ProCURE: Addressing the Programming Concept Understanding Gap for Code Generation in LLMs via Concept-Aware Consistency Learning

1 Introduction

Large language models (LLMs) have demonstrated promising performance in code generation tasks, marking a new paradigm for programming [Zhang et al., 2023; Sch¨afer et al., 2023; Abdin et al., 2024]. However, whether LLMs can truly understand code remains an open question. Such understanding is a prerequisite for users to reliably and confidently employ LLMs in code-related tasks, ensuring controllability and trustworthiness. Consequently, in-depth evaluation and enhancement of LLMs' code understanding ability has emerged as a critical research direction for the community.

∗Corresponding author.

Existing works [Ma et al., 2023; Orvalho and Kwiatkowska, 2025] revealed that LLMs have the potential to grasp code syntax but do not understand the semantics correctly. Even worse, recent research [Hooda et al., 2024] highlighted a fundamental limitation: LLMs lack sufficient understanding of Programming Concepts Predicates 1 , including how variables are managed in memory, how execution flows across constructs, and how code segments combine to perform computations. As illustrated in Figure 1, the figure presents a representative failure case in which a model becomes confused when control-flow variations are introduced within the code prefix.

However, effective solutions that explicitly target programming concept understanding are urgently needed, yet largely absent in existing work. Most prior approaches focus on improving robustness through surface-level perturbations and adversarial training [Bielik and Vechev, 2020; Luo et al., 2025], or fine-tune models for other objectives such as security [He et al., 2024], without explicitly modeling programming concepts or enforcing consistent behavior under concept-level variations. To bridge this gap, we propose a novel framework PROCURE ( Programming Concept UndeRstanding Enhancement), which enhances programming concept understanding via concept-aware consistency learning. PROCURE consists of two stages. In the first stage, we construct a concept-aligned dataset through a fully automated, LLM-assisted pipeline, where concept-oriented perturbations are generated using enriched one-shot chain-ofthought prompts augmented with static code analysis signals. In the second stage, we perform concept-aware fine-tuning with a concept-sensitive consistency loss that emphasizes concept-relevant tokens, encouraging the model to respond consistently to fine-grained programming concept variations while preserving functional correctness.

1 Throughout this paper, we use the term programming concepts to denote programming concept predicates for brevity.

We conduct a comprehensive evaluation on open-source LLMs, including Llama3.1-8B, CodeLlama-13B, StarCoder7B, and Mistral-7B, using three widely recognized benchmark datasets: HumanEval, MBPP, and CodeContests, which span a diverse range of programming challenges. Experimental results show that PROCURE improves CCScore by an average of 17.9 points, demonstrating its effectiveness in enhancing programming concept understanding and providing new insights for code augmentation and robust training in downstream code-related tasks. In summary, our contributions are outlined as follows:

• We propose PROCURE, a concept-aware consistency learning framework that enhances programming concept understanding in LLMs, which is, to the best of our knowledge, the first to explicitly target this problem.
• Extensive experiments show the effectiveness of PROCURE, improving CCScore by an average of 17.9 points.
• We release ConceptEval 2 , a new benchmark for evaluating programming concept understanding.

2 Preliminary

2.1 LLM-based Code Generation

LLM-based code generation [Jiang et al., 2025] formulates source code generation as an autoregressive process conditioned on natural language, source code, or both. Given an input token sequence T = [t1, . . . , tM], an LLM generates code by iteratively estimating the conditional probability of the next token:

where Y = [y1, . . . , yN] denotes the generated token sequence. Among various code generation tasks, code completion is one of the most widely studied settings, where T consists of a functional instruction and a partial program. Following [Hooda et al., 2024], we adopt code completion to evaluate LLMs' understanding of programming concepts, as it directly tests whether models can appropriately adapt their generation to concept-level variations in the input.

2.2 Programming Concepts

Programming Concepts refer to the properties of specific program elements such as variables, data values, data paths, and execution paths, considered from a holistic, program-wide perspective [Hooda et al., 2024; Hoare, 1969]. These concepts may describe, for example, the value range of a variable at a specific location, whether control flow can reach one function location from another, or whether a value assigned to a variable may later be used elsewhere (i.e., data-flow or control-flow). Prior work identifies four major themes -control flow [Allen, 1970; Yang et al., 2015], data flow [Nilsson-Nyman et al., 2009; Fosdick and Osterweil, 1976], identifier names [Lin and Wu, 2008], and data types [Allamanis et al., 2020; Dart and Zobel, 1992]-and proposes a representative set of programming concepts that cover these themes:

• Control Flow describes the execution order of statements governed by control structures. Perturbing a control condition (e.g., in an if statement) requires adjusting the corresponding execution path.
• Data Flow ensures variable references are in scope and live at their use sites, preserving correct data dependencies and value propagation.
• Data Types constrain the set of valid values and operations for variables; type correctness must be maintained to ensure semantic soundness.
• Identifier Naming refers to the symbolic names of variables. While not affecting semantics, consistent renaming is necessary to preserve referential correctness.
• Statement Order captures cases where independent statements without mutual data or control dependencies can be reordered without affecting program behavior.

In this work, we follow the problem formulation of prior study [Hooda et al., 2024] that identifies the programming concept understanding gap in LLMs. Specifically, we focus on weakly typed programming languages (e.g., Python), where type information is either implicit or dynamically resolved at runtime. Consequently, our analysis centers on the four programming concepts introduced above, excluding data types.

What It Means to Understand Programming Concepts? Understanding a programming concept means that when a concept-oriented change occurs at a specific program location, an appropriate response can be made based on the underlying programming logic to preserve the program's intended functionality. Let P = ⟨l1, l2, . . . , ln⟩ be a program of n lines, with its overall functionality denoted by �P� = F . Let E = {e1, . . . , em} be the set of m program elements. Suppose a program element ej ∈ E is modified at line k (1 ≤ k ≤ n), resulting in an intermediate program P ⊕∆(ej). Understanding a programming concept implies that an appropriate transformation TC(ej) can be applied, which rewrites only the lines within the impact region C(ej) ⊆ {lk+1, . . . , ln}, such that:

In Equation (1), the transformation TC(ej), guided by the semantics of the corresponding programming concept, compensates for the effect of ∆(ej) by refactoring only the affected lines, thereby preserving the original functionality F.

2 https://github.com/hnurxn/Counterfactual Benchmark

When applied to LLMs, this definition implies that given a functional instruction and a code prefix, the model should adapt its completion to concept-related changes in the prefix while preserving the intended functionality. However, existing LLMs exhibit limited understanding of such programming concepts, and effective solutions remain lacking. Addressing this gap constitutes the primary motivation of our work.

3 Framework: PROCURE

3.1 Overview

As illustrated in Figure 2, we first develop an automated concept-oriented perturbation engine that systematically applies transformations to input programs with respect to specific programming concepts. Each transformation generates a perturbed variant paired with the original program, and all such pairs collectively form a concept-aligned dataset. Built upon this dataset, we perform joint optimization during finetuning, where the standard training objective is augmented with a concept-sensitive consistency objective that emphasizes concept-relevant regions. This optimization encourages the model to preserve functional correctness while appropriately responding to concept-level variations, thereby enabling LLMs to internalize programming concepts and exhibit consistent behavior under concept-oriented changes.

3.2 Concept-oriented Perturbation Engine

As illustrated in Figure 3, we present the pipeline of LLMassisted Concept-Oriented Perturbation Engine. It consists of two core components: (1) efficient and effective prompt construction for concept-oriented perturbation generation, and (2) automatic validation of the generated perturbations to ensure semantic correctness. By repeatedly applying this pipeline to the original programs, we construct a high-quality conceptaligned dataset for subsequent concept-aware fine-tuning.

Concept-Guided Prompt Construction. The perturbation engine is driven by a set of concept-specific perturbation strategies that modify targeted structural aspects of a program while preserving function equivalence. Following prior work [Hooda et al., 2024; Ma et al., 2024], we consider five representative strategies: If-Else Flip, Def-Use Break, Independent Swap, Name Random, and Name Shuffle. To guide the LLM toward generating valid and concept-aligned perturbations, we perform concept-specific static analysis on the input program and incorporate the extracted signals into the prompt. We further augment the prompt with chain-of-thought reasoning and a one-shot example to improve generation reliability. Details of the perturbation rules, illustrative examples, and the complete prompt template are provided in the Supplementary Material. Results Validation. After the LLM generates a perturbed candidate, we apply an automated validation procedure to determine whether it constitutes a valid function-preserving transformation. The procedure follows a two-stage design, consisting of a fast, execution-free filtering stage followed by unit test validation.

Fast Heuristic Filtering. We first apply lightweight checks to quickly eliminate invalid or redundant candidates without executing the program. Specifically, we discard candidates that are identical to the original program based on hash comparison, or that contain syntax errors detected via AST parsing. For the remaining candidates, we examine structural differences: if the abstract syntax trees are identical, or if the control flow graphs remain unchanged despite syntactic variations, the candidate is accepted as a valid perturbation at this stage. Unit Test Validation. Candidates that pass heuristic filtering but whose semantic equivalence remains uncertain are further validated through unit test execution. Each original program is associated with a set of functional test cases, and a perturbed

Input: Dataset Dcombine, learning rate η, number of epochs E Output: Fine-tuned model parameters θFT 1 Initialize model parameters θ; 2 for e = 1 to E do 3 Shuffle Dcombine; 4 foreach mini-batch B sampled from Dcombine do 5 Partition B into original samples Bori and concept-aligned samples Bcon; 6 Compute the standard NLL loss Lstd on Bori; 7 foreach concept-aligned sample (ic , oc ) ∈ Bcon do 8 Compute masked token loss Ltoken; 9 Compute attention-guided loss Lattn; 10 end 11 Compute the overall batch loss: Lbatch = Lstd + Ltoken + Lattn; 12 Update model parameters: θ ← θ - η · ∇θLbatch; 13 end 14 end 15 return θFT

variant is accepted only if it passes all tests. Candidates failing any test are rejected.

Concept-Aligned Dataset Construction. All validated perturbations are paired with their corresponding original programs to form concept-aligned program pairs. For each pair, we annotate the transformation locations at the token level on the perturbed variant using difflib 3 , explicitly identifying tokens modified by the concept-oriented perturbation. The resulting collection of annotated pairs constitutes our concept-aligned dataset, which serves as training data for concept-aware finetuning and as the basis for constructing an evaluation benchmark.

3.3 Concept-Aware Fine-Tuning

We propose a concept-aware fine-tuning strategy that jointly optimizes standard task learning and programming concept understanding. The core idea is to integrate concept-aware data sampling with a concept-sensitive loss, enabling the model to learn task-specific generation behavior while consistently responding to programming concept variations.

Concept-Aware Data Sampling. Given an original dataset Dori = {(ij, oj)}, where each input ij = (h, x) consists of a functional instruction h and a code prefix x, and oj = y denotes the corresponding target completion, and a set of programming concepts C = {c1, c2, . . . , cn}, we construct a concept-aligned dataset Dcon = {(ick j , ock j )} by applying concept-oriented perturbations with respect to each ck ∈ C. Both the input and output are transformed in a conceptconsistent manner to preserve the program functionality.

We define the combined training dataset as:

3 https://docs.python.org/3/library/difflib.html

Each entry in Dcombine consists of one original example and its associated concept-aligned variants, all sharing the same underlying functionality. To ensure joint exposure to both sample types during training, we adopt a structured batch construction strategy. Specifically, each mini-batch B is formed as:

where |B| denotes the total batch size. This design ensures that original and concept-aligned samples are jointly optimized within each parameter update.

Concept-Sensitive Loss Function. Given the mixed nature of the training data, we employ a joint optimization objective composed of two complementary loss components. Original samples focus on learning correct task behavior, while concept-aligned samples explicitly encourage sensitivity to programming concept variations.

Standard Loss. For each original sample (i, o) ∈ Dori , we apply the standard negative log-likelihood (NLL) loss:

Concept-Sensitive Loss. Let o and oc denote the original and concept-aligned outputs, respectively. To localize the effect of concept-oriented perturbations, we construct a binary mask δ ∈ {0, 1}|oc | , where δj = 1 indicates that token j is affected by the perturbation. We design two complementary loss terms to guide concept-aware learning:

• Masked Token Loss. This term emphasizes prediction accuracy on concept-altered regions:

• Attention-Guided Loss. To further encourage structural awareness, we regularize the decoder attention so that tokens generated after a perturbation attend more strongly to the altered regions. Given the decoder attention matrix Mattn ∈ R|oc |×|oc | , we define:

where λ > 0 controls the strength of the attention regularization.

Training Summary. During training, each mini-batch contains both original and concept-aligned samples to enable joint optimization. Specifically, original samples are optimized using the standard negative log-likelihood loss, while conceptaligned samples are trained with a concept-sensitive objective composed of the masked token loss and the attention-guided consistency loss. The overall batch loss is computed as:

and model parameters are updated via gradient descent. The complete training procedure is summarized in Algorithm 1. At each epoch, the combined dataset is shuffled and processed in mixed mini-batches containing both original and conceptaligned samples. Original samples are optimized using the standard negative log-likelihood loss to preserve functional correctness, while concept-aligned samples are trained with a concept-sensitive objective composed of the masked token loss and the attention-guided loss. These loss components are jointly optimized within each parameter update via gradient descent, enabling the model to balance task-level performance and programming concept sensitivity. After all training epochs, the fine-tuned model parameters θFT are obtained.

4 Experiment Evaluation

4.1 Experimental Setup

Models. We evaluate four state-of-the-art open-source LLMs, representing both general-purpose and code-specialized paradigms. For general-purpose LMs, we select LLaMA3.18B [Touvron et al., 2024] and Mistral-7B [Jiang et al., 2023], both trained on large-scale web and code corpora. For coding LMs, we adopt StarCoder-7B [Li et al., 2023] and CodeLLaMA-13B [Roziere et al., 2023], which are pretrained on permissively licensed GitHub code and optimized for program synthesis tasks.

Benchmarks. We evaluate models on three widely-used code generation benchmarks: HumanEval [Chen et al., 2021], MBPP [Austin et al., 2021], and CodeContests [Li et al., 2022]. HumanEval consists of 164 Python problems with unit tests for functional correctness. MBPP includes 1,000 beginner-level programming tasks, and CodeContests provides a challenging set of real-world algorithmic problems from competitive programming platforms. Together, these benchmarks span a broad range of task difficulties, algorithmic patterns, and prompt formulations. Building upon these benchmarks, we further construct a concept-variation benchmark for evaluating programming concept understanding under controlled concept-level perturbations.

Evaluation Metrics. We define a binary attribution function A : H × X × Y → {0, 1}, where H denotes the set of natural language instructions, X the input space, and Y the output space. A(h, x, y) is 1 if the model's output satisfies the instruction, and 0 otherwise. This attribution function is used to compute the following metrics:

• Pass@k. Pass@k [Abdin et al., 2024; Luo et al., 2023; Wei et al., 2024] measures the fraction of problems where at least one of k generated outputs satisfies the instruction:

where n is the number of problems, and yj i is the j-th output for problem i.

• Concept Consistency Score (CCScore). Inspired by prior work [Hooda et al., 2024], we quantify programming concept understanding using the Concept Consistency Score (CCScore), which measures the proportion of correct generations preserved under concept-level variations. Given an

input x and its set of concept-perturbed variants {xck }Kk=1 (K ≤ 5), the model is considered consistent on x if it produces identical attribution outcomes across the original input and all its variants, i.e., A(h, x,M(h, x)) = A(h, xck , M(h, xck )) for all k.

The CCScore is computed as:

Inputs are excluded only when the original output and all corresponding variant outputs are invalid, since such failures primarily indicate general model capacity rather than concept understanding. A higher CCScore indicates stronger robustness to concept-level variations.

Environment. All experiments are conducted on a single NVIDIA L40 GPU with 46GB of memory using PyTorch and the HuggingFace Transformers library.

Hyperparameters. For automated concept-oriented perturbation, we use GPT-5 with temperature 1, generating up to 5 attempts per sample for valid outputs. For concept-aware fine-tuning, we optimize models using AdamW with a learning rate of 5 × 10-6 , sequence length of 2048, batch size of 16, and a concept-sensitive loss with λ = 0.1 over 5 epochs. During evaluation, we use top-p = 0.95 and max tokens = 512, with temperature set to 0.2 for Pass@1 and CCScore (averaged over 10 runs) and 0.6 for Pass@5, following prior work [Chen et al., 2021; Nijkamp et al., 2022].

Baselines. Since there is currently no fine-tuning method explicitly designed to enhance programming concept understanding, we adopt standard supervised fine-tuning (std-SFT) and several representative code augmentation-based fine-tuning approaches as baselines. Specifically, we include: (1) a diversity-oriented code transformation baseline SA-AFT [Chen et al., 2023] that applies syntax- and structure-level transformations to increase data diversity; (2) a counterfactual instructiontuning baseline CTF-Code [Luo et al., 2025], which augments instructions via fine-grained counterfactual variations in problem descriptions; and (3) a robustness-oriented adversarial fine-tuning baseline CodeFort [Zhang et al., 2024], which incorporates semantic-preserving adversarial perturbations with robust training objectives.

4.2 Dataset Experimental Results

Effectiveness and Efficiency of Dataset Construction. Table 1 summarizes the success rates of concept-oriented perturbation generation across datasets and perturbation types. Overall, the proposed pipeline achieves a high success rate of 97.51%, with dataset-level averages of 98.99%, 97.15%, and 96.39% on HumanEval, MBPP, and CodeContests, respectively. Among perturbation strategies, If-Else Flip yields the highest success rate (99.33%), while Name Shuffle performs worst, particularly on CodeContests (95.06%). Table 2 reports the efficiency of the perturbation process. Across all settings, valid perturbations are obtained with fewer than two attempts on average (1.24 overall), and the average token cost is 1,041 tokens per sample. CodeContests incurs higher costs due to its greater program complexity.

Dataset Quality. Before fine-tuning, we systematically assess the quality of the constructed concept-aligned dataset Dcon from both automatic statistics and human evaluation, ensuring that the generated perturbations are natural and semantically reliable. Code naturalness reflects the readability and predictability of generated programs. We measure naturalness using perplexity (PPL), computed by a pre-trained CodeGPT model (microsoft/CodeGPT-small-py), where lower values indicate more natural code. As shown in Table 3, the perturbed programs consistently achieve lower PPL than the original programs across all benchmarks (e.g., decreasing from 2457.73 to 1410.81 on HumanEval). This trend suggests that conceptoriented perturbations preserve, and in some cases improve, the linguistic regularity of code while introducing structural variations. To further verify semantic validity, we conduct a human evaluation on 400 randomly sampled program pairs, evenly split between valid and invalid perturbations. Two PhD-level annotators independently assess whether each perturbed program correctly reflects the intended programming concept while preserving functionality. Table 3 reports high inter-annotator agreement across all datasets, with Cohen's κ exceeding 0.975, indicating near-perfect consistency. These results confirm that our automated perturbation pipeline produces high-quality, semantically valid samples suitable for concept-aware fine-tuning.

Data Decontamination. Data leakage poses a significant threat to the validity of LLM evaluation. To mitigate this risk, we conduct a comprehensive decontamination analysis at two granularities: (i) Exact Match detection via hash comparison, and (ii) Near-Duplicate Detection using MinHash with locality-sensitive hashing (LSH) over 5-gram token shingles, with a similarity threshold of τ = 0.8 [Kocetkov et al., 2022]. The detection results are summarized in Table 4. No cross-dataset leakage is observed among HumanEval, MBPP, and CodeContests. However, we identify limited internal redundancy within individual datasets. Specifically, CodeContests contains 64 exact duplicates and 101 near-duplicate pairs, while MBPP exhibits minor redundancy (7 exact and 45 near duplicates), and HumanEval shows only 2 near-duplicate pairs. To ensure a fair and uncontaminated evaluation, we apply a strict sanitization procedure, retaining only a single representative from each detected duplicate cluster and removing all remaining instances.

Dataset Summary. Through the above process, we construct a concept-aligned dataset comprising 33,203 perturbed programs of varying complexity, derived from 8,285 original samples, with each sample associated with 1-5 concept-oriented variants. This dataset is directly applicable to concept-aware fine-tuning. Moreover, by integrating the CCScore evaluation protocol into the data construction pipeline, we further build and release the first open benchmark, ConceptEval, for evaluating programming concept understanding in LLMs.

4.3 Fine-tuning Experimental Results

Based on the validated concept-aligned dataset, we evaluate the effectiveness of different fine-tuning strategies in improving both task performance and programming concept understanding. We randomly split the dataset into two equal parts, using 50% for fine-tuning and 50% for testing. For all baseline methods, data augmentation is applied only to the original training samples, and the number of augmented instances is strictly controlled to ensure that all methods are trained with the same total number of training samples, resulting in comparable training cost. During evaluation, Pass@1 and Pass@5 are computed on the original test samples to measure tasksolving capability, while the CCScore is computed on paired original and concept-aligned test samples to assess robustness under programming concept variations.

Overall Results. Table 5 summarizes the performance of all methods across four code LLMs. Overall, ProCURE consistently achieves the highest CCScore across all evaluated models, with an average improvement of 17.9 percentage points, demonstrating its effectiveness in strengthening programming concept understanding. In terms of task performance, ProCURE achieves consistently strong Pass@1 and Pass@5 results, ranking as the best or second-best across all settings. In contrast, standard supervised fine-tuning (stdSFT) yields noticeable gains in Pass@k but only marginal improvements in CCScore, indicating that while conventional fine-tuning improves task accuracy, it provides limited supervision for learning programming concepts. Compared with augmentation-based baselines (SA-AFT, CTF-Code, and CodeFort), ProCURE maintains a clear advantage in CCScore while preserving competitive task accuracy. SA-AFT achieves the highest Pass@5 on Mistral-7B and StarCoder-7B, indicating that diversity-oriented code transformations mainly improve sampling-based success rates rather than conceptlevel generalization. Among the baselines, CodeFort yields the strongest CCScore improvements, reflecting the benefit of robustness-oriented adversarial perturbations that expose vulnerabilities related to insufficient concept understanding. In contrast, CTF-Code attains the lowest CCScore gains, as its instruction-level counterfactual augmentation provides limited supervision for learning fine-grained programming concepts.

Ablation Analysis. Table 6 reports ablation results averaged over four models. Removing both concept-sensitive loss terms, which reduces training to standard fine-tuning on the constructed dataset, leads to the largest performance degradation, with clear drops in pass@1 and pass@5 and a substantial decrease in CCScore. This indicates that data augmentation alone is insufficient to capture programming concept variations. When removing individual components, excluding the token-level loss Ltoken causes a more pronounced decline than excluding the attention-guided loss Lattn, particularly in CCScore. This suggests that explicit supervision on conceptaltered tokens is the primary driver of concept understanding, while attention regularization provides complementary gains. Overall, both components are necessary, and their combination yields the most consistent improvements.

5 RelatedWork

Perturbation-based code augmentation applies diverse codespecific transformations to existing programs to construct augmented training data for robust fine-tuning. Early studies indicate that neural code models are highly sensitive to minor perturbations, such as variable renaming or syntactic reordering, despite preserved program semantics [Yefet et al., 2020; Bielik and Vechev, 2020]. These observations have motivated various augmentation approaches based on standard transformations or adversarial code samples. A primary line of work focuses on rule-based or heuristic code transformations. ReCode [Wang et al., 2023] systematically investigates over thirty semantic-preserving transformations, revealing substantial performance degradation in code generation models. More recently, CodeFort [Zhang et al., 2024] introduces a comprehensive robustness training framework combining diverse perturbations with consistency-based objectives. Another line of work explores adversarial perturbations. Prior studies design attacks, ranging from identifier substitution to structure-aware perturbations, to expose model vulnerabilities [Zhou et al., 2022; Zhang et al., 2020; Tian et al., 2021]. CodeAttack [Jha and Reddy, 2023] further demonstrates the efficacy of adversarial fine-tuning as a defense mechanism. Subsequent research continues to refine these methods by leveraging syntactic or semantic structures to guide adversarial sample generation [Chen et al., 2023], with recent work extending this to adversarial perturbations specifically targeting code task descriptions [Luo et al., 2025].

Crucially, Hooda et al. [Hooda et al., 2024] identify a "programming concept understanding gap" in LLMs, highlighting the need for effective augmentation and fine-tuning strategies. However, existing methods are not tailored to programming concepts, limiting their ability to capture deep semantic logic. To address this, we propose a novel fine-tuning approach to enhance programming concept understanding.

6 Conclusion

We propose PROCURE, a concept-aware consistency learning framework that enhances LLMs' understanding of programming concepts through concept-oriented code augmentation and concept-sensitive consistency learning. Extensive experiments on four open-source LLMs across three code generation benchmarks show that ProCURE improves CCScore by an average of 17.9 points, demonstrating its effectiveness in addressing the programming concept understanding gap.

Acknowledgments

This work was supported by the 2025 Purple Mountain Talent Program for High-Level Innovative and Entrepreneurial Talents under the project "Theoretical Research on Trustworthy Evaluation of Intelligent Software" (Grant No. E6430219G8). This work was also supported by the National Natural Science Foundation of China (Grant Nos. U23B2041 and U24A6009), and the Joint Research Center for System Security, Tsinghua University (Institute for Network Sciences and Cyberspace)-Science City (Guangzhou) Digital Technology Group Co., Ltd.