Pith. sign in

REVIEW 2 major objections 1 minor 49 references

Scalable Source Code Similarity Detection in Large Code Repositories

T0 review · 2 major / 1 minor · reviewed 2026-05-24 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Hashing control flow graphs of source code produces fingerprints that support efficient similarity searches in large repositories.

desk verdict The paper's claim that hashing CFGs produces fingerprints for similarity search lacks any mechanism or evidence to support approximate matching. read the letter →

arxiv 1907.11817 v1 pith:5TD56I7F submitted 2019-07-26 cs.SE cs.IRcs.PL

F Alomari , M Harbi This is my paper
classification cs.SEcs.IRcs.PL
keywords sourcecodesimilaritycontrolflowgraphsfingerprintingclonedetectionscalablesearchrepositoriesbugisolation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper establishes an approach that converts source code into control flow graphs and then hashes those graphs to form unique fingerprints. These fingerprints are designed to capture both syntactic structure and semantic behavior, enabling storage and retrieval operations that scale to large code collections. Automatic detection becomes necessary because manual review cannot handle the volume of code or the variations in coding styles across modern languages. The method targets practical uses such as locating code clones, tracing bugs to their origins, and checking for unauthorized copying. Prototype experiments are presented as evidence that the technique performs with better efficiency than prior solutions.

What carries the argument

Control flow graph fingerprinting by hashing, which turns program structure into compact, searchable identifiers for similarity comparison.

What would settle it

Run the prototype on a repository containing a known set of cloned fragments and count how many true clones are missed or how many unrelated fragments are incorrectly flagged as similar.

Watch

Extended reading notes

Core claim

The paper claims that source code can be processed into control flow graphs which are then hashed to produce fingerprints; these fingerprints encode both syntax and semantics and can be stored and queried to identify similar code fragments at the scale of large repositories.

Load-bearing premise

Hashing control flow graphs produces fingerprints that reliably mark semantic and syntactic similarity at scale without too many false positives or undetected clones.

Editorial extensions

If this is right

  • Code clones can be located automatically instead of through manual inspection.
  • Bugs identified in one fragment can be traced and corrected across all similar copies.
  • Copyright violations become detectable through systematic fingerprint comparison.
  • Maintenance tasks such as applying patches scale without repeated manual effort.
  • The approach shows measurable gains in speed and accuracy over earlier detection methods.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The fingerprint storage model could support incremental updates when new code is added to a repository.
  • Combining the fingerprints with line-level or token-level features might reduce false positives in edge cases.
  • The same hashing step could be applied to detect duplicated logic across different programming languages if control flow abstractions are normalized.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 1 minor

Summary. The manuscript proposes an efficient and scalable approach for source code similarity detection (clone detection, bug isolation, copyright checks) by converting source code fragments to control flow graphs (CFGs), hashing the CFGs to produce fingerprints claimed to capture both syntactic and semantic similarity, storing the fingerprints for efficient retrieval, and performing similarity search on them. The abstract states that a prototype implementation's experimental results support the approach's validity, effectiveness, and efficiency relative to other solutions.

Significance. If the central engineering claim holds with a mechanism that actually supports approximate similarity search at scale and with supporting experimental evidence, the work could provide a practical, parameter-free method for clone detection in large repositories, addressing maintenance challenges in diverse coding styles. The direct construction without fitted parameters is a strength.

major comments (2)
  1. [Abstract] Abstract: the claim that 'Experimental results from our prototype implementation supports the validity of our approach and show its effectiveness and efficiency in comparison with other solutions' supplies no datasets, quantitative metrics (precision/recall/F1, runtime, scalability curves), baselines, or error analysis, leaving the effectiveness and efficiency assertions unsupported by visible evidence.
  2. [Abstract] Abstract (approach description): the transition from 'generate control flow graphs that are then hashed to create a unique fingerprint' to 'efficiently stored and retrieved to perform similarity search' assumes the hash supports approximate matching. Standard hashes (e.g., MD5/SHA) map any structural difference to an unrelated value and support only exact matches; no locality-sensitive hash family, graph embedding, or secondary distance computation on retained CFGs is specified, which is load-bearing for the similarity-search claim at scale.
minor comments (1)
  1. [Abstract] Abstract: 'Source code similarity are increasingly used' contains a subject-verb agreement error ('similarity' is singular).

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for their careful reading and valuable comments on our manuscript. We address the major comments below and will make revisions where appropriate to strengthen the paper.

read point-by-point responses

  1. Referee: [Abstract] Abstract: the claim that 'Experimental results from our prototype implementation supports the validity of our approach and show its effectiveness and efficiency in comparison with other solutions' supplies no datasets, quantitative metrics (precision/recall/F1, runtime, scalability curves), baselines, or error analysis, leaving the effectiveness and efficiency assertions unsupported by visible evidence.

    Authors: We agree that the abstract does not detail the experimental evidence. The manuscript body includes the specific datasets, quantitative metrics including precision, recall, F1, runtime, and scalability, as well as baselines and comparisons. We will revise the abstract to include a brief mention of the evaluation setup and key results to support the claims. revision: yes

  2. Referee: [Abstract] Abstract (approach description): the transition from 'generate control flow graphs that are then hashed to create a unique fingerprint' to 'efficiently stored and retrieved to perform similarity search' assumes the hash supports approximate matching. Standard hashes (e.g., MD5/SHA) map any structural difference to an unrelated value and support only exact matches; no locality-sensitive hash family, graph embedding, or secondary distance computation on retained CFGs is specified, which is load-bearing for the similarity-search claim at scale.

    Authors: The referee correctly identifies that the abstract does not specify how approximate similarity is achieved with the fingerprints. The manuscript describes a fingerprinting approach intended to capture similarity, but to address this concern, we will revise the paper to explicitly detail the method for performing similarity search on the fingerprints, including any techniques used for approximate matching. revision: yes

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: direct engineering construction without fitted predictions or self-referential steps

full rationale

The paper describes a straightforward pipeline: parse source code into control flow graphs, hash the graphs to produce fingerprints, then store/retrieve fingerprints for similarity search. No equations, parameter fitting, uniqueness theorems, or ansatzes are presented. The abstract and approach statements treat the hashing step as an engineering choice whose effectiveness is asserted via prototype experiments rather than derived from prior results by the same authors. No load-bearing self-citation chains or renamings of known results appear. The method is therefore self-contained as an implementation claim; any questions about false-positive rates or the precise hash function (standard vs. locality-sensitive) concern correctness or missing specification, not circularity in a derivation chain.

Assumptions & free parameters 0 free parameters · 1 assumptions · 0 invented entities

The central claim rests on the untested premise that CFG hashing preserves sufficient semantic information for accurate similarity detection; no free parameters, new entities, or non-standard axioms are introduced in the abstract.

assumptions (1)
  • domain assumption Control flow graphs faithfully represent both syntactic structure and semantic behavior of source code fragments
    Invoked when the abstract states that fingerprints capture semantics as well as syntax similarity

how reviews work

0 comments
Cite this review

Pith. "Pith review of Scalable Source Code Similarity Detection in Large Code Repositories." pith.science (2026). https://pith.science/paper/5TD56I7F

@misc{pith2026190711817,
  author       = {Pith},
  title        = {Pith review of: Scalable Source Code Similarity Detection in Large Code Repositories},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5TD56I7F}},
  note         = {Machine review of arXiv:1907.11817}
}
read the original abstract

Source code similarity are increasingly used in application development to identify clones, isolate bugs, and find copy-rights violations. Similar code fragments can be very problematic due to the fact that errors in the original code must be fixed in every copy. Other maintenance changes, such as extensions or patches, must be applied multiple times. Furthermore, the diversity of coding styles and flexibility of modern languages makes it difficult and cost ineffective to manually inspect large code repositories. Therefore, detection is only feasible by automatic techniques. We present an efficient and scalable approach for similar code fragment identification based on source code control flow graphs fingerprinting. The source code is processed to generate control flow graphs that are then hashed to create a unique fingerprint of the code capturing semantics as well as syntax similarity. The fingerprints can then be efficiently stored and retrieved to perform similarity search between code fragments. Experimental results from our prototype implementation supports the validity of our approach and show its effectiveness and efficiency in comparison with other solutions.

Figures

Figures reproduced from arXiv: 1907.11817 by the authors.

Figure 1
Figure 1. Similarity Detection Overview: High level steps of the proposed approach. present detection results in useful and usable manner to development and quality teams. Typically, source code similarity detection tools work by scanning the source code to identify pieces of code that are similar by using different string matching algorithms. Although reasonably fast for small data, they are quiet inaccurate and slow for lar… view at source ↗
Figure 2
Figure 2. Control Flow Extraction Example. of a program is a leader, 2) the targets of control statements (i.e., loops and conditions) are leaders, and 3) the statements immediately following control statements are leaders. The sequence of statements between these leaders constitutes the basic blocks bi ∈ B. An edge ei,j ∈ E describes the transfer of control between two blocks of code bi and bj . The CFG is constructed by add… view at source ↗
Figure 3
Figure 3. An Example Control Flow. sequence of statements in these ordered blocks are then hashed as shown in in algorithm 2.3. Therefore, an execution path will have a specific hash value and a program CFG will have multiple hash values. Consider the CFG example shown in [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Pairwise plot for the experiment data set the experimental setup and the data selected for the evaluation. Then, we present the results and discuss different observations made during the experiment. 3.1. Experiment To evaluate the effectiveness of our approach in detec…
Figure 5
Figure 5. Figure 5: Detection Results: (a) False positives as a function of the number of LoC (Top), False positives as a function of the number of blocks (Bottom); (b) Clone candidates identified for α (Top), False positives for α (Bottom); (c) Time it takes to query for clones in our ap…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

49 extracted references · 49 canonical work pages

  1. [1]

    Enterprise resource planning: ERP system migrations

    Kremers M, Van Dissel H. Enterprise resource planning: ERP system migrations. Communications of the ACM. 2000;43(4):53–56

    work page 2000

  2. [2]

    Enterprise Integration with ERP and EAI

    Lee J, Siau K, Hong S. Enterprise Integration with ERP and EAI. Comm of the ACM. 2003;46(2):54–60

    work page 2003

  3. [3]

    ERP problems and application integration issues: An empirical survey

    Themistocleous M, Irani Z, O’Keefe RM, Paul R. ERP problems and application integration issues: An empirical survey. In: Proceedings of the 34th Annual Hawaii International Conference on System Sciences. IEEE; 2001. p. 10–pp

    work page 2001

  4. [4]

    Tailoring ERP systems: a spectrum of choices and their implications

    Brehm L, Heinzl A, Markus ML. Tailoring ERP systems: a spectrum of choices and their implications. In: Proceedings of the 34th annual Hawaii international conference on system sciences. IEEE; 2001. p. 9–pp

    work page 2001

  5. [5]

    O ffi cial ABAP Programming Guidelines

    Keller H, Thümmel WH. O ffi cial ABAP Programming Guidelines. Galileo Press; 2010

    work page 2010

  6. [6]

    ABAP objects

    Keller H, Krüger S. ABAP objects. Sap Press; 2003

    work page 2003

  7. [7]

    Do code clones matter? In: Software Engineering, 2009

    Juergens E, Deissenboeck F, Hummel B, Wagner S. Do code clones matter? In: Software Engineering, 2009. ICSE 2009. IEEE 31st International Conference on. IEEE

    work page 2009

  8. [8]

    A survey on code clone, its behavior and applications

    Gupta A, Suri B. A survey on code clone, its behavior and applications. In: Networking Communication and Data Knowledge Engineering. Springer; 2018. p. 27–39

    work page 2018

Show all 49 references
  1. [9]

    Benchmarks for software clone detection: A ten-year retrospective

    Roy CK, Cordy JR. Benchmarks for software clone detection: A ten-year retrospective. In: 2018 IEEE 25th Int. Conf. on Software Analysis, Evolution and Reengineering (SANER). IEEE; 2018. p. 26–37

    2018

  2. [10]

    Software clone detection: A systematic review

    Rattan D, Bhatia R, Singh M. Software clone detection: A systematic review. Information and Software Technology. 2013;55(7):1165–1199

    2013

  3. [11]

    An assessment of type- 3 clones as detected by state-of-the-art tools

    Tiarks R, Koschke R, Falke R. An assessment of type- 3 clones as detected by state-of-the-art tools. In: Source Code Analysis and Manipulation, 2009. SCAM’09. Ninth IEEE Inter. Working Conf. on. IEEE; 2009. p. 67–76

    2009

  4. [12]

    Achieving accurate clone detection results

    Juergens E, Göde N. Achieving accurate clone detection results. In: Proceedings of the 4th Inter. Workshop on Software Clones. ACM; 2010. p. 1–8

    2010

  5. [13]

    Comparison and evaluation of code clone detection techniques and tools: A qualitative approach

    Roy CK, Cordy JR, Koschke R. Comparison and evaluation of code clone detection techniques and tools: A qualitative approach. Science of computer programming. 2009;74(7):470–495

    2009

  6. [14]

    Evaluating modern clone detection tools

    Svajlenko J, Roy CK. Evaluating modern clone detection tools. In: Software Maintenance and Evolution (ICSME), 2014 IEEE Int Conf on. IEEE; 2014. p. 321–330

    2014

  7. [15]

    Comparison and evaluation of clone detection tools

    Bellon S, Koschke R, Antoniol G, Krinke J, Merlo E. Comparison and evaluation of clone detection tools. IEEE Trans on software eng. 2007;33(9)

    2007

  8. [16]

    Clone detection using rolling hashing, suffi x trees and dagification: A case study

    Thomsen MJ, Henglein F. Clone detection using rolling hashing, suffi x trees and dagification: A case study. In: Software Clones (IWSC), 2012 6th Intern. Workshop on. IEEE; 2012. p. 22–28

    2012

  9. [17]

    Detecting clones in business applications

    Guo J, Zou Y. Detecting clones in business applications. In: Reverse Engineering, 2008. WCRE’08. 15th Working Conference on. IEEE; 2008. p. 91–100

    2008

  10. [18]

    A language independent approach for detecting duplicated code

    Ducasse S, Rieger M, Demeyer S. A language independent approach for detecting duplicated code. In: Software Maintenance, 1999.(ICSM’99) Proceedings. IEEE Inter Conf on. IEEE; 1999. p. 109–118

    1999

  11. [19]

    On finding duplication and near-duplication in large software systems

    Baker BS. On finding duplication and near-duplication in large software systems. In: Reverse Engineering, 1995., Proceedings of 2nd Working Conference on. IEEE

    1995

  12. [20]

    Clone detection using abstract syntax trees

    Baxter ID, Yahin A, Moura L, Sant’Anna M, Bier L. Clone detection using abstract syntax trees. In: Software Maintenance, 1998. Proceedings., Int. Conf. on. IEEE

    1998

  13. [21]

    Identifying similar code with program dependence graphs

    Krinke J. Identifying similar code with program dependence graphs. In: Reverse Engineering, 2001. Proceedings. Eighth Working Conference on. IEEE; 2001. p. 301–309

    2001

  14. [22]

    Experiment on the Automatic Detection of Function Clones in a Software System Using Metrics

    Mayrand J, Leblanc C, Merlo E. Experiment on the Automatic Detection of Function Clones in a Software System Using Metrics. In: icsm. vol. 96; 1996. p. 244

    1996

  15. [23]

    CCFinder: a multilinguistic token-based code clone detection system for large scale source code

    Kamiya T, Kusumoto S, Inoue K. CCFinder: a multilinguistic token-based code clone detection system for large scale source code. IEEE Trans on Software Engineering. 2002;28(7):654–670

    2002

  16. [24]

    Code clone detection using coarse and fine-grained hybrid approaches

    Sheneamer A, Kalita J. Code clone detection using coarse and fine-grained hybrid approaches. In: 2015 IEEE seventh international conference on intelligent computing and information systems (ICICIS). IEEE

    2015

  17. [25]

    Index- based code clone detection: incremental, distributed, scalable

    Hummel B, Juergens E, Heinemann L, Conradt M. Index- based code clone detection: incremental, distributed, scalable. In: 2010 IEEE International Conference on Software Maintenance. IEEE; 2010. p. 1–9

    2010

  18. [26]

    Ctcompare: Code clone detection using hashed token sequences

    Toomey W. Ctcompare: Code clone detection using hashed token sequences. In: 2012 6th Inter Workshop on Software Clones (IWSC). IEEE; 2012. p. 92–93

    2012

  19. [27]

    On the effectiveness of simhash for detecting near-miss clones in large scale software systems

    Uddin MS, Roy CK, Schneider KA, Hindle A. On the effectiveness of simhash for detecting near-miss clones in large scale software systems. In: Reverse Eng. (WCRE), 2011 18th Working Conf on. IEEE; 2011. p. 13–22

    2011

  20. [28]

    Deep learning code fragments for code clone detection

    White M, Tufano M, Vendome C, Poshyvanyk D. Deep learning code fragments for code clone detection. In: Proceedings of the 31st IEEE/ACM Inter Conf on Automated Software Engineering. ACM; 2016. p. 87–98

    2016

  21. [29]

    Bayesian sparse topical coding

    Peng M, Xie Q, Wang H, Zhang Y, Tian G. Bayesian sparse topical coding. IEEE Transactions on Knowledge and Data Engineering. 2018

    2018

  22. [30]

    A framework for call graph construction algorithms

    Grove D, Chambers C. A framework for call graph construction algorithms. ACM Trans on Programming Languages and Systems (TOPLAS). 2001;23(6):685–746

    2001

  23. [31]

    Control flow graph visualization in compiled software engineering

    Mikhailov A, Hmelnov A, Cherkashin E, Bychkov I. Control flow graph visualization in compiled software engineering. In: Information and Communication Technology, Electronics and Microelectronics (MIPRO), 2016 39th International Convention on. IEEE; 2016. p. 1313–1317

    2016

  24. [32]

    Auto- mated vulnerability analysis: Leveraging control flow for evolutionary input crafting

    Sparks S, Embleton S, Cunningham R, Zou C. Auto- mated vulnerability analysis: Leveraging control flow for evolutionary input crafting. In: Twenty-Third Annual Computer Security Applications Conference (ACSAC 2007). IEEE; 2007. p. 477–486

    2007

  25. [33]

    E ffi cient path profiling

    Ball T, Larus JR. E ffi cient path profiling. In: Proc. of the 29th annual ACM/IEEE inter symposium on Microarchitecture. IEEE Computer Society; 1996. p. 46– 57. 10 EAI Endorsed Transactions Preprint Scalable Source Code Similarity Detection in Large Code Repositories

    1996

  26. [34]

    Static branch frequency and program profile analysis

    Wu Y, Larus JR. Static branch frequency and program profile analysis. In: Proceedings of the 27th annual international symposium on Microarchitecture. ACM

  27. [35]

    Comparing Control Flow Graphs of Binary Programs through Match Propagation

    Lim HI. Comparing Control Flow Graphs of Binary Programs through Match Propagation. In: 2014 IEEE 38th Annual Computer Software and Applications Conference. IEEE; 2014. p. 598–599

    2014

  28. [36]

    Detecting self- mutating malware using control-flow graph matching

    Bruschi D, Martignoni L, Monga M. Detecting self- mutating malware using control-flow graph matching. In: International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment. Springer

  29. [37]

    Anomaly detection using program control flow graph mining from execution logs

    Nandi A, Mandal A, Atreja S, Dasgupta GB, Bhat- tacharya S. Anomaly detection using program control flow graph mining from execution logs. In: Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. ACM; 2016. p. 215–224

    2016

  30. [38]

    Control flow analysis

    Allen FE. Control flow analysis. In: ACM Sigplan Notices. vol. 5. ACM; 1970. p. 1–19

    1970

  31. [39]

    Hashing for similarity search: A survey

    Wang J, Shen HT, Song J, Ji J. Hashing for similarity search: A survey. arXiv preprint arXiv:14082927. 2014

    2014

  32. [40]

    A survey on learning to hash

    Wang J, Zhang T, Sebe N, Shen HT, et al. A survey on learning to hash. IEEE Trans on Pattern Analysis and Machine Intelligence. 2018;40(4):769–790

    2018

  33. [41]

    Locality- sensitive hashing scheme based on p-stable distribu- tions

    Datar M, Immorlica N, Indyk P, Mirrokni VS. Locality- sensitive hashing scheme based on p-stable distribu- tions. In: Proc. of the twentieth annual symposium on Computational geometry. ACM; 2004. p. 253–262

    2004

  34. [42]

    Similarity estimation techniques from rounding algorithms

    Charikar MS. Similarity estimation techniques from rounding algorithms. In: Proceedings of the thiry-fourth annual ACM symposium on Theory of computing. ACM

  35. [43]

    Maximum common subgraph isomorphism algorithms for the matching of chemical structures

    Raymond JW, Willett P . Maximum common subgraph isomorphism algorithms for the matching of chemical structures. Journal of computer-aided molecular design. 2002;16(7):521–533

    2002

  36. [44]

    Detecting near- duplicates for web crawling

    Manku GS, Jain A, Das Sarma A. Detecting near- duplicates for web crawling. In: Proceedings of the 16th international conference on World Wide Web. ACM

  37. [45]

    Bitshred: feature hashing malware for scalable triage and semantic analysis

    Jang J, Brumley D, Venkataraman S. Bitshred: feature hashing malware for scalable triage and semantic analysis. In: Proceedings of the 18th ACM conference on Computer and communications security. ACM; 2011. p. 309–320

    2011

  38. [46]

    Self-protecting and self- optimizing database systems: Implementation and experimental evaluation

    Alomari FB, Menascé DA. Self-protecting and self- optimizing database systems: Implementation and experimental evaluation. In: Proceedings of the 2013 ACM Cloud and Autonomic Computing Conference. ACM; 2013. p. 18

    2013

  39. [47]

    An autonomic framework for integrating security and quality of service support in databases

    Alomari F, Menasce DA. An autonomic framework for integrating security and quality of service support in databases. In: 2012 IEEE Sixth Inter. Conf. on Software Security and Reliability. IEEE; 2012. p. 51–60

    2012

  40. [48]

    Mining event-oriented topics in microblog stream with unsupervised multi-view hierarchical embedding

    Peng M, Zhu J, Wang H, Li X, Zhang Y, Zhang X, et al. Mining event-oriented topics in microblog stream with unsupervised multi-view hierarchical embedding. ACM Transactions on Knowledge Discovery from Data (TKDD). 2018;12(3):38

    2018

  41. [49]

    Block Bayesian Sparse Topical Coding

    Peng M, Shi H, Xie Q, Zhang Y, Wang H, Li Z, et al. Block Bayesian Sparse Topical Coding. In: 2018 IEEE 22nd International Conference on Computer Supported Cooperative Work in Design ((CSCWD)). IEEE; 2018. p. 271–276. 11 EAI Endorsed Transactions Preprint

    2018

Pith tools

Reviewed May 24, 2026 · model on record in the stance chip above.