ai-research-survey

scan.json (24634B)

---

 {
   "paper": {
     "title": "CodeMark: Imperceptible Watermarking for Code Datasets against Neural Code Completion Models",
     "authors": ["Zhensu Sun", "Xiaoning Du", "Fu Song", "Li Li"],
     "year": 2023,
     "venue": "ESEC/FSE 2023",
     "arxiv_id": "2308.14401",
     "doi": "10.1145/3611643.3616297"
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "Section 10 (Data Availability) states: 'source code of our toolkit, all the artifacts and results are available on our website [9].' Reference [9] links to https://sites.google.com/view/codemark."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses the publicly available CodeSearchNet (CSN) dataset [21] for Python and Java. Section 10 also states all artifacts and results are available on their website."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, or detailed environment setup section is provided in the paper. The paper mentions using Tree-sitter and GPT-2 (124M) and CodeT5 (60M) but does not specify library versions or environment details."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not include step-by-step reproduction instructions, a README with commands, or a 'Reproducing Results' section. Artifacts are referenced on the website but no instructions are provided in the paper itself."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "The paper reports point estimates for BLEU and EM scores (e.g., 0.233, 0.352) without confidence intervals or error bars. Only p-values from the t-test validation are reported."
       },
       "significance_tests": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses independent-samples t-tests (Section 3.5) with a 5% confidence level (alpha=0.05) to validate watermark existence. P-values are reported for all validation experiments in Tables 2 and 5."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports effect sizes in context for harmlessness: 'on average 0.6% and 0.1% in terms of BLEU and Exact Match' reduction (Section 5.1). Table 2 provides baseline and watermarked model scores side by side (e.g., BLEU from 0.233 to 0.230), enabling assessment of magnitude."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No power analysis or sample size justification is provided. The validation set size is limited to 1000 (Section 4.3) without justification. The human study uses 22 participants without justification for this number."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or spread measures are reported across experimental runs. Results appear to be from single training runs of GPT-2 and CodeT5 models."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The paper compares CodeMark against CoProtector [38], an existing dead-code-based watermarking method. Unwatermarked models serve as baselines for harmlessness and verifiability evaluations."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "CoProtector (2021) is the only existing code watermarking method against neural models at the time of this work, making it the most relevant and contemporary baseline."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "The paper evaluates individual backdoors (B1, B2, B3, B4) separately and in combination (B1,2 and B3,4), showing the contribution of single vs. multiple backdoors. The robustness experiment (RQ4, Table 5) varies the watermarking rate (100%, 50%, 20%, 10%, 0%) to measure the effect of watermark density."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses BLEU, Exact Match (EM), p-value for validation, and Recall/Precision for defense method evaluation (Section 4.4)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.3 describes a human study with 22 participants evaluating the imperceptibility of CodeMark vs. CoProtector across three rounds (watermark-unaware, watermark-aware, method-aware). Results are reported in Table 3."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 states the train and test sets come from 'non-overlapping repositories.' The test split is used for evaluating model accuracy, separate from the training data."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by programming language (Python vs. Java), model architecture (GPT-2 vs. CodeT5), individual backdoors (B1-B4), single vs. multiple backdoor settings, and watermarking rates (Tables 2, 4, 5)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.4 and Section 7 discuss cases where backdoors fail: B4 becomes invalid at 10% watermarking rate for GPT-2, and B1 fails for CodeT5 at 20% rate. Section 7 discusses the challenge that 'some inappropriate backdoors may lead to unexpected results.'"
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports that certain backdoors fail at lower watermarking rates (Table 5, e.g., B4 at 10% for GPT-2 yields p=0.28, failing the test). Section 7 acknowledges CodeMark cannot 'fully ensure the effectiveness of all the watermark backdoors during the design phase.'"
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims CodeMark is 'validated to fulfill all desired properties of practical watermarks, including harmlessness to model accuracy, verifiability, robustness, and imperceptibility.' Each of these is evaluated in dedicated RQs (RQ1-RQ4) with supporting experimental evidence in Section 5."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper's causal claims relate to watermark embedding causing specific model behaviors. These are tested through controlled experiments: training models with and without watermarks and comparing outcomes, which constitutes adequate controlled manipulation."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 (Threats to Validity) explicitly bounds generalization: 'we only conducted experiments using two popular NCCMs in two programming languages. Though our method is theoretically applicable to any programming language and NCCM, the effectiveness of CodeMark in other settings has not been experimentally verified yet.'"
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 discusses alternative factors: varying model learning abilities for different code semantics, the impact of backdoor design choices, and the practical feasibility of dilution attacks. Section 6 discusses threats including limited generalization and potential bias in the human study."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper specifies 'GPT-2' (124M parameters) and 'CodeT5' (60M parameters) but does not provide specific model version identifiers or snapshot dates (e.g., no Hugging Face model IDs or version numbers beyond parameter counts)."
       },
       "prompts_provided": {
         "applies": false,
         "answer": false,
         "justification": "The paper does not use prompting in the LLM sense. The models are fine-tuned on code datasets for code completion, not prompted with instructions."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "The paper states GPT-2 is fine-tuned for 10 epochs and CodeT5 for 20 epochs (Section 4.2), but does not report learning rate, batch size, optimizer, temperature, or other training hyperparameters."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. CodeMark is a data transformation tool, not an agentic system."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 describes the dataset source (CodeSearchNet), how it was collected (extracting functions and paired comments from GitHub), and provides exact sizes: 412,178 train / 22,176 test for Python, 454,451 train / 26,909 test for Java. The watermark embedding process is documented in detail in Section 3.3-3.4."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 is titled 'Threats to Validity' and contains substantive discussion across three subsections: Generalization, Backdoor design, and Limited experiments."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 includes specific threats: 'we only conducted experiments using two popular NCCMs in two programming languages,' 'the human study can be inherently biased due to its small scale and the potential differences in expertise and backgrounds of the participants,' and 'some inappropriate backdoors may lead to unexpected results.'"
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 explicitly states scope limits: CodeMark targets code completion models only and 'is currently not directly applicable' to code tasks involving natural language (code search, summarization). Section 7 notes they 'cannot fully ensure the effectiveness of all the watermark backdoors during the design phase.'"
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": true,
         "justification": "Section 10 states 'source code of our toolkit, all the artifacts and results are available on our website [9].' The underlying CodeSearchNet dataset is publicly available."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 describes the CodeSearchNet dataset: 'collected by extracting each function and its paired comment from open-source code repositories on Github.' Train/test split sizes are provided for both languages."
       },
       "recruitment_methods_described": {
         "applies": true,
         "answer": false,
         "justification": "For the human study (Section 5.3), the paper states '22 participants are recruited' with 'more than one year of development experience' but does not describe how participants were recruited (channels, population, potential selection bias)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The watermark embedding pipeline is documented in Sections 3.2-3.5: code parsing via AST, pattern selection, SPT application, and validation set creation. Table 1 provides the number of transformable instances for each SPT rule."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "The Acknowledgments section discloses: 'This work is supported by the National Natural Science Foundation of China under Grant No.: 62072309, CAS Project for Young Scientists in Basic Research under Grant No.: YSBR-040, and ISCAS New Cultivation Project under Grant No.: ISCAS-PYFX-202201.'"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are listed: Beihang University, Monash University, and the State Key Laboratory of Computer Science at the Institute of Software, Chinese Academy of Sciences. No product evaluation conflict exists since the work proposes a new method rather than evaluating a commercial product."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "The funders are the National Natural Science Foundation of China, CAS, and ISCAS — academic and government funding bodies with no apparent financial interest in the outcome of this watermarking research."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement or financial interest declaration is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper does not evaluate a pre-trained model's capability on a benchmark. It fine-tunes GPT-2 and CodeT5 on specific code datasets to test watermark embedding, not model knowledge or benchmark performance."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests watermark embedding effectiveness, not model knowledge. Train/test overlap of the pre-trained model's data is not relevant to the claims about watermark verifiability."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The paper evaluates a watermarking method, not model capability on a benchmark. Contamination is not relevant to the claims being made."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": true,
         "answer": false,
         "justification": "No pre-registration is mentioned for the human imperceptibility study with 22 participants."
       },
       "irb_or_ethics_approval": {
         "applies": true,
         "answer": false,
         "justification": "No IRB or ethics board approval is mentioned for the human study involving 22 participants."
       },
       "demographics_reported": {
         "applies": true,
         "answer": false,
         "justification": "The paper only reports that participants have 'more than one year of development experience.' No other demographics (gender, geographic distribution, programming background, expertise level beyond one year) are reported."
       },
       "inclusion_exclusion_criteria": {
         "applies": true,
         "answer": false,
         "justification": "The only stated criterion is 'more than one year of development experience.' No formal inclusion/exclusion criteria, screening process, or rationale for the threshold is provided."
       },
       "randomization_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.3 states participants are shown 'ten snippets randomly sampled from the pool' and 'Every participant examines the same ten code snippets throughout the three rounds.'"
       },
       "blinding_described": {
         "applies": true,
         "answer": true,
         "justification": "The study uses progressive disclosure across three rounds: participants start unaware of watermarks (round 1), are told some snippets may be watermarked (round 2), then given technical details (round 3). This effectively describes blinding conditions."
       },
       "attrition_reported": {
         "applies": true,
         "answer": false,
         "justification": "No information is provided about whether any participants dropped out or failed to complete all three rounds of the study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference cost, latency, or time required for watermark embedding or validation is reported."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "Section 6 mentions 'Limited by our computing resources' but does not quantify GPU hours, training time, or total computational budget for any experiments."
       }
     }
   },
   "claims": [
     {
       "claim": "CodeMark causes negligible performance reduction: on average 0.6% BLEU and 0.1% Exact Match reduction.",
       "evidence": "Table 2 shows BLEU/EM for watermarked vs. unwatermarked models across GPT-2 and CodeT5 for Python and Java. The largest difference is 2.5% of the unwatermarked baseline (Section 5.1).",
       "supported": "moderate"
     },
     {
       "claim": "The t-test-based validation method correctly distinguishes watermarked from unwatermarked models with statistical significance.",
       "evidence": "Table 2 shows all watermarked models pass the t-test (p-values from 3.2E-126 to 2.1E-3) while no unwatermarked model passes (p-values all ≥ 0.71). Section 5.2.",
       "supported": "strong"
     },
     {
       "claim": "CodeMark is significantly more imperceptible than CoProtector to human developers.",
       "evidence": "Table 3 shows CodeMark suspicious rate stays at 15.6% across rounds while CoProtector rises from 43.9% to 70.7%. 22 participants across 3 rounds. Section 5.3.",
       "supported": "moderate"
     },
     {
       "claim": "Automated defense methods (activation clustering and spectral signature) fail to eliminate CodeMark watermarks.",
       "evidence": "Table 4 shows both AC and SS achieve low recall (≤0.56 for AC, ≤0.05 for SS) and extremely low precision (≤0.01). Models retrained after elimination still pass watermark validation. Section 5.3.",
       "supported": "strong"
     },
     {
       "claim": "CodeMark resists dilution attacks at a 20% watermarking rate, and most backdoors survive at 10%.",
       "evidence": "Table 5 shows most backdoors remain valid (p<0.05) at 20% watermarking rate for GPT-2. At 10%, B4 fails for GPT-2 but B3 survives. For CodeT5, more backdoors fail at lower rates. Section 5.4.",
       "supported": "moderate"
     }
   ],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "CodeMark proposes semantic-preserving code transformations (syntactic sugar, default parameters, keyword parameters, equivalent implementations) as imperceptible watermarks for code datasets. Experiments on GPT-2 and CodeT5 with Python/Java CodeSearchNet data show negligible accuracy impact (0.6% BLEU, 0.1% EM reduction), statistically significant watermark detection via t-tests, and superior imperceptibility over CoProtector (15.6% vs. 70.7% suspicious rate with method-aware participants). The watermarks resist both automated elimination methods and dataset dilution down to 20% watermarking rate, though some individual backdoors fail at 10%.",
   "red_flags": [
     {
       "flag": "No variance across runs",
       "detail": "Model training results appear to be from single runs without reporting standard deviation or variance across different random seeds. DL model training is stochastic and results can vary significantly between runs, making it impossible to know if the reported differences are within normal variation."
     },
     {
       "flag": "Small human study without recruitment details",
       "detail": "The imperceptibility human study uses only 22 participants with no IRB approval, no demographics beyond '1+ year experience,' no recruitment method description, and no power analysis. The 3-minute time limit per round and same 10 snippets across 3 rounds introduce learning effects. The small N limits the statistical power of comparisons."
     },
     {
       "flag": "Missing training hyperparameters",
       "detail": "Only epochs (10 for GPT-2, 20 for CodeT5) are reported. No learning rate, batch size, optimizer, weight decay, or other hyperparameters are given, making reproduction difficult."
     },
     {
       "flag": "No computational cost reporting",
       "detail": "The paper mentions being 'limited by computing resources' but never quantifies training time, GPU hours, or the cost of the watermark embedding process. This makes it impossible to assess practical feasibility."
     }
   ],
   "cited_papers": [
     {
       "title": "CoProtector: Protect Open-Source Code against Unauthorized Training Usage with Data Poisoning",
       "authors": ["Zhensu Sun", "Xiaoning Du", "Fu Song", "Mingze Ni", "Li Li"],
       "year": 2021,
       "relevance": "Direct baseline for code dataset watermarking against neural models, proposes dead-code-based watermarks."
     },
     {
       "title": "CodeSearchNet Challenge: Evaluating the State of Semantic Code Search",
       "authors": ["Hamel Husain", "Hongqi Wu", "Tiferet Gazit", "Miltiadis Allamanis", "Marc Brockschmidt"],
       "year": 2019,
       "relevance": "Provides the code dataset (CSN) used in CodeMark's evaluation, widely used benchmark for code intelligence."
     },
     {
       "title": "StarCoder: may the source be with you!",
       "authors": ["Raymond Li"],
       "year": 2023,
       "arxiv_id": "2305.06161",
       "relevance": "Large-scale code LLM that recruited annotators to remove PII from training data, illustrating the importance of code dataset curation."
     },
     {
       "title": "You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completion",
       "authors": ["R. Schuster", "Congzheng Song", "Eran Tromer", "Vitaly Shmatikov"],
       "year": 2020,
       "relevance": "Demonstrates backdoor poisoning attacks on code completion models, directly relevant to security of code generation systems."
     },
     {
       "title": "CodeT5: Identifier-aware Unified Pre-trained Encoder-Decoder Models for Code Understanding and Generation",
       "authors": ["Yue Wang", "Weishi Wang", "Shafiq R. Joty", "Steven C. H. Hoi"],
       "year": 2021,
       "arxiv_id": "2109.00859",
       "relevance": "One of the two code completion models used in CodeMark's evaluation, a prominent pre-trained model for code tasks."
     },
     {
       "title": "On the generalizability of Neural Program Models with respect to semantic-preserving program transformations",
       "authors": ["Md. Rafiqul Islam Rabin", "Nghi D. Q. Bui", "Ke Wang", "Yijun Yu", "Lingxiao Jiang", "Mohammad Amin Alipour"],
       "year": 2021,
       "relevance": "Demonstrates vulnerability of neural code models to semantic-preserving transformations, the theoretical basis for CodeMark's approach."
     },
     {
       "title": "Protecting Intellectual Property of Language Generation APIs with Lexical Watermark",
       "authors": ["Xuanli He", "Qiongkai Xu", "L. Lyu", "Fangzhao Wu", "Chenguang Wang"],
       "year": 2021,
       "arxiv_id": "2112.02701",
       "relevance": "Proposes lexical watermarking for NLP datasets using synonyms, the key inspiration for CodeMark's code synonym approach."
     },
     {
       "title": "Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring",
       "authors": ["Yossi Adi", "Carsten Baum", "Moustapha Cissé", "Benny Pinkas", "Joseph Keshet"],
       "year": 2018,
       "relevance": "Foundational work on using backdoor poisoning as watermarks in deep neural networks."
     },
     {
       "title": "Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering",
       "authors": ["Bryant Chen"],
       "year": 2019,
       "relevance": "One of two automated defense methods tested against CodeMark watermarks; relevant to backdoor detection in ML models."
     },
     {
       "title": "Spectral Signatures in Backdoor Attacks",
       "authors": ["Brandon Tran", "Jerry Li", "A. Madry"],
       "year": 2018,
       "relevance": "Second automated defense method tested against CodeMark; relevant to backdoor detection and ML security."
     }
   ]
 }