The success of large language models for code relies on vast amounts of code data, including public open-source repositories, such as GitHub, and private, confidential code from companies. This raises concerns about intellectual property compliance and the potential unauthorized use of license-restricted code. While membership inference (MI) techniques have been proposed to detect such unauthorized usage, their effectiveness can be undermined by semantically equivalent code transformation techniques, which modify code syntax while preserving semantic. In this work, we systematically investigate whether semantically equivalent code transformation rules might be leveraged to evade MI detection. The results reveal that model accuracy drops by only 1.5% in the worst case for each rule, demonstrating that transformed datasets can effectively serve as substitutes for fine-tuning. Additionally, we find that one of the rules (RenameVariable) reduces MI success by 10.19%, highlighting its potential to obscure the presence of restricted code. To validate these findings, we conduct a causal analysis confirming that variable renaming has the strongest causal effect in disrupting MI detection. Notably, we find that combining multiple transformations does not further reduce MI effectiveness. Our results expose a critical loophole in license compliance enforcement for training large language models for code, showing that MI detection can be substantially weakened by transformation-based obfuscation techniques.

翻译：面向代码的大型语言模型的成功依赖于海量代码数据，包括公开的开源代码库（如GitHub）以及企业的私有机密代码。这引发了关于知识产权合规性及潜在未经授权使用许可受限代码的担忧。虽然已有成员推断技术被提出用于检测此类未经授权的使用，但其有效性可能受到语义等价代码变换技术的削弱，这类技术能在保持语义不变的前提下修改代码语法。本研究系统性地探究了语义等价代码变换规则是否可能被用于规避成员推断检测。结果表明，在最坏情况下每条规则仅导致模型准确率下降1.5%，证明变换后的数据集能有效作为微调的替代品。此外，我们发现其中一条规则（RenameVariable）使成员推断成功率降低10.19%，凸显其掩盖受限代码存在的潜力。为验证这些发现，我们进行了因果分析，证实变量重命名对破坏成员推断检测具有最强的因果效应。值得注意的是，我们发现组合多种变换并不会进一步降低成员推断的有效性。我们的研究结果揭示了代码大模型训练中许可合规性执行的关键漏洞，表明基于变换的混淆技术可显著削弱成员推断检测能力。