graph neural network-based model (i.e.,
using Graph convolutional networks [GCNN2017] and Gated graph neural networks
[Gated2016]) for the software vulnerability detection problem.

Please refer to the appendix, Section 6.2, for the details of the model’s
configurations of our LEO method and baselines.

####  4.1.3 Measures

To measure the performance of our LEO method and baselines, we use three main
metrics, i.e., FPR (at TPR 95%), AUROC, and AUPR, used in almost all of the
out-of-distribution detection methods, notably [Hendrycks18, Sehwag21]. In
particular, the FPR (at TPR 95%) metric calculates how many percent of out-of-
distribution data are predicted as in-distribution data. For the FPR measure,
the smaller value is better.

The AUROC (the area under the receiver operating characteristic) metric
presents the model’s ability to discriminate between the in-distribution and
out-of-distribution data while the AUPR (the area under the precision-recall
curve) metric measures if the model can find all out-of-distribution data
without accidentally marking any in-distribution data as out-of-distribution
data. For the AUROC and AUPR measures, the higher value is better.

The source code and data samples for reproducing the experiments of our LEO
method are published at https://anonymous.4open.science/r/LEO/.

###  4.2 Experimental results

RQ1: Can our method successfully detect out-of-distribution source code
vulnerabilities? How effective is it compared to baselines?

##### Approach

We compare the performance of our LEO method with the baselines including
Standard DNN [Hendrycks2017dnn], Outlier Exposure [Hendrycks18], SSD
[Sehwag21], VulDeePecker [VulDeePecker2018], CodeBERT [CodeBERT2020], and
ReGVD [ReGVD2022] in the task of out-of-distribution vulnerability detection
using FPR (at TPR 95%), AUROC, and AUPR measures.

As mentioned, we conduct our experiments on the top five popular (CWE)
vulnerability types including CWE-119 (Improper Restriction of Operations
within the Bounds of a Memory Buffer), CWE-20 (Improper Input Validation),
CWE-125 (Out-of-bounds Read), CWE-200 (Exposure of Sensitive Information to an
Unauthorized Actor), and CWE-264 (Permissions, Privileges, and Access
Controls).

ID and OOD | Methods |  FPR $\downarrow$ |  AUROC $\uparrow$ |  AUPR $\uparrow$
---|---|---|---|---
CWE20 vs. CWE119 | Standard DNN | 86.15% | 82.78% | 58.66%
Outlier Exposure | 83.49% | 84.02% | 61.16%
SSD | 87.50% | 86.89% | 63.45%
VulDeePecker | 34.95% | 85.23% | 82.07%
CodeBERT | 89.08% | 46.34% | 37.46%
ReGVD | 93.35% | 59.07% | 39.78%
LEO (Ours) | 0.00% | 99.89% | 99.28%
| ($\downarrow$ 34.95%) | ($\uparrow$ 13%) | ($\uparrow$ 17.21%)
CWE20 vs. CWE125 | Standard DNN | 82.62% | 84.88% | 30.01%
Outlier Exposure | 81.25% | 85.39% | 31.87%
SSD | 85.35% | 88.33% | 34.83%
VulDeePecker | 77.34% | 92.16% | 43.42%
CodeBERT | 86.23% | 46.55% | 17.67%
ReGVD | 78.39% | 78.49% | 28.27%
LEO (Ours) | 0.00% | 99.93% | 98.81%
| ($\downarrow$ 77.34%) | ($\uparrow$ 7.77%) | ($\uparrow$ 55.39%)
CWE264 vs. CWE200 | Standard DNN | 85.16% | 75.76% | 29.20%
Outlier Exposure | 79.95% | 85.93% | 39.58%
SSD | 87.76% | 85.22% | 34.04%
VulDeePecker | 1.04% | 98.39% | 85.52%
CodeBERT | 9.94% | 95.89% | 93.42%
ReGVD | 84.47% | 77.32% | 33.64%
LEO (Ours) | 0.00% | 99.84% | 98.33%
| ($\downarrow$ 1.04%) | ($\uparrow$ 1.45%) | ($\uparrow$ 4.91%)
CWE119 vs. CWE264 | Standard DNN | 83.07% | 77.69% | 16.54%
Outlier Exposure | 87.50% | 77.98% | 15.21%
SSD | 85.68% | 84.24% | 20.56%
VulDeePecker | 95.83% | 63.35% | 9.39%
CodeBERT | 91.75% | 74.06% | 15.51%
ReGVD | 88.66% | 66.60% | 14.11%
LEO (Ours) | 0.00% | 98.62% | 75.18%
| ($\downarrow$ 83.07%) | ($\uparrow$ 14.38%) | ($\uparrow$ 54.62%)
CWE119 vs. CWE125 | Standard DNN | 89.06% | 82.08% | 21.41%
Outlier Exposure | 84.18% | 83.40% | 23.37%
SSD | 87.50% | 83.94% | 23.73%
VulDeePecker | 96.09% | 67.96% | 13.23%
CodeBERT | 93.12% | 74.18% | 18.47%
ReGVD | 76.29% | 73.37% | 23.46%
LEO (Ours) | 0.00% | 99.96% | 99.12%
| ($\downarrow$ 76.29%) | ($\uparrow$ 16.02%) | ($\uparrow$ 75.39%)
CWE200 vs. CWE20 | Standard DNN | 93.16% | 69.00% | 48.74%
Outlier Exposure | 88.96% | 77.53% | 56.97%
SSD | 88.77% | 79.21% | 59.17%
VulDeePecker | 39.06% | 89.05% | 86.40%
CodeBERT | 43.73% | 80.58% | 81.04%
ReGVD | 90.21% | 73.46% | 57.68%
LEO (Ours) | 0.00% | 99.33% | 98.08%
| ($\downarrow$ 39.06%) | ($\uparrow$ 10.28%) | ($\uparrow$ 11.68%)

Table 1: The results of our LEO method and baselines for the FPR (at TPR 95%),
AUROC, and AUPR measures on the vulnerable source code of each out-of-
distribution (OOD) vulnerability corresponding with specific in-distribution
(ID) data. (The best results are in bold while the second highest results are
in underline. The numbers highlighted in blue color are the improvements of
our method over the second-best values from the baselines.)

In the training phase, we alternatively use each CWE vulnerability type as in-
distribution data to train our LEO method and the baselines. In the inference
(testing) phase, for each trained model on a specific in-distribution CWE
vulnerability type, we use the remaining CWE vulnerability types as out-of-
distribution data to evaluate the model’s performance for out-of-distribution
vulnerability detection. For example, we train each model using the CWE-119
vulnerability type as in-distribution data. In the inference (testing) phase,
we use other CWE vulnerability types (CWE-20, CWE-200, CWE-125, and CWE-264)
as out-of-distribution data to evaluate the model performance. We then do the
same process for other CWE vulnerability types. It is worth noting that in the
training phase, we do not know and do not use any information from out-of-
distribution vulnerability source code data. We only use out-of-distribution
vulnerability data in the inference process for evaluating the models’
performance.

##### Quantitative results

The experimental results in Table 1 show the superiority of our proposed LEO
method over the baseline approaches. In particular, our method obtains much
higher performances in all of the used measures including FPR, AUROC, and AUPR
with a high margin for almost all cases of the in-distribution data and out-
of-distribution vulnerability source code data. Our LEO method is strongly
effective for detecting out-of-distribution source code vulnerabilities with
nearly 0% for the FPR measure and over 90% for both the AUROC and AUPR
measures in almost all cases of the in-distribution and out-of-distribution
data. Especially, in some cases of the in-distribution and out-of-distribution
data pairs, our LEO method achieves nearly 100% for both the AUROC and AUPR
measures.

In general, to the FPR measure, our method achieves significantly higher
performances than the baselines from around 1% to 83.1% while to the AUROC and
AUPR measures, our method obtains higher performances from around (1.5% to
16%) and (4.9% to 75.4%), respectively, compared to the baseline approaches
across the used in-distribution data and out-of-distribution source code
vulnerabilities.

##### Qualitative results

To further demonstrate the advancement and effectiveness of our LEO method for
OOD vulnerability detection, we visualize the representations of both in-
distribution and out-of-distribution data in the feature space. This
visualization helps us investigate whether our method can successfully learn
the characteristics and leverage the semantic relationships inside and between
source code data. It is crucial for our method to effectively distinguish
between in-distribution and out-of-distribution data samples, facilitating the
OOD vulnerability detection process.

We use a t-SNE [tSNE2008] projection, with perplexity equal to $60$, to
visualize the distributions of the in-distribution and out-of-distribution
data in the feature space. As illustrated in Figure 5, it becomes apparent
that our LEO method significantly enhances the separation of the distributions
between in-distribution and out-of-distribution data in the latent space,
compared to the baselines. These visual representations provide compelling
evidence of the robustness of our LEO method in boosting the source code data
representation learning facilitating the detection of out-of-distribution
vulnerabilities. This also highlights our method’s ability to identify hidden
vulnerability patterns in both in-distribution and out-of-distribution
vulnerable source code data, facilitating their differentiation in the feature
space for enhancing out-of-distribution vulnerability detection.

Figure 5: A 2D t-SNE projection for the data representation distribution of
the in-distribution data (blue color) and the out-of-distribution vulnerable
data (red color) in the latent space (i.e., where CWE20 and CWE125 are used as
in-distribution data and out-of-distribution data, respectively) of our
proposed LEO method and the baselines.

In conclusion for RQ1: The quantitative results in Table 1 on three main
measures (i.e., FPR (at TPR 95%), AUROC, and AUPR) and the qualitative
visualizations depicted in Figure 5 show the effectiveness and advancement of
our LEO method in achieving significantly higher performances for out-of-
distribution source code vulnerability detection over the baselines. In short,
our method achieves higher performances than the baselines from around (1% to
83.1%), (1.5% to 16%), and (4.9% to 75.4%) to the FPR (at TPR 95%), AUROC and
AUPR measures, respectively, on the used in-distribution and out-of-
distribution vulnerabilities.

Please refer to the appendix, Section 6.4, for the experimental results of our
proposed LEO method and baselines on some other pairs of the in-distribution
and out-of-distribution source code vulnerabilities in the top five popular
(CWE) vulnerability types (i.e., CWE-119, CWE-20, CWE-125, CWE-200, and
CWE-264).

RQ2: How does our method perform in different cases of the in-distribution
data when the in-distribution data consists of more than one different type of
vulnerability?

ID and OOD | Methods |  FPR $\downarrow$ |  AUROC $\uparrow$ |  AUPR $\uparrow$
---|---|---|---|---
| Standard DNN | 92.97% | 75.84% | 37.33%
Outlier Exposure | 87.55% | 82.12% | 45.63%
CWE20-264 | SSD | 90.89% | 84.99% | 47.47%
vs. CWE119 | VulDeePecker | 3.70% | 96.01% | 84.14%
| CodeBERT | 93.30% | 54.48% | 28.38%
| ReGVD | 68.50% | 86.58% | 42.45%
| LEO (Ours) | 0.00% | 99.76% | 98.28%
| ($\downarrow$ 3.70%) | ($\uparrow$ 3.75%) | ($\uparrow$ 14.14%)
| Standard DNN | 93.26% | 64.11% | 17.91%
Outlier Exposure | 91.02% | 73.75% | 22.57%
CWE119-125 | SSD | 62.40% | 61.79% | 47.13%
vs. CWE20 | VulDeePecker | 30.76% | 84.38% | 49.47%
| CodeBERT | 91.22% | 51.69% | 19.92%
| ReGVD | 90.30% | 70.07% | 21.02%
| LEO (Ours) | 0.00% | 99.97% | 99.66%
| ($\downarrow$ 30.76%) | ($\uparrow$ 15.59%) | ($\uparrow$ 50.19%)
| Standard DNN | 89.84% | 78.55% | 23.44%
Outlier Exposure | 83.59% | 86.94% | 31.12%
CWE200-264 | SSD | 52.34% | 72.17% | 56.15%
vs. CWE125 | VulDeePecker | 0.2% | 99.78% | 98.86%
| CodeBERT | 4.97% | 97.52% | 96.02%
| ReGVD | 75.00% | 83.86% | 31.86%
| LEO (Ours) | 0.00% | 99.93% | 99.03%
| ($\downarrow$ 0.2%) | ($\uparrow$ 0.15%) | ($\uparrow$ 0.17%)
| Standard DNN | 92.71% | 66.35% | 16.05%
Outlier Exposure | 92.71% | 76.14% | 19.77%
CWE200-125 | SSD | 88.54% | 74.30% | 20.41%
vs. CWE264 | VulDeePecker | 79.43% | 67.67% | 22.01%
| CodeBERT | 17.53% | 92.91% | 87.71%
| ReGVD | 90.53% | 60.49% | 18.21%
| LEO (Ours) | 0.78% | 99.47% | 92.85%
| ($\downarrow$ 16.75%) | ($\uparrow$ 6.56%) | ($\uparrow$ 5.14%)
| Standard DNN | 82.03% | 88.01% | 12.33%
Outlier Exposure | 83.85% | 82.56% | 9.25%
CWE119-20-264 | SSD | 86.46% | 77.02% | 7.37%
vs. CWE200 | VulDeePecker | 90.10% | 42.56% | 3.03%
| CodeBERT | 90.48% | 48.26% | 18.37%
| ReGVD | 89.26% | 69.80% | 7.92%
| LEO (Ours) | 0.26% | 99.75% | 92.44%
| ($\downarrow$ 81.77%) | ($\uparrow$ 11.74%) | ($\uparrow$ 74.07%)

Table 2: The results of our LEO method and baselines for the FPR (at TPR 95%),
AUROC, and AUPR measures on the vulnerable source code of each out-of-
distribution (OOD) vulnerability corresponding with specific in-distribution
(ID) data. (The best results are in bold while the second highest results are
in underline. The numbers highlighted in blue color are the improvements of
our method over the second-best values from the baselines.)

##### Approach

This research question reflects different reality cases where in-distribution
source code data can consist of more than one (presented in Table 1) type of
vulnerability. Therefore, we further investigate our proposed LEO method’s
performance in cases of different vulnerability types existing in the in-
distribution data and observe how the model performs compared to the
baselines.

For this experiment, without loss of generality, we assume that there are two
and three different vulnerability types existing in the in-distribution data.
When the in-distribution data has two different types of vulnerability, we
conduct four cases where we assume the in-distribution data is formed by
(CWE20 and CWE264), (CWE119 and CWE125), (CWE200 and CWE264), and (CWE200 and
CWE125). When the in-distribution data has three different vulnerability
types, we assume the in-distribution data is formed by (CWE119, CWE20, and
CWE264).

For these combinations, we simply randomly choose different CWE types (from
the top five popular CWE types) to form the in-distribution data. For each
case of the in-distribution data after the training process, in the inference
phase, we use the remaining CWE vulnerability types as out-of-distribution
data to evaluate the model’s performance for out-of-distribution vulnerability
detection.

##### Results

The experimental results in Table 2 again prove the effectiveness and
superiority of our LEO method compared to the baselines for out-of-
distribution vulnerability detection in all various cases of the in-
distribution data. Particularly, in the cases when there is more than one
vulnerability type existing in the in-distribution data (e.g., two and three
different vulnerability types), our LEO method still obtains much higher
performances on almost pairs of the in-distribution and out-of-distribution
for the used measures. Except for the case of the in-distribution data (CWE200
and CWE264) and the out-of-distribution data (CWE125), the second highest
baseline (i.e., VulDeepecker) obtains a performance close to our LEO method,
in all other cases of the in-distribution and out-of-distribution data, our
LEO method gains around (3.7% to 81.8%), (3.8% to 15.6%), and (5.1% to 74.1%)
higher than the baselines on the FPR (at TPR 95%), AUROC, and AUPR measures,
respectively.

In conclusion for RQ2: The experimental results in Table 2 on the FPR (at TPR
95%), AUROC, and AUPR measures again show the superiority of our proposed LEO
method over the baselines for out-of-distribution vulnerability detection on
different cases regarding the various number of vulnerability types existing
in the in-distribution data. In accordance with the results shown in Table 1,
our LEO method still demonstrates its noticeable advancement with much higher
performances compared to the baselines on the used measures in almost all
cases of the in-distribution and out-of-distribution vulnerabilities.

In Figure 6, we present the average values of the FPR, AUROC, and AUPR
measures, respectively, for our LEO method and baselines in all cases of the
in-distribution and out-of-distribution vulnerabilities mentioned in Tables 1
and 2. These average results highlight the dramatic advancement of our LEO
method compared to the baselines. In short, our LEO method obtains a
significantly higher performance around (49% to 88.3%), (18.4% to 30.4%),
(43.2% to 67.9%) in the FPR, AUROC, and AUPR measures, respectively, in
comparison with the baselines.

Figure 6: The average results for the FPR, AUROC, and AUPR measures,
respectively, of our LEO method and baselines in all cases of the in-
distribution and out-of-distribution vulnerabilities mentioned in Tables 1 and
2. Note that for the FPR measure, the smaller value is better while for the
AUROC, and AUPR measures, the higher value is better.

RQ3: Do the cluster-contrastive learning and the data-distribution mechanism
help improve the code data representation learning for boosting the model
performance of out-of-distribution vulnerability detection?

##### Approach

We compare the performance of our LEO method to itself in the cases of using
and without using cluster-contrastive learning mentioned in Eq. (6) and the
data-distribution mechanism described in Eq. (5) to investigate if these
additional terms successfully boosting the source code data representation
learning facilitating the out-of-distribution source code vulnerability
detection. We conduct the experiment on some random pairs of the in-
distribution and out-of-distribution vulnerability types as shown in Table 3.
Note that in the case without using cluster-contrastive learning and data-
distribution mechanism terms, we denote the method as LEO-w/oCD.

##### Results

ID and OOD | Methods |  FPR $\downarrow$ |  AUROC $\uparrow$ |  AUPR $\uparrow$
---|---|---|---|---
|  LEO-woCD | 0.00% | 98.55% | 75.44%
CWE119 vs. CWE200 | LEO | 0.00% | 99.85% | 95.64%
|  | ($\uparrow$ 1.3%) | ($\uparrow$ 20.2%)
|  LEO-w/oCD | 18.70% | 92.45% | 84.79%
CWE20 vs. CWE119 | LEO | 0.00% | 99.89% | 99.28%
| ($\downarrow$ 18.70%) | ($\uparrow$ 7.44%) | ($\uparrow$ 14.49%)
|  LEO-w/oCD | 3.32% | 97.48% | 86.70%
CWE20 vs. CWE125 | LEO | 0.00% | 99.93% | 98.81%
| ($\downarrow$ 3.32%) | ($\uparrow$ 2.45%) | ($\uparrow$ 12.11%)
|  LEO-w/oCD | 17.45% | 94.80% | 83.00%
CWE264 vs. CWE200 | LEO | 0.00% | 99.84% | 98.33%
| ($\downarrow$ 17.45%) | ($\uparrow$ 5.04%) | ($\uparrow$ 15.33%)
|  LEO-w/oCD | 1.15% | 97.67% | 95.93%
CWE200 vs. CWE119 | LEO | 0.00% | 99.39% | 99.05%
| ($\downarrow$ 1.15%) | ($\uparrow$ 1.72%) | ($\uparrow$ 3.12%)
CWE200-125 |  LEO-w/oCD | 9.38% | 96.78% | 64.54%
LEO | 0.78% | 99.47% | 92.85%
vs. CWE264 | ($\downarrow$ 8.6%) | ($\uparrow$ 2.69%) | ($\uparrow$ 28.31%)

Table 3: The results of our method for the FPR (at TPR 95%), AUROC, and AUPR
measures on the vulnerable source code of each OOD vulnerability corresponding
with specific in-distribution (ID) data when using and without using the
cluster-contrastive learning and the data-distribution mechanism. (The higher
results for each measure in each pair of the ID and OOD data are in bold. The
numbers highlighted in the blue color are the improvements of LEO over
LEO-w/oCD.)

The experimental results in Table 3 show the effectiveness of cluster-
contrastive learning and the data-distribution mechanism in improving the
source code data representation learning process to boost the model
performance for out-of-distribution source code vulnerability detection. In
particular, our method with the cluster-contrastive learning and data-
distribution mechanism terms (LEO) obtained considerably higher performances
than itself without using these terms (denoted as LEO-w/oCD) on almost all of
the used measures and the cases of the in-distribution and out-of-distribution
vulnerabilities.

For the FPR measure, LEO obtains around 1.2% to 18.7% higher performances
compared to LEO-w/oCD, except for the case of (CWE119 vs. CWE200) where
LEO-w/oCD also obtains 0% for the FPR measure. For the AUROC and AUPR
measures, in all cases of the in-distribution and out-of-distribution data
mentioned in Table 3, LEO achieves around (1.3% to 7.4%) and (3.1% to 28.3%)
higher compared to LEO-w/oCD, respectively.

In conclusion for RQ3: The experimental results mentioned in Table 3 on the
FPR (at TPR 95%), AUROC, and AUPR measures show the benefits of using cluster-
contrastive learning (leveraging source code characteristics and semantic
vulnerability pattern relationships) and the data-distribution mechanism for
boosting source code data representation learning. These terms help
significantly improve the model performance for out-of-distribution
vulnerability detection compared to the case without using these terms on all
the used measures in almost all cases of the in-distribution and out-of-
distribution vulnerabilities.

The average experimental results of the FPR, AUROC, and AUPR measures,
respectively, for the LEO and LEO-w/oCD methods in all cases of the in-
distribution and out-of-distribution vulnerabilities mentioned in Tables 3 are
shown at Figure 7. These values show a significant advancement of LEO over
LEO-w/oCD in all the used metrics, especially for the FPR and AUPR measures.

Figure 7: The average results for the FPR (at TPR 95%), AUROC, and AUPR
measures, respectively, of LEO-w/oCD and LEO in all cases of the in-
distribution and out-of-distribution vulnerabilities mentioned in Table 3.

Please refer to the appendix, Section 6.3, for our discussions about the
threats to the validity of our proposed LEO method and corresponding
mitigation.

##  5 Conclusion

In this paper, we have successfully proposed an innovative deep learning-based
approach for out-of-distribution source code vulnerability detection. Our LEO
method derived from information theory, combined with the use of innovative
cluster-contrastive learning and the data-distribution mechanism, has
effectively learned the source code characteristics and figured out the
semantic relationships between source code data samples (i.e., functions or
programs) to boost the data representation learning facilitating the OOD
vulnerability detection. The extensive experimental results on the top five
popular real-world source code vulnerabilities demonstrate the effectiveness
and advancement of our LEO method compared to the state-of-the-art baselines
by a wide margin.

##  6 Appendix

###  6.1 Data processing and embedding

We preprocessed the datasets before injecting them into deep neural networks.
In particular, we standardized the source code by (i) removing comments, blank
lines, and non-ASCII characters, and (ii) mapping user-defined variables to
symbolic variable names (e.g., _var1_ and _var2_) and user-defined functions
to symbolic function names (e.g., _func1_ and _func2_) using Treesitter
[Treesitter]. We also replaced strings with a generic _"str"_ token.

We then embedded source code statements into vectors. For instance, consider
the following statement (C/C++ programming language) _"for(var1=0;var1
<10;var1++)"_, we use the byte pair encoding (BPE) algorithm
[sennrich2016neural] (i.e., commonly used in large language models, e.g.,
CodeBERT [CodeBERT2020] for tokenization) to tokenize this statement into a
sequence of tokens, and then we used a 150-dimensional token Embedding layer
followed by a Dropout layer with a dropped fixed probability $p=0.2$ and (a 1D
convolutional layer with the filter size $150$ and kernel size $3$, and a 1D
max pooling layer) or (a 1D max pooling layer) to encode each statement in a
function $F$. Finally, a mini-batch of functions in which each function
consisting of $L$ encoded statements was fed to the deep learning-based
models. Note that the Embedding and convolutional layers are learnable during
the training process.

It is worth noting that the length ($L$) of each function is padded or
truncated to $100$ source code statements. We chose these values based on the
fact that for the used dataset, over 95% of the source code functions, have
the number of code statements less than or equal to $100$. Furthermore, almost
all important information relevant to the vulnerability of each source code
function lies in the first $100$ code statements.

###  6.2 Model’s configurations

For the main baselines of our LEO method including Standard DNN
[Hendrycks2017dnn], Outlier Exposure [Hendrycks18], and SSD [Sehwag21]. These
methods are popular and state-of-the-art approaches for out-of-distribution
detection applied in the computer vision domain. To make them applicable for
out-of-distribution source code vulnerability detection, we keep the principle
of these methods and use the same data embedding process for handling the
sequential source code data as used in our method. For the popular and state-
of-the-art baselines (i.e., VulDeePecker [VulDeePecker2018], CodeBERT
[CodeBERT2020], and ReGVD [ReGVD2022]) in the software vulnerability detection
problem, we use the architecture proposed in the corresponding original
papers.

To our LEO method, for the $g\left(\cdot;\alpha\right)$ and
$f\left(\cdot;\beta\right)$ networks, we used deep feed-forward neural
networks having three and two hidden layers with the size of each hidden layer
in $\left\\{100,300\right\\}$. The dense hidden layers are followed by a ReLU
function as nonlinearity and Dropout [srivastava14a] with a retained fixed
probability $p=0.8$ as regularization. The last dense layer of the
$g\left(\cdot;\alpha\right)$ network for learning a discrete distribution is
followed by a sigmoid function while the last dense layer of the
$f\left(\cdot;\beta\right)$ network is followed by a softmax function for
predicting. The number of chosen clusters guiding the computation of the
innovative cluster-contrastive learning mentioned is from $2$ to $5$ in the
case of the distribution data consisting of one vulnerability type. When the
in-distribution data consists of more than one vulnerability type, the number
of vulnerability patterns used in cluster-contrastive learning also needs to
be increased. In the cases of two or more two vulnerability types (i.e.,
three), we vary and tune the number of clusters in the range of $2$ to $15$.
The trade-off hyper-parameter $\lambda$ representing the weight of the
innovative cluster-contrastive learning is in $\\{10^{-2},10^{-1},10^{0}\\}$
while the scalar temperature $\tau$ is in $\\{0.5,1.0\\}$. The temperature
$\nu$ for the Gumbel softmax distribution is also set in $\\{0.5,1.0\\}$.

For our LEO method and baselines, we employed the Adam optimizer [KingmaB14]
with an initial learning rate equal to $10^{-3}$, while the mini-batch size is
set to $128$. For the training process, we split the data of each in-
distribution data set into two random partitions. The first partition contains
80% for training, the second partition contains 20% for validation. For each
in-distribution data set, we used $10$ epochs for the training process. We
additionally applied gradient clipping regularization to prevent over-fitting.
For each method, we ran the corresponding model several times and reported the
averaged FPR (at TPR 95%), AUROC, and AUPR measures. We ran our experiments in
Python using Tensorflow [abadi2016tensorflow] for the used methods on a 13th
Gen Intel(R) Core(TM) i9-13900KF having 24 CPU Cores at 3.00 GHz with 32GB
RAM, integrated Gigabyte RTX 4090 Gaming OC 24GB. Some baseline methods (i.e.,
CodeBERT [CodeBERT2020] and ReGVD [ReGVD2022]) were written using Pytorch
[pytorch2019]. For these baselines, we followed the source code samples
published by the authors.

###  6.3 Discussion of Threats to Validity

##### Construct Validity

Key construct validity threats are if our assessments of the proposed method
and baselines demonstrate their capability for out-of-distribution source code
vulnerability detection. In the cyber security domain, by doing out-of-
distribution vulnerability detection, we help security analysts and software
engineers detect potential unknown vulnerability types coming in order to
harden the security computer systems. To evaluate the performance of our
method and baselines, we use three main common measures used in out-of-
distribution detection including FPR (at TPR 95%), AUROC, and AUPR.

##### Internal Validity

Key internal validity threats are relevant to the choice of hyper-parameter
settings (i.e., optimizer, learning rate, number of layers in deep neural
networks, etc.). It is worth noting that finding a set of optimal
hyperparameter settings of deep neural networks is expensive due to a large
number of trainable parameters. To train our method, we only use the common or
default values for the hyper-parameters such as using Adam optimizer, the
learning rate equals $10^{-3}$, while the scalar temperature $\tau$ used in
the cluster-contrastive learning and the temperature $\nu$ for the Gumbel
softmax distribution are set in $\\{0.5,1.0\\}$. For the number of clusters
used in cluster-contrastive learning aiming to improve the data representation
learning process, we use it as a hyperparameter. In our paper, we detail the
hyperparameter settings (i.e., the value-tuned ranges of the hyperparameters)
in the released reproducible source code to support future replication
studies.

##### External Validity

Key external validity threats include whether our proposed LEO method will
generalize to other source code vulnerability types and whether they will work
on other types of vulnerability datasets. We mitigated this problem by
conducting our experiments on the top five popular (CWE) vulnerability types
as mentioned in [Bigdata2020] including CWE-119 (Improper Restriction of
Operations within the Bounds of a Memory Buffer), CWE-20 (Improper Input
Validation), CWE-125 (Out-of-bounds Read), CWE-200 (Exposure of Sensitive
Information to an Unauthorized Actor), and CWE-264 (Permissions, Privileges,
and Access Controls).

###  6.4 Additional experiments

Here we present some additional experiments of our LEO method and baselines on
other further cases of the in-distribution and out-of-distribution source code
vulnerability data. The experimental results in Table 4 again show the
effectiveness and superiority of our proposed LEO method compared to the
baselines for out-of-distribution software vulnerability detection by a wide
margin. Notably, in these additional cases, our method obtains around (10% to
95%), (4% to 53%), and (3.6% to 89%) higher performances on the FPR (at TPR
95%), AUROC, and AUPR measures, respectively, compared to the baselines.

ID and OOD | Methods |  FPR $\downarrow$ |  AUROC $\uparrow$ |  AUPR $\uparrow$
---|---|---|---|---
CWE20 vs. CWE264 | Standard DNN | 89.58% | 76.48% | 17.40%
Outlier Exposure | 91.93% | 78.86% | 18.00%
SSD | 88.28% | 86.27% | 26.44%
VulDeePecker | 72.14% | 92.33% | 37.41%
CodeBERT | 90.31% | 48.86% | 13.21%
ReGVD | 91.13% | 63.96% | 15.80%
LEO (Ours) | 0.00% | 99.63% | 92.77%
| ($\downarrow$ 72.14%) | ($\uparrow$ 7.3%) | ($\uparrow$ 55.36%)
CWE200 vs. CWE119 | Standard DNN | 88.02% | 77.84% | 71.74%
Outlier Exposure | 84.79% | 82.74% | 76.94%
SSD | 88.23% | 80.88% | 74.28%
VulDeePecker | 24.58% | 94.60% | 95.49%
CodeBERT | 58.16% | 72.91% | 80.98%
ReGVD | 95.58% | 55.13% | 56.73%
LEO (Ours) | 0.00% | 99.32% | 99.05%
| ($\downarrow$ 24.58%) | ($\uparrow$ 4.72%) | ($\uparrow$ 3.56%)
CWE200 vs. CWE264 | Standard DNN | 93.49% | 67.11% | 25.40%
Outlier Exposure | 91.67% | 75.52% | 31.59%
SSD | 87.24% | 80.50% | 37.54%
VulDeePecker | 65.36% | 74.24% | 53.21%
CodeBERT | 60.00% | 70.74% | 57.74%
ReGVD | 95.46% | 54.03% | 23.88%
LEO (Ours) | 0.00% | 99.91% | 99.26%
| ($\downarrow$ 60.00%) | ($\uparrow$ 19.41%) | ($\uparrow$ 41.52%)
CWE264 vs. CWE20 | Standard DNN | 91.80% | 62.03% | 38.20%
Outlier Exposure | 83.50% | 72.09% | 48.95%
SSD | 85.84% | 82.97% | 59.62%
VulDeePecker | 52.34% | 90.88% | 74.79%
CodeBERT | 10.06% | 95.57% | 95.31%
ReGVD | 90.12% | 68.36% | 43.88%
LEO (Ours) | 0.00% | 99.82% | 99.32%
| ($\downarrow$ 10.06%) | ($\uparrow$ 4.25%) | ($\uparrow$ 4.01%)
| Standard DNN | 80.08% | 90.47% | 18.27%
Outlier Exposure | 86.52% | 85.44% | 12.84%
CWE119-20-264 | SSD | 94.34% | 79.86% | 9.32%
vs. CWE125 | VulDeePecker | 54.69% | 88.76% | 33.41%
| CodeBERT | 90.06% | 47.02% | 19.17%
| ReGVD | 87.02% | 69.85% | 8.35%
| LEO (Ours) | 0.00% | 99.93% | 97.06%
| ($\downarrow$ 54.69%) | ($\uparrow$ 9.46%) | ($\uparrow$ 63.65%)

Table 4: The results of our LEO method and baselines for the FPR (at TPR 95%),
AUROC, and AUPR measures on the vulnerable source code samples of each out-of-
distribution data with the corresponding used in-distribution data. (The best
results are in bold while the second highest results are in underline. The
numbers highlighted in blue color are the improvements of our method LEO over
the second-best values from the baselines.)

###  6.5 Related backgrounds

In this section, we briefly present the main related backgrounds used in our
proposed LEO and the baseline methods.

####  6.5.1 Recurrent neural networks

Recurrent neural networks (RNNs) [Rumelhart-RNN86], a class of deep neural
networks (DNNs), are specialized for sequential data (e.g., time series,
sentences, documents, or audio samples). RNNs are extremely useful for natural
language processing (NLP) systems [ChoMBB14, sutskever2014sequence] such as
automatic translation, speech-to-text, and sentiment analysis. Leveraging the
idea of sharing parameters across different parts of a model, an RNN can
extend and apply to data of different forms and generalize across them. An RNN
is similar to a DNN, except it has backward connections. A visualization of an
RNN’s architecture is depicted in Figure 8 (the left-hand figure). At each
time step $t$, the state of a recurrent neuron (i.e., the hidden state denoted
by ${\mathbf{h}}_{t}$) will receive the input vector ${\mathbf{x}}_{t}$ as
well as the state vector from the previous step $t-1$ (i.e.,
${\mathbf{h}}_{t-1}$) to obtain the state vector ${\mathbf{h}}_{t}$.

In particular, we have:

${\mathbf{h}}_{t}=f({\mathbf{h}}_{t-1},{\mathbf{x}}_{t})$

We can unroll the RNN network through time to gain a new visualization as
depicted in Figure 8 (the right-hand figure). Each recurrent neuron has two
relevant input weights. One is for the input vector ${\mathbf{x}}_{t}$, and
the other is for the state vector ${\mathbf{h}}_{t-1}$ of the previous time
step $t-1$. At the time step $t$, if we denote the weight from the input
vector ${\mathbf{x}}_{t}$ to the state ${\mathbf{h}}_{t}$ of the current
recurrent neuron by ${\mathbf{W}}_{xh}$ and the weight from the state
${\mathbf{h}}_{t-1}$ of the previous recurrent neuron to the state
${\mathbf{h}}_{t}$ of the current recurrent neuron by ${\mathbf{W}}_{hh}$, the
state ${\mathbf{h}}_{t}$ of the current recurrent neuron is computed as
follows:

${\mathbf{h}}_{t}=\phi({\mathbf{W}}_{xh}^{\top}{\mathbf{x}}_{t}+{\mathbf{W}}_{hh}^{\top}{\mathbf{h}}_{t-1}+{\mathbf{b}})$

where ${\mathbf{b}}$ is the bias vector and $\phi(.)$ is the activation
function (e.g., the ReLU or Tanh functions).

At the time step $t$, if we denote ${\mathbf{W}}_{hy}$ as the weight from the
state ${\mathbf{h}}_{t}$ of the current recurrent neuron to the corresponding
output denoted by ${\mathbf{y}}_{t}$, the output ${\mathbf{y}}_{t}$ is
computed as follows:

${\mathbf{y}}_{t}=\phi({\mathbf{W}}_{hy}^{\top}{\mathbf{h}}_{t}+{\mathbf{c}})$

where ${\mathbf{c}}$ is the bias vector and $\phi(.)$ is the activation
function (e.g., the softmax function).

Figure 8: An Architecture of a recurrent neural network with the outputs $y$
plus the hidden states $h$ of recurrent neurons.

####  6.5.2 Long short-term memory networks

Long short-term memory (LSTM) networks are a type of RNNs capable of learning
long-term dependencies, first proposed by Hochreiter and Schmidhuber
[hochreiter1997long-short] and gradually improved over the years by other
researches [hasim-lstm-2014, zaremba-lstm-2014]. An LSTM network was
introduced to address the exploding and vanishing gradients problems as well
as the short-term memory problem (i.e., the lost information from some of the
first elements from the corresponding input in the memory cell of a long RNN)
in training RNNs.

The key idea of an LSTM network is about storing long-term memory. An LSTM
network can learn to figure out what information from the inputs should be
read and stored in the long-term state denoted by ${\mathbf{c}}_{t}$ as well
as what information should be thrown out from ${\mathbf{c}}_{t}$. A
visualization of an LSTM network is shown in Figure 9. As depicted, there are
four layers in an LSTM network including the main layer and three additional
layers (i.e., gate controllers), namely, the forget gate, the input gate, and
the output gate.

  * •

The main layer at the time step $t$ aims to analyse the current input vector
${\mathbf{x}}_{t}$ and the previous (short-term) state ${\mathbf{h}}_{t-1}$ to
gain the output ${\mathbf{g}}_{t}$ (i.e., ${\mathbf{h}}_{t}$ in a basic cell
RNN). In an LSTM cell, the layer’s output ${\mathbf{g}}_{t}$ does not go
straight out, but instead goes through a gate controller to decide what parts
are stored in the long-term state (i.e., ${\mathbf{c}}_{t}$).

  * •

Using the logistic activation function, the forget gate ${\mathbf{f}}_{t}$
aims to learn which parts of the long-term state ${\mathbf{c}}_{t}$ should be
erased. The input gate ${\mathbf{i}}_{t}$ aims to control which parts of
${\mathbf{g}}_{t}$ should be added to the long-term state ${\mathbf{c}}_{t}$
while the output gate ${\mathbf{o}}_{t}$ aims to learn which parts of the
long-term state ${\mathbf{c}}_{t}$ should be outputted for both
${\mathbf{h}}_{t}$ and ${\mathbf{y}}_{t}$.

The following equation (i.e., Eq. (7)) summarises the computing process of the
four layers of an LSTM network at the time step $t$:

$\displaystyle{\mathbf{i}}_{t}$
$\displaystyle=\sigma\left({\mathbf{W}}_{xi}^{\top}{\mathbf{x}}_{t}+{\mathbf{W}}_{hi}^{\top}{\mathbf{h}}_{t-1}+{\mathbf{b}}_{i}\right)$
$\displaystyle{\mathbf{f}}_{t}$
$\displaystyle=\sigma\left({\mathbf{W}}_{xf}^{\top}{\mathbf{x}}_{t}+{\mathbf{W}}_{hf}^{\top}{\mathbf{h}}_{t-1}+{\mathbf{b}}_{f}\right)$
$\displaystyle{\mathbf{o}}_{t}$
$\displaystyle=\sigma\left({\mathbf{W}}_{xo}^{\top}{\mathbf{x}}_{t}+{\mathbf{W}}_{ho}^{\top}{\mathbf{h}}_{t-1}+{\mathbf{b}}_{o}\right)$
$\displaystyle{\mathbf{g}}_{t}$
$\displaystyle=\tanh\left({\mathbf{W}}_{xg}^{\top}{\mathbf{x}}_{t}+{\mathbf{W}}_{hg}^{\top}{\mathbf{h}}_{t-1}+{\mathbf{b}}_{g}\right)$
$\displaystyle{\mathbf{c}}_{t}$
$\displaystyle={\mathbf{f}}_{t}\otimes{\mathbf{c}}_{t-1}+{\mathbf{i}}_{t}\otimes{\mathbf{g}}_{t}$
$\displaystyle{\mathbf{y}}_{t}$
$\displaystyle={\mathbf{h}}_{t}={\mathbf{o}}_{t}\otimes\tanh({\mathbf{c}}_{t-1})$
(7)

where ${\mathbf{W}}_{xi}$, ${\mathbf{W}}_{xf}$, ${\mathbf{W}}_{xo}$ and
${\mathbf{W}}_{xg}$ are the weight matrices from the input vector
${\mathbf{x}}_{t}$ to each of the four layers while ${\mathbf{W}}_{hi}$,
${\mathbf{W}}_{hf}$, ${\mathbf{W}}_{ho}$ and ${\mathbf{W}}_{hg}$ are the
weight matrices from the previous short-term state ${\mathbf{h}}_{t-1}$ to
each of the four layers, and ${\mathbf{b}}_{i}$, ${\mathbf{b}}_{f}$,
${\mathbf{b}}_{o}$ and ${\mathbf{b}}_{g}$ are the bias vectors to each of the
four layers, respectively. In general, the output ${\mathbf{y}}_{t}$ can be
different from the short-term state ${\mathbf{h}}_{t}$ (i.e.,
${\mathbf{y}}_{t}=\phi({\mathbf{W}}_{hy}^{\top}{\mathbf{h}}_{t}+{\mathbf{b}}_{y})$)
where ${\mathbf{b}}_{y}$ is the bias vector while ${\mathbf{W}}_{hy}$ is the
weight from ${\mathbf{h}}_{t}$ to ${\mathbf{y}}_{t}$, and $\phi(.)$ is the
activation function (e.g., the softmax function).

Figure 9: An architecture of a long short-term memory (LSTM) network.

####  6.5.3 Convolutional neural networks

Convolutional neural networks (CNNs) [Lecun98gradient-basedlearning] are a
kind of DNNs that are specialized for processing image data. CNNs have
achieved breakthrough performance on many complex visual tasks [alex_2012,
TranBFTP15] such as visual object recognition, self-driving cars, automatic
video classification systems, and more. CNNs also successfully show high
performance on other tasks such as voice recognition and natural language
processing (NLP). In 1998, Lecun et al. [Lecun98gradient-basedlearning]
introduced a typical famous architecture of a CNN named LeNet-5 as depicted in
Figure 10. This architecture shows some common building blocks often used in
CNNs including fully connected layers (i.e., as used in DNNs), convolutional
layers, and pooling layers.

Figure 10: An architecture of LeNet-5 (a convolutional neural network) with
some building blocks including convolutional layers, pooling layers, and fully
connected layers.

Convolutional layers as shown in Figure 10 are the most important part of a
CNN. The neurons in the first convolutional layer are connected to pixels in
small rectangles (i.e., the receptive fields) of the input layer. This
principle is kept for the connection between other layers (e.g., the
connection between the second convolutional layer and the first convolutional
layer). The neurons in the second convolutional layer are also connected to
only some neurons in the first convolutional layer in the receptive fields.
This architecture allows the network to concentrate on small low-level (i.e.,
general) features in some first hidden layers, and then assemble them into
larger higher-level (i.e., specific) features in some next hidden layers. In
reality, a convolutional layer often applies multiple filters (i.e., trainable
filters and each filter outputting one feature map) to gain multiple
corresponding feature maps, making the convolutional layer capable of
detecting multiple features from its inputs.

We can summarise the computational process of convolutional layers by using
Eq. (8) to further demonstrate how to compute the output of a given neuron of
a convolutional layer.

$o_{i,j,k}=b_{k}+\sum_{u=0}^{f_{h}-1}\sum_{v=0}^{f_{w}-1}\sum_{k^{\prime}=0}^{f_{k^{\prime}}-1}o^{\prime}_{i\times
s_{h}+u,j\times s_{w}+v,k^{\prime}}\times w_{u,v,k^{\prime},k}$ (8)

where

  * •

$o_{i,j,k}$ is the output in row $i$ and column $j$ in the feature map $k$ of
convolutional layer $l$.

  * •

$o^{\prime}_{i\times s_{h}+u,j\times s_{w}+v,k^{\prime}}$ is the output in row
$i\times s_{h}+u$ and column $j\times s_{w}+v$ in the feature map $k^{\prime}$
of the previous convolutional layer $l-1$.

  * •

$w_{u,v,k^{\prime},k}$ is the connection weight (i.e., it is updated during
the training process) between any neuron in the feature map $k$ of
convolutional layer $l$ and its inputs in row $u$ and column $v$ of the
corresponding receptive field and feature map $k^{\prime}$ of the previous
convolutional layer $l-1$ while $b_{k}$ is the bias of the feature map $k$ of
convolutional layer $l$.

The next important blocks of a CNN are pooling layers. The main goal of the
pooling layers is to subsample (i.e., shrink) the input convolutional layer in
order to reduce the computational cost. Pooling layers not only reduce memory
usage but also reduce the number of parameters, thus eliminating the risk of
overfitting. Pooling layers have no weights and they only aim to aggregate the
inputs using an aggregation function such as the max or mean. We also need to
define the size, the stride, and the padding type (i.e., zero padding or no
padding) for the pooling layers.

It is worth noting that convolutional neural networks (CNNs) [Lecun98gradient-
basedlearning] were introduced and specialized for processing image data;
However, they have also shown excellent performance when working on sequential
data (e.g., text used in sentiment analysis [Kim14f, ZhangW15b]).

####  6.5.4 Transformers

Transformer models [transformers-Vaswani17, chatgpt] represent groundbreaking
advancements in natural language processing and machine learning. These models
have revolutionized various fields by demonstrating remarkable abilities in
understanding and generating human-like text. Operating on a self-attention
mechanism, transformers are uniquely adept at capturing contextual
relationships in language, making them exceptionally proficient in natural
language processing tasks such as language translation and text generation.

The architecture of a Transformer’s framework is depicted in Figure 11. In
general, a Transformer follows the encoder-decoder structure used in neural
sequence transduction models [SutskeverVL14, Bahdanau15]. The encoder aims to
map an input sequence of token representations
$X=(\mathbf{x}_{1},...,\mathbf{x}_{n})$ to a sequence of continuous
representations $Z=(\mathbf{z}_{1},...,\mathbf{z}_{n})$. Given $Z$, the
decoder then generates an output sequence
$Y=(\mathbf{y}_{1},...,\mathbf{y}_{n})$ of symbols one element at a time. At
each step the model is auto-regressive [Graves13], consuming the previously
generated tokens as additional input when generating the next token.

The encoder and decoder of a Transformer consist of multiple layers including
multi-head attention layers and feed-forward neural networks. The main part of
multi-head attention layers is the scaled dot product attention which is the
core concept behind self-attention. In self-attention, each sequence element
provides a key, value, and query. For each element, we perform an attention
layer where based on its query, we check the similarity of all sequence
elements’ keys and return a different, averaged value vector for each element.

##### Scaled dot product attention

The core concept behind self-attention is the scaled dot product attention
whose goal is to have an attention mechanism with which any element in a
sequence can attend to any other while still being efficient to compute.

The dot product attention takes as input a set of queries $Q\in R^{L\times
d_{k}}$, keys $K\in R^{L\times d_{k}}$, and values $V\in R^{L\times d_{v}}$
where $L$ is the sequence length and $d_{k}$ and $d_{v}$ are the hidden
dimensionality for queries, keys, and values, respectively. The attention
value from element $i$ to $j$ is based on its similarity of the query $Q_{i}$
and key $K_{j}$, using the dot product as the similarity metric. In math, we
calculate the dot product attention as follows:

$Attention(Q,K,V)=softmax(\frac{QK^{T}}{\sqrt{d_{k}}})V$

where ${1}/{\sqrt{d_{k}}}$ is the scaling factor. The matrix multiplication
$QK^{T}$ performs the dot product for every possible pair of queries and keys,
resulting in a matrix of the shape $L\times L$. Each row represents the
attention logits for a specific element to all other elements in the sequence.
On these, we apply a softmax and multiply with the value vector to obtain a
weighted mean (the weights being determined by the attention).

##### Multi-Head Attention

The scaled dot product attention allows a network to attend over a sequence.
However, often there are multiple different aspects a sequence element wants
to attend to, and a single weighted average is not a good option for it. This
is why the authors extend the attention mechanisms to multiple heads, i.e.
multiple different query-key-value triplets on the same features.
Specifically, given a query, key, and value matrix, we transform those into
sub-queries, sub-keys, and sub-values, which we pass through the scaled dot
product attention independently. Afterward, we concatenate the heads and
combine them with a final weight matrix. Mathematically, we can express this
operation as:

$\displaystyle Multihead(Q,K,V)$
$\displaystyle=Concat(head_{1},...,head_{d})W^{O}$ $\displaystyle
where\,\,head_{i}$ $\displaystyle=Attention(QW_{i}^{Q},KW_{i}^{K},VW_{i}^{V})$

In this multi-head attention computational process, $W_{1...h}^{Q}\in
R^{D\times d_{k}}$, $W_{1...h}^{K}\in R^{D\times d_{k}}$, $W_{1...h}^{V}\in
R^{D\times d_{v}}$, and $W_{1...h}^{O}\in R^{h.d_{v}\times d_{out}}$ ($D$
being the input dimensionality) are the learnable parameters.

Figure 11: An architecture of the Transformer model [transformers-Vaswani17].

####  6.5.5 Graph neural networks

A Graph Neural Network (GNN) is a powerful deep learning architecture designed
to analyze and process data represented in the form of graphs. GNNs are
specialized in capturing complex relationships and interactions within
interconnected nodes. They operate by propagating information through the
graph’s nodes and edges, allowing them to learn patterns and features from
both local and global contexts. GNNs have found applications in diverse fields
such as social network analysis, recommendation systems, molecular chemistry,
and spatial data analysis, demonstrating their versatility in addressing real-
world problems involving interconnected data points.

A graph is represented as $G=(V,E)$ where $V$ is the set of vertices (or
nodes), and $E$ is the set of edges. Let $v_{i}\in V$ to denote a node and
$e_{ij}=(v_{i},v_{j})\in E$ to denote an edge pointing from $v_{i}$ to
$v_{j}$. The neighborhood of a node $v$ is defined as $N(v)=\\{u\in V|(u,v)\in
E\\}$. The adjacency matrix $A$ is a $n\times n$ matrix with $A_{ij}=1$ if
$e_{ij}\in E$ and $A_{ij}=0$ if $e_{ij}\notin E$. A graph may have node
attributes $X$, where $X\in R^{n\times d}$ is a node feature matrix with
$x_{v}\in R^{d}$ representing the feature vector of a node $v$. Meanwhile, a
graph may have edge attributes $X^{e}$, where $X^{e}\in R^{m\times c}$ is an
edge feature matrix with $x_{v,u}^{e}\in R^{c}$ representing the feature
vector of an edge $(v,u)$.

One popular category of GNNs is Convolutional graph neural networks (ConvGNNs)
which generalize the operation of convolution from grid data to graph data.
The main idea is to generate a node $v$’s representation by aggregating its
own features $x_{v}$ and neighbors’ features $x_{u}$, where $u\in N(v)$.
Particularly, ConvGNNs stack multiple graph convolutional layers to extract
high-level node representations. ConvGNNs play a central role in building up
many other complex GNN models. Figure 12 shows a ConvGNN with multiple graph
convolutional layers for nodes’ representation learning.

We consider a multi-layer Graph Convolutional Network (GCN) with the following
layer-wise propagation rule:

$H^{(l+1)}=\sigma(\tilde{D}^{-1/2}\tilde{A}\tilde{D}^{-1/2}H^{(l)}W^{(l)})$

Here, $\tilde{A}=A+I_{N}$ is the adjacency matrix of the undirected graph $G$
with added self-connections. $I_{N}$ is the identity matrix,
$\tilde{D}_{ii}=\sum_{j}\tilde{A}_{ij}$ and $W^{(l)}$ is a layer-specific
trainable weight matrix. $\sigma(.)$ denotes an activation function, such as
the $RELU(.)=max(0,.)$. $H^{(l)}\in R^{N\times D}$ is the matrix of
activations in the $l^{th}$ layer with $H^{(0)}=X$.

Figure 12: A ConvGNN with multiple graph convolutional layers. A graph
convolutional layer captures the underlying representation of each node by
aggregating feature information from its neighborhood nodes. Following this
aggregation, a non-linear transformation is applied to the resulting outputs.
By stacking multiple layers, the final representation of each node receives
messages from its neighborhood.

Please refer to [GNNssurveys] for the details of other categories of graph
neural networks (GNNs) including Recurrent graph neural networks (RecGNNs),
Graph autoencoders (GAEs), and Spatial-temporal graph neural networks
(STGNNs).

####  6.5.6 Mahalanobis distance

A rich line of machine learning and deep learning algorithms has been
developed for out-of-distribution (OOD) detection, among which distance-based
methods demonstrated promise [lee2018simple, Tack2020, Sehwag21]. Distance-
based methods leverage feature embeddings extracted from a model and operate
under the assumption that the test OOD samples are relatively far away from
the ID data. For example, [Sehwag21] uses the Mahalanobis distance
[Mahalanobis] to all cluster centroids for OOD detection. In particular, the
authors first partition the features for in-distribution training data in $M$
clusters. They represent features for each cluster as $Z_{m}$ (by using the
k-means clustering method due to its effectiveness and low computation cost).
Next, they model features in each cluster independently and calculate the
following $outlier\,score(s_{\mathbf{x}})=min_{m}D(\mathbf{x},Z_{m})$ for each
test input $\mathbf{x}$, where $D(.,.)$ is a distance metric in the feature
space. The Mahalanobis distance to calculate the outlier score of each input
data $x$ in the latent space is as follows:

$s(x)=min_{k}(\mathbf{z}_{\mathbf{x}}-\mu_{m})^{\mathrm{\top}}\Sigma_{m}^{-1}(\mathbf{z}_{\mathbf{x}}-\mu_{m})$

where $\mathbf{z}_{\mathbf{x}}$ is the representation of data $\mathbf{x}$ in
the latent space while $\mu_{m}$ and $\Sigma_{m}$ are the sample mean and
sample covariance of cluster $m^{th}\in M$.

####  6.5.7 Contrastive loss functions

Using contrastive loss functions for improving data representations has been
widely applied to computer vision domain applications from computer vision
classification, detection, and segmentation [NEURIPS2020_Kim, Wang_2021_ICCV,
Sun_2021_CVPR, Du_2022_CVPR, Wang_2021_CVPR] to vision data out-of-
distribution detection [Sehwag21].

##### Self-supervised contrastive learning

For a set of $N$ randomly sampled sample and label pairs,
$\\{\mathbf{x}_{k},y_{k}\\}_{k=1...N}$, the corresponding batch used for
training consists of $2N$ pairs,
$\\{\tilde{\mathbf{x}}_{l},\tilde{y}_{l}\\}_{l=1...2N}$, where
$\tilde{\mathbf{x}}_{2k}$ and $\tilde{\mathbf{x}}_{2k-1}$ are two random
augmentations of $\mathbf{x}_{k}(k=1...N)$ and
$\tilde{y}_{2k-1}=\tilde{y}_{2k}=y_{k}$. We refer to a set of $N$ samples as a
“batch” and the set of 2N augmented samples as a “multi-viewed batch”.

Within a multi-viewed batch, let $i\in I\equiv\\{1...2N\\}$ be the index of an
arbitrary augmented sample, and let $j(i)$ be the index of the other augmented
sample originating from the same source sample. In self-supervised contrastive
learning (SimCLR), the loss takes the following form:

$\mathcal{L}^{self}=\sum_{i\in I}\mathcal{L}_{i}^{self}=-\sum_{i\in
I}log\frac{exp(sim(\mathbf{z},\mathbf{z}_{j(i)})/\tau)}{\sum_{\alpha\in
A(i)}exp(sim(\mathbf{z},\mathbf{z}_{a})/\tau)}$

where $\mathbf{z}_{l}$ can be considered as a representation of corresponding
$\mathbf{x}$; $sim$ function can be the inner (dot) product; $\tau\in R^{+}$
is a scalar temperature parameter, and $A(i)\equiv I\setminus{i}$. The index
$i$ is called the anchor, index $j(i)$ is called the positive, and the other
$2(N-1)$ indices ($\\{k\in A(i)\setminus\\{j(i)\\}\\})$ are called the
negatives. Note that for each anchor $i$, there is one positive pair and
$2N-2$ negative pairs. The denominator has a total of $2N-1$ terms (the
positives and negatives).

##### Supervised contrastive learning

Supervised contrastive learning (SupCLR) is a supervised version of self-
supervised contrastive learning (SimCLR). That builds on the contrastive self-
supervised literature by leveraging label information. Normalized embeddings
from the same class are pulled closer together than embeddings from different
classes:

$\mathcal{L}^{sup}=\sum_{i\in I}\mathcal{L}_{i}^{sup}=\sum_{i\in
I}\frac{-1}{\left|P(i)\right|}log\frac{exp(sim(\mathbf{z},\mathbf{z}_{p})/\tau)}{\sum_{\alpha\in
A(i)}exp(sim(\mathbf{z},\mathbf{z}_{a})/\tau)}$

where $P(i)\equiv\\{p\in A(i):\tilde{y}_{p}=\tilde{y}_{i}\\}$ is the set of
indices of all positives in the multi-viewed batch distinct from $i$, and
$\left|P(i)\right|$ is its cardinality.

####  6.5.8 Cosine similarity

Cosine similarity is a metric used to measure the similarity of two vectors.
In particular, cosine similarity measures the similarity in the direction or
orientation of the vectors ignoring differences in their magnitude or scale.
The similarity of two vectors is measured by the cosine of the angle between
them (please refer to Figure 14 for details). In our paper, to form the
corresponding vector for each $\tilde{X}$ of each source code section $X$ in
the latent space for calculating the cosine similarity, we simply concatenate
all vectors where each vector stands for a representation of a code statement
in $\tilde{X}$.

####  6.5.9 Mutual information

Mutual information (MI) is used to measure the dependence between two random
variables [TheoryofC, EofIT2006]. It captures how much the knowledge of one
random variable reduces the uncertainty of the other. In particular, MI
quantifies the amount of information obtained about one random variable by
observing the other random variable. For example, consider a scenario where
variable A denotes the outcome of rolling a standard 6-sided die and variable
B represents whether the roll results in an even number (0 for even, 1 for
odd). Evidently, the information conveyed by B provides insights into the
value of A, and vice versa. In other words, these random variables possess
mutual information.

Assume that we have two random variables $X$ and $Y$ drawn from the joint
distribution $p(x,y)$ with two corresponding marginal distributions $p(x)$ and
$p(y)$. The mutual information between $X$ and $Y$ denoted by $I(X,Y)$ is the
relative entropy between the joint distribution $p(x,y)$ and the product
distribution $p(x)p(y)$, and is defined as follows:

$\displaystyle I(X,Y)=$
$\displaystyle\sum_{x\in\mathcal{X}}\sum_{y\in\mathcal{Y}}p(x,y)\log\frac{p(x,y)}{p(x)p(y)}$
$\displaystyle=$ $\displaystyle D_{KL}(p(x,y)||p(x)p(y))$ (9)

where $D_{KL}(p(x,y)||p(x)p(y))$ is the Kullback-Leibler divergence measuring
the relative entropy (i..e, the difference in information) represented by two
distributions, i.e., the product of marginal distributions $p(x)p(y)$ of $X$
and $Y$ from their joint distribution $p(x,y)$.

####  6.5.10 Information bottlenecks

Here, we consider the supervised learning context where we want to predict
corresponding outputs (e.g., labels)
$\left\\{{\mathbf{y}}_{i}\right\\}_{i=1}^{n}$ of given inputs
$\left\\{{\mathbf{x}}_{i}\right\\}_{i=1}^{n}$. A deep learning network (DNN)
will learn latent representations (i.e., latent features in the latent space
that contain useful information to describe the data)
$\left\\{\tilde{{\mathbf{x}}}_{i}\right\\}_{i=1}^{n}$ of the corresponding
input data samples $\left\\{{\mathbf{x}}_{i}\right\\}_{i=1}^{n}$ in terms of
enabling good predictions and generalizations.

Assume that the whole hidden layer in Figure 13 is denoted by a random
variable $\tilde{X}$ while the input and output layers are denoted by random
variables $X$ and $Y$ respectively. We can describe this hidden layer by two
conditional distributions: the encoder $p(\tilde{{\mathbf{x}}}|{\mathbf{x}})$
and the decoder $p({\mathbf{y}}|\tilde{{\mathbf{x}}})$. This transformation
process preserves the information of the input layer $X$ without considering
which individual neurons within the hidden layer $\widetilde{X}$ encode which
features (i.e., neurons) of $X$. An optimal encoder process of the mutual
information between $X$ and the desired output $Y$ denoted by $I(X,Y)$ can
create the most compact encoding (i.e., minimally sufficient statistic)
$\tilde{X}$ of the input data $X$ while $\tilde{X}$ still has enough
information (i.e., $\tilde{X}$ can capture the important features of $X$ as
well as remove the unnecessary parts of $X$ that do not make any contributions
to the prediction of $Y$) to predict $Y$ as accurately as possible.

An information bottleneck [tishby2000information, tishby2015deep] is proposed
to be a computational framework that aims to find the most compact encoding
$\tilde{X}$ of the input data $X$. In particular, it is the optimal trade-off
between the compression $\tilde{X}$ and the prediction of the desired output
$Y$ as described in the following optimization problem:

$\min_{p(\tilde{{\mathbf{x}}}|{\mathbf{x}}),p({\mathbf{y}}|\tilde{{\mathbf{x}}}),p(\tilde{{\mathbf{x}}})}\left\\{I(X,\tilde{X})-\beta
I(\tilde{X},Y)\right\\}$ (10)

where $\beta$ specifies the amount of relevant information captured by the
encoding process (i.e., the representations $\tilde{X}$ and $I(\tilde{X},Y)$).

Figure 13: An architecture of a simple deep neural network in a supervised
learning context for the classification problem.
---
Figure 14: A graphic showing two vectors with cosine similarities close to 1,
close to 0, and close to -1. The similarity of two vectors is measured by the
cosine of the angle between them. The similarity can take values between -1
and +1. Smaller angles between vectors produce larger cosine values,
indicating greater cosine similarity.