Bachelor and Master Theses

Background

Modern software development increasingly relies on AI-based tools to automatically detect bugs and vulnerabilities in source code. Models such as CodeBERT and GraphCodeBERT are transformer-based neural networks trained on millions of lines of code and can identify defects with high accuracy. However, these models are black boxes: when the model flags a piece of code as buggy, developers cannot easily understand why. Which parts of the code did the model look at? What relationships between code elements — variables, function calls, loop conditions — did it use to reach its conclusion?

Answering these questions requires more than just highlighting important tokens. A bug is rarely caused by a single token in isolation — it typically involves a relationship between code artifacts. A null pointer dereference involves a pointer declaration and a use without a null check. A buffer overflow involves an array size and a loop bound. Understanding which relationships the model captures is essential for trusting, debugging, and improving AI-based defect detection.

Research Idea

Probabilistic Activation Flow (PAF) is a recently developed neural network explanation method that propagates a probability distribution backward through every layer of the network simultaneously, satisfying exact mass conservation at every step. PAF has been developed and evaluated on image classifiers and vision transformers, where it produces spatially precise attribution maps.

This thesis proposes extending PAF to transformer-based code defect detection models such as CodeBERT and GraphCodeBERT.  The extension includes the design and implementation  of PAF-extension, validates it against existing attribution baselines, and evaluates whether PAF's unique properties provide new insight into what relationships between code artifacts transformer-based defect detectors rely on.

The extended PAF would produce not only a token-level attribution map (which tokens were important) but also a relational attribution graph over code tokens: a probabilistic representation of which inter-token relationships the model relied on when making its prediction. This could reveal, for example, that the model detected a null pointer dereference by routing attribution mass between the pointer declaration on line~5 and its unchecked use on line~23, a relational insight that may not be available by existing attribution methods. Whether this relational information faithfully reflects the model's actual decision process, and whether it aligns with established program dependence structure, are the central empirical questions this thesis investigates.

Publication Potential

Strong results from this thesis will be targetted for submission to reputed conference/journal venues, with the student listed as co-author

Strong Python and PyTorch skills, familiarity with transformer architectures (BERT, attention mechanisms), basic knowledge of software engineering concepts, and interest in explainable AI and software engineering