To What Extent do Deep Learning-based Code Recommenders Generate Predictions by Cloning Code from the Training Set?

TL;DR

This study investigates whether deep learning-based code recommenders predominantly clone training set code, impacting licensing considerations, and finds that a small but significant percentage of predictions are exact clones, especially for shorter code snippets.

Contribution

It provides the first large-scale analysis quantifying the extent of code cloning in DL-based code completion tools, informing licensing and originality concerns.

Findings

Approximately 0.1% to 10% of predictions are exact clones of training data.

Longer code predictions are less likely to be clones.

Cloning prevalence varies with the size of the predicted code.

Abstract

Deep Learning (DL) models have been widely used to support code completion. These models, once properly trained, can take as input an incomplete code component (e.g., an incomplete function) and predict the missing tokens to finalize it. GitHub Copilot is an example of code recommender built by training a DL model on millions of open source repositories: The source code of these repositories acts as training data, allowing the model to learn "how to program". The usage of such a code is usually regulated by Free and Open Source Software (FOSS) licenses, that establish under which conditions the licensed code can be redistributed or modified. As of Today, it is unclear whether the code generated by DL models trained on open source code should be considered as "new" or as "derivative" work, with possible implications on license infringements. In this work, we run a large-scale study investigating the extent to which DL models tend to clone code from their training set when recommending code completions. Such an exploratory study can help in assessing the magnitude of the potential licensing issues mentioned before: If these models tend to generate new code that is unseen in the training set, then licensing issues are unlikely to occur. Otherwise, a revision of these licenses urges to regulate how the code generated by these models should be treated when used, for example, in a commercial setting. Highlights from our results show that ~$10% to ~0.1% of the predictions generated by a state-of-the-art DL-based code completion tool are Type-1 clones of instances in the training set, depending on the size of the predicted code. Long predictions are unlikely to be cloned.