ML Security PapersHogVul: Black-box Adversarial Code Generation Framework Against LM-based Vulnerability Detectors
Jingxiao Yang 1, Ping He 1, Tianyu Du 1,2, Sun Bing 3, Xuhong Zhang 1,2
Published on arXiv
2601.05587
Input Manipulation Attack
OWASP ML Top 10 — ML01
Key Finding
HogVul achieves an average attack success rate improvement of 26.05% over state-of-the-art black-box baselines across four vulnerability detection benchmarks.
HogVul
Novel technique introduced
Recent advances in software vulnerability detection have been driven by Language Model (LM)-based approaches. However, these models remain vulnerable to adversarial attacks that exploit lexical and syntax perturbations, allowing critical flaws to evade detection. Existing black-box attacks on LM-based vulnerability detectors primarily rely on isolated perturbation strategies, limiting their ability to efficiently explore the adversarial code space for optimal perturbations. To bridge this gap, we propose HogVul, a black-box adversarial code generation framework that integrates both lexical and syntax perturbations under a unified dual-channel optimization strategy driven by Particle Swarm Optimization (PSO). By systematically coordinating two-level perturbations, HogVul effectively expands the search space for adversarial examples, enhancing the attack efficacy. Extensive experiments on four benchmark datasets demonstrate that HogVul achieves an average attack success rate improvement of 26.05\% over state-of-the-art baseline methods. These findings highlight the potential of hybrid optimization strategies in exposing model vulnerabilities.
Key Contributions
- HogVul framework integrating lexical and syntax perturbations under a unified dual-channel optimization loop for black-box adversarial attacks on code LMs
- PSO-based hybrid optimization with stagnation-triggered switching between perturbation strategies to efficiently navigate the expanded adversarial code space
- 26.05% average attack success rate improvement over state-of-the-art baselines across four vulnerability detection benchmark datasets
🛡️ Threat Analysis
HogVul crafts adversarial code inputs — via lexical (identifier renaming, token substitution) and syntax (AST/control-flow) perturbations — that cause LM-based vulnerability detectors to misclassify vulnerable code as benign at inference time. This is a classic evasion/input manipulation attack optimized with PSO in a black-box setting.