---
title: Source Code Authorship Attribution
url: https://www.emergentmind.com/topics/source-code-authorship-attribution-scaa
type: topic
---

# Source Code Authorship Attribution

Source Code Authorship Attribution (SCAA) is the computational task of inferring the author of a code sample—at the file, fragment, project, or even binary level—by exploiting stylistic, structural, or semantic coding patterns. SCAA has direct applications in software forensics, plagiarism detection, malware lineage tracing, and intellectual property litigation. While methods span classic stylometry, deep learning, robust adversarial modeling, and large language models, the field faces unique challenges due to the highly structured, variable, and obfuscatable nature of source code.

## 1. Technical Foundations and Problem Formulation

SCAA formalizes the problem as a multiclass supervised classification over a closed—or, less often, open—set of candidate authors. Given a training corpus of source code samples $C = \{c_1, ..., c_N\}$ with author labels $A = \{a_1, ..., a_M\}$ and an unseen code sample $c^*$, the goal is to construct a function $f: C \to A \cup \{“unknown”\}$ that correctly assigns $c^*$ to its true author or abstains. Classification accuracy, precision, recall, and $F_1$ score are standard metrics, typically macro- or micro-averaged over $A$ [2001.11593]. Some systems also support confidence-calibrated output for "open-world" rejection, e.g., rejecting low-confidence attributions [1701.05681].

SCAA can target whole files, small incomplete fragments, or binary executables [1512.08546]. Multi-author segments, code written by groups or with heavy borrowing, present a further complication addressed by tailored modeling [2212.05610]. Adversarial rejection (i.e., prediction under style obfuscation or adversarial perturbation) is now a central focus [2304.13255][1905.12386].

## 2. Stylometric and Syntactic Feature Engineering

Early and continuing lines of SCAA research rely on coding style ("stylometry") as found in layout, identifier naming, indentation, and syntactic habits. Features fall into several broad categories:

- **Lexical**: word n-grams, character n-grams [1701.05681][2101.12384], token frequency, API symbols, comment ratios.
- **Syntactic**: AST (abstract syntax tree) node frequencies, syntactic bigrams, subtree depth distributions, parse tree statistics [2001.11593][2406.19896].
- **Structural**: control-flow graph node counts, statement and block types, function parameter patterns.
- **Layout/Style**: whitespace ratios, brace placement, comment density, line length, indentation habits [2212.05610][2406.19896].
- **Semantic/Dynamic**: binary disassembly length, execution-time/memory usage, code complexity metrics [2406.19896].
  
Feature selection is commonly performed via information gain, mutual information [1512.08546][2001.11593], or discriminative filtering to reduce high cardinality (often hundreds of thousands of initial features). Language-agnostic approaches using AST paths and path-contexts (e.g., code2vec representations) have demonstrated cross-language portability [2001.11593]. In practice, a hybrid combination of these features provides the most robust performance, particularly when supported by interpretation tools such as SHAP for tree-based models [2406.19896].

Surface features—such as identifiers—have ambiguous effects: certain identifier types (notably class/object names) can be highly discriminative, whereas method and simple variable names often add noise; globally renaming all user-defined identifiers can actually increase overall credit assignment by removing generic, non-informative tokens [2101.12384].

## 3. Learning Architectures and Attribution Pipelines

The primary supervised learning paradigms for SCAA span classic machine learning, deep neural networks, ensemble stacking, and—emergently—transformer-based language models:

**Traditional ML:**
- **Random Forests**: frequently used with token/AST-path features; ensemble voting provides robust multiclass outputs [1701.05681][1512.08546][2406.19896]. Feature importances can be directly interpreted.
- **SVMs, XGBoost, Gradient Boosting**: used for higher-dimensional or structured feature vectors.
- **SCAP (Source Code Author Profiles)**: n-gram intersection between author “profiles” and code sample [2101.12384].

**Deep Learning:**
- **DNNs/LSTMs/RNNs**: sequence and bag-of-token features; bi-LSTM encoders combine n-gram/statistical input; softmax for multiclass output [2304.13255][2202.06043].
- **CNNs**: 1D convolutions over n-gram or embedding sequences for encoding syntax and order [2304.13255].
- **Stacked (Ensemble) Models**: Multiple heterogeneous base classifiers (RF, SVM, DNN variants), outputs concatenated as meta-features and ingested by a second-level neural meta-learner, consistently yield higher accuracy, especially in the multi-author scenario [2212.05610].

**Language-Aware Transformers:**
- **CodeBERT, GraphCodeBERT, UniXcoder, Code Llama, DeepSeek-Coder**: encoder, graph-aware, and decoder models fine-tuned to predict authorship from code tokens; code LLMs require careful hyperparameter tuning (batch size, learning rate, LoRA) and sometimes necessitate input chunking for long code [2506.17120].
- **LLM Zero-/Few-Shot Prompting**: Off-the-shelf LLMs (GPT-4o, Gemini 1.5-Pro, etc.) can perform attribution with “same-author verification” or few-shot identification via in-context learning. Tournament-style querying can scale attribution to hundreds of authors under context limitations [2501.08165].
- **Transformer Head Adaptation**: Custom decoderless transformer heads (e.g., CodeT5-JSA for JavaScript) can dramatically improve multi-class attribution performance, especially for code generated by LLMs [2510.10493].

## 4. Empirical Performance and Dataset Considerations

Reported SCAA accuracy varies by language, number of authors, fragment granularity, feature set, and learning architecture:

| Dataset / Model                 | # Authors | # Samples | Accuracy (Top-1) | Reference       |
|----------------------------------|-----------|-----------|------------------|-----------------|
| GCJ C++ (RF, LSTM, DNN)         | 100–200   | 900–1800  | 88–96%           | [1512.08546][2304.13255][1701.05681] |
| GitHub/Competitive C++ (RF)     | 50        | 300–1000  | 65%              | [1512.08546]    |
| Python/Java/Multilingual        | 70–200    | 1000–2500 | 88–98%           | [2001.11593][2202.06043] |
| LLM Prompting (C++/Java, LLM Tournament) | 500–686    | 26,000–55,000 | 65–69%           | [2501.08165]    |
| Multi-author segments (Python, Stacking Ensemble) | 8 (groups) | 6063    | 87%             | [2212.05610]    |
| Small, incomplete fragments     | 106       | ~100 / author | 60–75% (single); 99% (multi-aggregated) | [1701.05681] |
| JavaScript (LLM-NodeJS, CodeT5-JSA) | 5 / 10 / 20 | 250,000 | 95.8% / 94.6% / 88.5% | [2510.10493]    |

On clean, single-author data with language/style-constrained contexts, state-of-the-art models regularly attain near-perfect accuracy. When evaluated in context-separated, temporally-separated, or multi-author conditions, accuracy can fall to 20–30% [2001.11593][2212.05610]. Models trained on realistic industry datasets, where author style evolves and project conventions dominate, are much less accurate than on synthetic or balanced problems.

## 5. Security, Robustness, and Adversarial Perspectives

SCAA models—regardless of method—are highly vulnerable to adversarially crafted, semantics-preserving code transformations. Black-box code insertion (e.g., dead code snippets, unreachable branches), Monte Carlo Tree Search–guided transformation sequences, and automatic style imitation can reduce attribution accuracy to near-random (≤1–5%) [1905.12386][2304.13255]. Targeted attacks (impersonation of another author) show 66–88% success rates on standard methods when only a few semantically null lines are added [2304.13255].

Defenses investigated include:

- **Adversarial Training**: Augmenting training data with perturbed/adversarial examples, as in RoPGen, reduces attacker success rates by 22–41% [2202.06043].
- **Normalize-and-Predict (N&P)**: Preprocessing all code via deterministic normalization provably blocks whole classes of relational (equivalence-class–based) attacks, with robust accuracy gains of 45–70 pp over vanilla or adversarially trained deep networks [2007.00772].
- **Structural/Deep Stylometry**: Moving from surface features to AST/data-flow–based signatures increases robustness under obfuscation [2510.10493].
- **Prompt Engineering**: LLMs prompted to focus on “persistent author-specific traits” can partially resist style-transfer attacks, with resilience improving by ~10 pp [2501.08165].

However, no known transformation offers universal $k$-anonymity for code authorship: the problem is formally undecidable due to the equivalence problem for Turing-complete languages [2208.12553]. The weaker measure of $k$-uncertainty (closeness of attribution confidences for $k$ authors) can be increased empirically with heavy obfuscation (as with Tigress), but even sophisticated transformations only yield practical privacy on select datasets and can often be neutralized when the attacker adapts classifier training [2208.12553].

## 6. Limitations, Open Problems, and Future Directions

A number of critical research directions are highlighted in the literature:

- **Multi-author and Mixed-style Segments**: Attribution for segments co-authored or containing heavily borrowed code is largely unsolved; ensemble stacking marginally increases accuracy for group labels, but with unknown scalability beyond small cases [2212.05610].
- **Cross-language, Multi-project, and Context Variation**: SCAA performance degrades when training and testing across different projects, time intervals, or language boundaries. Generalization remains an open challenge [2001.11593].
- **Evolving Coding Style (Temporal Drift)**: Developers’ patterns change over time; models trained on early commits underperform on later contributions [2001.11593].
- **Open-world and Unknown-author Attribution**: Explicit mechanisms for “author unknown” submission remain limited to confidence thresholding; calibration curves improve robustness but may discard valid predictions [1701.05681][1512.08546].
- **Binary/Obfuscated Attribution**: Machine learning on decompiled binaries, combining disassembly n-grams, ASTs, and statistical distributions, is effective with 65–96% accuracy over 50–100 known authors even after compilation, optimization, and moderate obfuscation [1512.08546].
- **Privacy/Defensive Transformations**: General, automated $k$-anonymizing (or high $k$-uncertainty) transformations are provably impossible. Practical privacy mechanisms require black-box adversarial awareness, extensive code rewriting, and continual arms-race adaptation [2208.12553].
- **Interpretability and Plagiarism Analysis**: SHAP and integrated gradients provide model-level explanation of decisive stylometric cues, supporting forensic evidence and diagnosis of authorship features [2406.19896][2506.17120].
- **Scalability**: Systems such as LLM tournament-based few-shot attribution enable scaling to hundreds of authors, but efficient attribution at greater scale, in streaming or evolving corpora, with provable calibration, remains unresolved [2501.08165].

A plausible implication is that ensemble, explainable, and normalization-augmented models, supported by adversarial training, currently define the frontier for robust, high-accuracy authorship attribution in practical settings. Open challenges remain in non-cooperative, real-world environments, where project, temporal, and author multiplicity conspire with adversarial activity to limit attribution confidence and reliability.

## 7. Key Resources and Selected Comparative Results

| Approach                    | Language(s) | Author Classes | Adversarial Robustness | Key Strengths                  | Reference        |
|-----------------------------|-------------|----------------|-----------------------|-------------------------------|------------------|
| RF/AST/CFG + DNN ensemble   | Python      | 8 (groups)     | Not evaluated         | Multi-author, stacking gain    | [2212.05610]     |
| CNN/RNN/Stylometry          | C++         | 200            | Weak                  | High clean accuracy            | [2304.13255]     |
| RoPGen (Adversarial Training)| C/C++/Java | 40–204         | Improves 22–41%       | Reduces attack success rate    | [2202.06043]     |
| Language-agnostic PbRF, PbNN| Java/C++/Py | 40–1600        | Not robust to context | High accuracy (benchmarks)     | [2001.11593]     |
| LLM tournament/few-shot     | C++/Java    | 500–686        | Partial               | Zero-/few-shot generalization  | [2501.08165]     |
| Structural Transformer (CodeT5-JSA) | JS | 5–20 (LLMs)     | Effective             | Robust to mangling, scalable   | [2510.10493]     |
| Normalize-and-Predict       | C++         | 204            | 70% gain, provable    | Efficient, adversarial defense | [2007.00772]     |
| Binary attribution          | C/C++       | 50–600         | Moderate              | Works post-compile, stripped   | [1512.08546]     |

These results reflect progress from classic stylometric techniques to advanced neural and transformer approaches, with special attention to design for interpretability, scalability, and adversarial resilience. Continuous evaluation on realistic cross-context, multi-author, and adversarially perturbed corpora is necessary for future progress in source code authorship attribution.

Source: https://www.emergentmind.com/topics/source-code-authorship-attribution-scaa