Existing backdoor attack methods predominantly rely on single static code features as triggers, rendering them easily detectable and achieving limited efficacy. To address this critical vulnerability, we propose a novel hybrid trigger mechanism that synergistically integrates static code structures, dynamic execution characteristics, and function signature patterns, coupled with an adaptive backdoor injection algorithm. Experimental evaluations demonstrate that our approach maintains model functionality while achieving exceptional attack performance. Specifically, the static-function signature hybrid configuration attains an average attack success rate of 99.0 % on CodeBert models, representing a 13-percentagepoint improvement over dynamic-only baselines. Furthermore, the static-function signature hybrid mechanism consistently outperforms conventional dynamic triggers across parameter configurations in GraphCodeBert models, achieving Attack Success Rate gains of 12-12.7 percentage points. Crucially, the static-dynamic hybrid configuration exhibits robust defense evasion capabilities when confronted with advanced detection systems such as Spectral Signatures, attaining a 94 % evasion success rate while achieving a 40 % relative reduction in detection likelihood compared to static-only baselines. Our study reveals critical security risks in code intelligence systems and provides essential insights for designing next-generation defense frameworks that are resilient to adaptive adversarial threats.

Abstract Recent advances in artificial intelligence technology and perception components have promoted the rapid development of autonomous vehicles. However, as safety‐critical software, autonomous driving systems often make wrong judgments, seriously threatening human and property safety. LiDAR is one of the most critical sensors in autonomous vehicles, capable of accurately perceiving the three‐dimensional information of the environment. Nevertheless, the high cost of manually collecting and labeling point cloud data leads to a dearth of testing methods for LiDAR‐based perception modules. To bridge the critical gap, we introduce MetaLiDAR, a novel automated metamorphic testing methodology for LiDAR‐based autonomous driving systems. First, we propose three object‐level metamorphic relations for the domain characteristics of autonomous driving systems. Next, we design three transformation modules so that MetaLiDAR can generate natural‐looking follow‐up point clouds. Finally, we define corresponding evaluation metrics based on metamorphic relations. MetaLiDAR automatically determines whether source and follow‐up test cases meet the metamorphic relations based on the evaluation metrics. Our empirical research on five state‐of‐the‐art LiDAR‐based object detection models shows that MetaLiDAR can not only generate natural‐looking test point clouds to detect 181,547 inconsistent behaviors of different models but also significantly enhance the robustness of models by retraining with synthetic point clouds.

Abstract The compatibility issues caused by Android fragmentation have become a vital task in the development of Android applications. To locate those issues, thousand of crowd testers run apps on different devices with different configurations to achieve the largest coverage, which might be costly and time‐consuming. Since existing approaches to selecting optimal devices are device‐side analysis without the information of the internal structures of apps, app‐side analysis that flags the essential devices for testers has remained elusive. To mitigate this gap of compatibility crowdtesting, this paper proposes an app constraint analysis approach named CompatDroid to generate the optimal device set to guide crowd testers. By evaluating 46 benchmark apps on 14 SDK versions, the optimal device sets are successfully generated, and CompatDroid only needs no more than 7 Android versions to achieve almost the same code coverage (i.e., 33.13%) testing on all 14 android versions (i.e., 34.65%) in 36 of 46 apps, which indicates that it can drastically reduce the consumption of test resources while losing little test coverage. On a larger dataset, CompatDroid successfully analyzes 98.3% of 645 apps, in which the median number of the optimal SDK versions set is 2.5 versions, and 68.92% of those apps contain the constraints of SDK version (i.e., SDK version) while 84.86% of them do not have the constraints of hardware information (i.e., model name and manufacture name).

Abstract The development of artificial intelligence and information communication technology has significantly propelled advancements in autonomous driving. The advent of autonomous driving has a profound impact on societal development and transportation methods. However, as intelligent systems, autonomous driving systems (ADSs) often make wrong judgements in specific scenarios, resulting in accidents. There is an urgent need for comprehensive testing and validation of ADSs. Metamorphic testing (MT) techniques have demonstrated effectiveness in testing ADSs. Nevertheless, existing testing methods primarily encompass relatively simple metamorphic relations (MRs) that only verify ADSs from a single perspective. To ensure the safety of ADSs, it is essential to consider the various elements of driving scenarios during the testing process. Therefore, this paper proposes MetaSem, a novel metamorphic testing method based on semantic information of autonomous driving scenes. Based on semantic information of the autonomous driving scenes and traffic regulations, we design 11 MRs targeting different scenario elements. Three transformation modules are developed to execute addition, deletion and replacement operations on various scene elements within the images. Finally, corresponding evaluation metrics are defined based on MRs. MetaSem automatically discovers inconsistent behaviours according to the evaluation metrics. Our empirical study on three advanced and popular autonomous driving models demonstrates that MetaSem not only efficiently generates visually natural and realistic scene images but also detects 11,787 inconsistent behaviours on three driving models.

From reducing traffic congestion to improving transportation, autonomous vehicles have immense potential in enhancing productivity and quality of life. As a safety-critical system, autonomous vehicles must undergo extensive testing before being deployed on public roads to ensure their safety and reliability. Given the complexity and high dimensionality of testing scenarios for autonomous driving, this paper proposes a test case generation method based on an improved genetic algorithm. The LGSVL simulator is used to conduct simulation tests on the Baidu Apollo system. The experimental results demonstrate that the test cases generated by this method can effectively test various safety violations of autonomous vehicles and improve the efficiency of generating effective test cases.

An Ethereum smart contract is an agreement reached by multiple parties, which is guaranteed by blockchain technology to be executed in accordance with the terms expressed in the form of code. Its security needs are particularly prominent due to a large number of digital assets under management. Testing is an effective way to find flaws that threaten the security of smart contracts. However, current smart contract test case generation methods do not regard the impact of other functions in the smart contract on state variables, resulting in the inaccessibility of the control statements related to state variables and low branch coverage of the function under test. To alleviate this problem, this paper proposes SV-Gen. SV-Gen generates test cases for smart contracts through two steps: static analysis and dynamic search. In the first step, SV-Gen considers the read-write relationship between functions and state variables in the smart contract to generate a function invocation sequence for the function to be tested through a backtracking algorithm on state variables. Then the arguments of transactions to invoke each function in the sequence are generated through regex matching to form the primitive test case. In the second step, the primitive test cases constitute an initial population, and a genetic algorithm undertakes the task of evolving them to high branch coverage. The experimental results on one of the VeriSmart datasets show that SV-Gen can effectively enter the control constraints related to state variables and improve the branch coverage of smart contracts.

ERC20 is the first token standard on Ethereum and is widely used in ICOs, voting, and various asset representations. However, some methods defined in ERC20 imply potential vulnerabilities and Multiple Withdrawal Attack is one of them. Attackers can transfer more tokens than the actual allowance through this vulnerability. The current prevention methods for Multiple Withdrawal Attack include changing the transaction process, modifying the API of ERC20, and modifying the implementation of functions, etc. However, these methods have disadvantages such as poor compatibility, incomplete resolution, and high gas consumption. In this paper, we describe the process of Multiple Withdrawal Attack and analyze the shortcomings of the existing methods, and then propose a solution with lower gas consumption. In our method, a variable is added to record the allowance in the approval function to prevent tokens from being transferred repeatedly. Finally, the effectiveness and the performance of the proposed method is analyzed. The result shows that the method proposed in this paper is safe and has lower gas consumption than the existing methods.

With the prosperity of Mobile APPs, developers need to dynamically find the compatibility issues by testing APP on all Android versions and devices, which is costly. This paper finds a systematic test method based on source codes of apps to be tested by identify compatibility-related characteristic codes. We propose an automated tool named “Periph” to search the source code of each app that can eventually generate compact versions and devices set to guide the testing. Through testing 21 apps on 13 Android versions, we find that our proposed tool can greatly reduce the consumption of test resources while only losing little test coverage.