VulCausal: Robust Vulnerability Detection Using Neural Network Models from a Causal Perspective

Deep learning has showcased remarkable performance in source code vulnerability detection. However, significant challenges persist in terms of generalization and handling real-world samples. These challenges are frequently attributed to dataset distribution shift, such as spurious correlations. While previous research has explored spurious correlations in other tasks, such as text classification and function naming, vulnerability detection has yet to receive extensive study in this context. This paper proposes a novel approach called VulCausal, which integrates a causal inference framework into neural network models for vulnerability detection. VulCausal aims to capture and address the spurious correlations present in the API function, user-defined identifiers, and code structure during the training phase. The mitigation of spurious correlations is achieved through backdoor adjustment in the inference phase, effectively mitigating the effects of these confounding factors. Experimental results demonstrate that VulCausal significantly enhances the accuracy and robustness of vulnerability detection. It achieves state-of-the-art accuracy in the CodeXGLUE defect dataset benchmark and ranks first on the leaderboard. Additionally, it reduces the attack success rate from 63.08% to 23.7% when confronted with a state-of-the-art adversarial attack called ALERT, which is for a pre-trained language model of code.