IEEE Transactions on Software Engineering最新文献

{"title":"Securing Code Understanding: Detecting Natural Backdoor Vulnerability in Code Language Models","authors":"Yuchen Chen;Weisong Sun;Haocheng Huang;Yuan Xiao;Chunrong Fang;Yiran Zhang;Tingting Xu;Zhenpeng Chen;An Guo;Peizhuo Lv;Xiaofang Zhang;Zhenyu Chen;Yang Liu;Baowen Xu","doi":"10.1109/TSE.2026.3704372","DOIUrl":"10.1109/TSE.2026.3704372","url":null,"abstract":"Code Language Models (CodeLMs) have become integral to software engineering, significantly advancing code intelligence tasks. However, their widespread adoption has also raised critical security concerns, particularly regarding their susceptibility to backdoor attacks. Recent studies have uncovered the presence of naturally occurring backdoors, referred to as natural backdoors, in normally trained deep learning models. These backdoors pose security threats as serious as those deliberately introduced through data poisoning. Nevertheless, research on the security implications of such natural backdoor vulnerabilities in CodeLMs remains scarce and lacks systematic investigation. In this paper, we conduct a thorough empirical study of natural backdoor vulnerabilities in CodeLMs, covering various model architectures and code intelligence tasks. Specifically, we first examine potential natural backdoor vulnerabilities in CodeLMs across 44 different scenarios, demonstrating that natural backdoors are prevalent and intrinsic to these CodeLMs. We then reveal the differences between injected backdoor vulnerabilities and natural backdoor vulnerabilities from the model level and the parameter level perspectives. Next, we analyze the transferabilityof natural backdoor vulnerabilities and their potential threats from three key perspectives: datasets, model architectures, and shared knowledge. We further conduct an in-depth analysis of the causes of natural backdoors in CodeLMs from two critical aspects: training datasets and the model training procedure. Furthermore, we evaluate the effectiveness of existing backdoor defense techniques, including pre-training, in-training, and post-training defenses, in mitigating natural backdoors in CodeLMs. Finally, we propose a novel detection method, <sc>ScanNBT</small>, designed to improve the comprehensive detection of potential natural backdoor vulnerabilities in CodeLMs. We aim for our findings to enhance the understanding of natural backdoor vulnerabilities in CodeLMs and provide valuable insights for strengthening their security against backdoor threats.","PeriodicalId":13324,"journal":{"name":"IEEE Transactions on Software Engineering","volume":"52 10","pages":"2855-2874"},"PeriodicalIF":6.0,"publicationDate":"2026-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148288732","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":1,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Equivalent Mutant Detection Based on Siamese Graph Neural Network","authors":"Lei Hu;Xiangjuan Yao;Changqing Wei;Dunwei Gong;Jie Wu","doi":"10.1109/TSE.2026.3710317","DOIUrl":"10.1109/TSE.2026.3710317","url":null,"abstract":"In recent years, many deep learning techniques have been proposed to address the equivalent mutant problem in mutation testing. However, these approaches often fail to fully exploit the rich graph structural information embedded in source code, thereby limiting their detection effectiveness. To tackle this issue, we propose SGENT, a novel equivalent mutant detection approach based on a Siamese graph neural network architecture. Specifically, each program is first modeled using three complementary graph representations (AST/CFG/DFG) to capture its syntactic, control-flow, and data-flow dependencies, respectively. These graph structures are then encoded using a shared graph attention network to extract intra-graph structural semantic representations. Finally, a Siamese architecture is employed to perform contrastive learning between the original and mutant programs, enabling the model to capture inter-graph differences and determine their equivalence. Experimental results on a benchmark comprising 189,424 labeled mutants from 10 open-source projects show that SGENT achieves an F1 score of 85.28% and an accuracy of 95.30%. Compared with representative baselines, SGENT delivers superior recall and overall F1 performance on project-level datasets. Furthermore, on an unseen external benchmark, SGENT attains the highest recall while maintaining robust F1 performance, demonstrating strong cross-dataset generalization ability.","PeriodicalId":13324,"journal":{"name":"IEEE Transactions on Software Engineering","volume":"52 10","pages":"3180-3197"},"PeriodicalIF":6.0,"publicationDate":"2026-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148414778","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":1,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Better Together: An LLM-Assisted Approach to Designing Software Architectures Using Attribute-Driven Design","authors":"Humberto Cervantes;Rick Kazman;Yuanfang Cai","doi":"10.1109/TSE.2026.3706446","DOIUrl":"10.1109/TSE.2026.3706446","url":null,"abstract":"Designing effective software architectures is a complex, iterative process that traditionally relies on expert judgment. This paper proposes an approach for Large Language Model (LLM)-assisted software architecture design leveraging the Attribute-Driven Design (ADD) method. By providing an LLM with an explicit description of ADD and an architect persona, our method guides the LLM to collaboratively produce a structured iteration plan and a detailed architecture design document. We have validated this approach in two ways: through the comparison of an LLM-generated solution with a proven solution, and through the evaluation of an LLM-generated architecture by a team of four professional architects. We also compare designs produced with and without our ADD-guided approach. Our results show that our LLM-assisted ADD process produces thorough architecture documentation and that the LLM-generated architectures satisfy architectural drivers. We also argue that human feedback and guidance are still needed in the design process, particularly with respect to the most critical and nuanced design decisions.","PeriodicalId":13324,"journal":{"name":"IEEE Transactions on Software Engineering","volume":"52 10","pages":"2970-2985"},"PeriodicalIF":6.0,"publicationDate":"2026-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148314054","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":1,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"AI or Ally? Understanding Student Reliance on GitHub Copilot and Human Peers Through Eye Tracking","authors":"George Salib;Zohreh Sharafi","doi":"10.1109/TSE.2026.3705249","DOIUrl":"10.1109/TSE.2026.3705249","url":null,"abstract":"As AI-powered tools like GitHub Copilot become increasingly integrated into development workflows, it’s essential to understand how developers—particularly novices—interact with these systems compared to traditional peer collaboration. This paper presents a within-subjects eye-tracking study of novice developers completing programming tasks with assistance from either GitHub Copilot or a human peer. We evaluate participants’ task performance, visual attention patterns, and perceived reliance on the assistant. Results show that participants achieved significantly higher correctness scores with Copilot (50%) than with peers (32%), but also spent more time and exhibited higher cognitive load. Participants relied more frequently on Copilot, spending more time fixating on the AI interface, even though they visited the peer chat pane more frequently than Copilot’s. Moreover, subjective responses indicated that Copilot was widely credited with enhancing speed and concentration, whereas opinions on its impact on code quality were more mixed. Visual attention patterns further indicated assistant-specific strategies, with significant differences in how participants navigated code panes, project structures, and error traces depending on the support type. These findings highlight important trade-offs between AI and human support in programming workflows and offer design implications for future intelligent development environments that better balance correctness, trust, and cognitive effort.","PeriodicalId":13324,"journal":{"name":"IEEE Transactions on Software Engineering","volume":"52 10","pages":"2933-2945"},"PeriodicalIF":6.0,"publicationDate":"2026-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148288626","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":1,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"LHGLink: LLM-Enhanced Heterogeneous Graph Learning for Issue–Issue Link Prediction","authors":"Yangyang Zhao;Zhenyu Song;Yibiao Yang;Yuming Zhou;Zuohua Ding","doi":"10.1109/TSE.2026.3707510","DOIUrl":"10.1109/TSE.2026.3707510","url":null,"abstract":"Issue–issue link prediction plays a critical role in supporting software maintenance and evolution by uncovering latent relationships among issues, such as duplicates, dependencies, or related faults. Existing approaches primarily rely on textual similarity or shallow structural features, which often struggle to capture the complex semantic dependencies and rich contextual information inherent in large-scale software repositories. In this study, we propose <italic>LHGLink</i>, a novel framework that integrates LLM-based semantic enhancement with heterogeneous graph representation learning for issue-issue link prediction. LHGLink first leverages large language models to refine and enrich noisy and incomplete issue descriptions, and then performs metapath-guided reasoning over a heterogeneous graph that explicitly models issues, assignees, and components. We conduct extensive experiments on 23 large-scale Apache projects collected from Jira. The results show that LHGLink consistently outperforms state-of-the-art baselines across multiple evaluation metrics, achieving an average AUC of 95.11% and an F1-score of 90.79% with statistically significant improvements. Further analyses indicate that heterogeneous node modeling plays a crucial role: component-related information yields stronger gains than assignee information, and their joint modeling improves the F1-score by up to 12.23% over text-only baselines. In addition, LLM-based text enhancement consistently enriches issue semantics and leads to notable performance gains across projects. Comparisons with representative graph-based learning architectures further confirm the superiority and robustness of LHGLink. Overall, this work demonstrates that combining LLM-enhanced semantic understanding with heterogeneous graph modeling provides an effective solution for issue–issue link recovery.","PeriodicalId":13324,"journal":{"name":"IEEE Transactions on Software Engineering","volume":"52 10","pages":"3019-3039"},"PeriodicalIF":6.0,"publicationDate":"2026-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148342295","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":1,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Corrections to “Women’s Participation in Student Software Development Teams: A Cross-Sectional Study on Role Distribution”","authors":"Claudia Maria Cutrupi;Letizia Jaccheri;Sofia Papavlasopoulou","doi":"10.1109/TSE.2026.3727843","DOIUrl":"https://doi.org/10.1109/TSE.2026.3727843","url":null,"abstract":"This addresses errors in [1].","PeriodicalId":13324,"journal":{"name":"IEEE Transactions on Software Engineering","volume":"52 10","pages":"3235-3235"},"PeriodicalIF":6.0,"publicationDate":"2026-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=11739400","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149188839","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":1,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Not All Synthetic Vulnerabilities Are What You Need for Training Deep Vulnerability Detectors","authors":"Heng Yong;Zhong Li;Minxue Pan;Tian Zhang;Jianhua Zhao;Xuandong Li","doi":"10.1109/TSE.2026.3709977","DOIUrl":"https://doi.org/10.1109/TSE.2026.3709977","url":null,"abstract":"Synthetic vulnerabilities have gained increasing attention in recent years for addressing the class imbalance issue in deep vulnerability detector training datasets, thereby boosting detector training. Despite their promise, existing work generally employs all available synthetic vulnerabilities indiscriminately, leaving a fundamental question under-explored: are all synthetic vulnerabilities beneficial for detector training? To bridge this gap, we empirically demonstrate a non-monotonic relationship between detector performance and the quantity of synthetic vulnerabilities, which we attribute to the limited diversity of synthetic samples, both internally and relative to the original training data. Motivated by these observations, we propose <sc>DiVuse</small>, a novel method for selecting synthetic vulnerabilities to better train deep vulnerability detectors. Specifically, <sc>DiVuse</small> evaluates synthetic vulnerabilities using intra-dataset and inter-dataset similarity to select a maximally diverse subset for detector training. Our extensive experiments on four deep vulnerability detectors and three synthetic vulnerability datasets demonstrate that <sc>DiVuse</small> outperforms seven baseline approaches across various settings.","PeriodicalId":13324,"journal":{"name":"IEEE Transactions on Software Engineering","volume":"52 10","pages":"3146-3165"},"PeriodicalIF":6.0,"publicationDate":"2026-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149188589","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":1,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"From Open Source to Industry: A Replication Study of AAA Test Structure in Envestnet","authors":"Chenhao Wei;Sunny Wong;Lu Xiao","doi":"10.1109/TSE.2026.3710992","DOIUrl":"10.1109/TSE.2026.3710992","url":null,"abstract":"The Arrange-Act-Assert (AAA) pattern, a unified structure for organizing unit tests, is widely recognized for better comprehension and maintenance of tests. However, its adoption in commercial software development remains insufficiently understood. This study investigates how the AAA pattern is practiced in industrial settings by examining test cases from Envestnet Inc. (ENV), adapting automated AAA tagging techniques, and comparing AAA-related issues between commercial and open-source software (OSS) projects. We enhanced a machine learning-based AAA tagging model, previously applied to OSS, to suit ENV domain-specific codebases. We then analyzed AAA adherence and issue distribution across three ENV projects, followed by developer interviews to uncover root causes and assess refactoring strategies. The adapted tagging model achieved F1 scores of 0.75, 0.77, and 0.73 for Arrangement, Action, and Assertion, respectively. Compared with seven open-source projects (25.17%), ENV projects exhibited a significantly lower prevalence of AAA issues (15.68%, <inline-formula><tex-math>$boldsymbol{p},mathbf{=,0.034}$</tex-math></inline-formula>, Cohen’s <inline-formula><tex-math>$boldsymbol{d},mathbf{=,1.64}$</tex-math></inline-formula>). Interviews with developers further illuminated the underlying causes of these violations—such as production–test co-evolution and unfamiliarity with certain testing APIs—and highlighted nuanced refactoring strategies that carefully balance structural consistency, code clarity, and test performance. These nuances, however, did not emerge in our earlier investigations of open-source projects. This study demonstrates that incorporating domain-specific data to fine-tune pre-trained models like CodeBERT, alongside context-aware features, enables accurate AAA analysis. ENV projects have significantly fewer AAA issues than OSS, with distinct patterns such as the absence of Multiple Acts and the prevalence of Assert Precondition. Developer interviews reveal practical motivations behind AAA deviations and inform context-sensitive refactoring strategies. These findings provide actionable guidance for improving test structure and developing automated refactoring tools in practice.","PeriodicalId":13324,"journal":{"name":"IEEE Transactions on Software Engineering","volume":"52 10","pages":"3214-3234"},"PeriodicalIF":6.0,"publicationDate":"2026-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148401136","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":1,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"A Lightweight Defense Against Code Poisoning Attacks Based on Code Naturalness","authors":"Mengzhe Yuan;Weisong Sun;Yuchen Chen;Chunrong Fang;Zhenpeng Chen;Peizhuo Lv;Wenbo Guo;Yang Liu;Baowen Xu;Zhenyu Chen;Yanhui Li","doi":"10.1109/TSE.2026.3705037","DOIUrl":"10.1109/TSE.2026.3705037","url":null,"abstract":"Neural code models (NCMs) have demonstrated extraordinary capabilities in code intelligence tasks. Meanwhile, the security of NCMs and NCMs-based systems has garnered increasing attention. In particular, NCMs are often trained on large-scale data from potentially untrustworthy sources, providing attackers with the opportunity to manipulate them by inserting crafted samples into the data. This type of attack is called a code poisoning attack (also known as a backdoor attack). It allows attackers to implant backdoors in NCMs and thus control model behavior, which poses a significant security threat. However, there is still a lack of effective techniques for detecting various complex code poisoning attacks. In this paper, we propose an innovative and lightweight technique for code poisoning detection named <small>DetBadCode</small>. <small>DetBadCode</small> is designed based on our insight that code poisoning disrupts the naturalness of code. Specifically, <small>DetBadCode</small> first builds a code language model (CodeLM) on a lightweight <inline-formula><tex-math>${boldsymbol n}$</tex-math></inline-formula>-gram language model. Then, given poisoned data, <small>DetBadCode</small> utilizes CodeLM to identify those tokens in (poisoned) code snippets that will make the code snippets more natural after being deleted as trigger tokens. Considering that the removal of some normal tokens in a single sample might also enhance code naturalness, leading to a high false positive rate (FPR), we aggregate the cumulative improvement of each token across all samples. Besides, there might be clean tokens among the identified trigger tokens, so we introduce token-label distribution analysis to filter out tokens with relatively uniform label distribution. Finally, <small>DetBadCode</small> purifies the poisoned data by removing all poisoned samples containing the identified trigger tokens. Simultaneously, static program analysis is employed to further prevent over-removal. We conduct extensive experiments to evaluate the effectiveness and efficiency of <small>DetBadCode</small>, involving two types of advanced code poisoning attacks (a total of five poisoning strategies) and datasets from four representative code intelligence tasks. The experimental results demonstrate that across 20 code poisoning detection scenarios, <small>DetBadCode</small> achieves an average FPR of 8.30% and an average Recall of 100%, significantly outperforming four baselines. More importantly, <small>DetBadCode</small> is very efficient, with a minimum time consumption of only 5 minutes, and is 25 times faster than the best baseline on average.","PeriodicalId":13324,"journal":{"name":"IEEE Transactions on Software Engineering","volume":"52 10","pages":"2894-2912"},"PeriodicalIF":6.0,"publicationDate":"2026-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148288754","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":1,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"LRNNet: Complementary Cloud API Recommendation With Abductive Correction via Logical Reasoning Neural Network","authors":"Zhen Chen;Haonan Liao;Mengmeng Sun;Dianlong You;Yueshen Xu;Xindong Wu","doi":"10.1109/TSE.2026.3705144","DOIUrl":"10.1109/TSE.2026.3705144","url":null,"abstract":"Cloud API recommendation systems play a vital role in tackling cloud API overloading issue and promoting a healthy API ecosystem. Recent studies mainly focus on user preferences, search keywords, and QoS, yielding API recommendations that satisfy single functional requirements or optimize non-functional QoS requirements in service-oriented software development. However, existing cloud API recommendation methods still face three key limitations: 1) insufficient support for practical complementary cloud API requirements in service-oriented software development; 2) inability to handle weak complementary relations and filter out substitute noise in modeling complementary relationships; and 3) lack of a post-recommendation verification and refinement mechanism to further improve recommendation results. To address these issues, we propose LRNNet, a Logical Reasoning Neural Network for complementary cloud API recommendation with abductive correction. LRNNet works in two phases: complementary recommendation and abductive correction. In the complementary recommendation phase, Beta probability embedding encodes query cloud APIs to facilitate logical reasoning. Subsequently, a logical reasoning unit, composed of projection, negation, and intersection logic operators, captures complementary relationships and mitigates substitute noise, and yields results complementary to the query. In the abductive correction phase, an abductive task is formulated to deduce potential reasons behind recommendation results. By backpropagating an abductive loss signal, the results are refined by minimizing the difference between predicted and true reasons. We conducted extensive experiments using two real-world cloud API datasets, demonstrating that LRNNet outperforms comparative SOTA baselines. Ablation studies and hyperparameter sensitivity analyses also confirm LRNNet’s effectiveness and practicality. The implementation code is publicly available at <uri>https://github.com/lhnngp/LRNNet</uri>.","PeriodicalId":13324,"journal":{"name":"IEEE Transactions on Software Engineering","volume":"52 10","pages":"2913-2932"},"PeriodicalIF":6.0,"publicationDate":"2026-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148288756","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":1,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}