RISE: repair-like insertions for stealthy evasion of vulnerability detection models

Abstract

Pre-trained code models are increasingly used for vulnerability detection, yet their robustness against adversarial perturbations remains insufficiently explored. Existing attacks either focus on identifier-level modifications with limited perturbation space or rely on strong prior resources such as mispredicted samples, reference inputs, or model-internal signals, limiting their practicality in realistic black-box settings. To address these limitations, we propose RISE, a practical black-box adversarial attack framework for vulnerability detection models. RISE combines semantic-preserving structural transformations with repair-like insertions, introducing Type System Inflation and Data Flow Fragmentation to construct structurally uncommon code patterns and injecting repair-like snippets to generate effective statement-level adversarial examples without relying on large-scale prior samples or model-internal information. We evaluate RISE on Devign and DiverseVul against CodeBERT, UniXcoder, and CodeLlama, comparing it with ALERT, DIP, and SLODA. Experimental results show that RISE consistently achieves the highest attack success rate across models and datasets while maintaining a favorable balance between effectiveness and query cost. Representation similarity and ablation analyses further indicate that RISE often preserves representation-level closeness between original and adversarial code and that its core components contribute to attack effectiveness. We emphasize that this similarity analysis serves as an indirect indicator of representation-level closeness rather than direct evidence of semantic equivalence or human-perceived stealthiness.