GitHub Copilot may be perfect for cheating CompSci programming exercises

[xrunner]

The Register — Biting the hand that feeds IT

GitHub Copilot may be perfect for cheating CompSci programming exercises

Shakeup in teaching looms as code-completion tool lets students 'bring an Uzi to a knife fight'

Thomas Claburn Fri 19 Aug 2022 // 20:25 UTC

Microsoft's AI code-suggestion tool GitHub Copilot is showing itself to be so capable that educators may have to rethink how they teach computer science.

University of Massachusetts Amherst computer science professor Emery Berger earlier this month published a blog post warning educators that "students armed with [Copilot] will be bringing Uzis to a knife fight."

His concern is that Copilot will render traditional programming exercises – part of computer science training but by no means all of it – pointless because Copilot knows all the answers.

"As far as I can tell, Copilot was specifically trained on all the intro programming assignments ever," Berger wrote. "Copilot frickin’ loves intro programming assignments."

For students using Copilot, he wrote, educators might as well describe their course objectives as "hitting the Tab key," in reference to the key command to generate code from a description of the desired output.

"Programming plays a role in a lot of computer science classes, and especially in introductory computer science classes," explained Berger in a phone interview with The Register. This often involves exercises to sort a list of numbers in a certain way or to find the nth element of a Fibonacci series, and so on.

"Copilot will just do them," said Berger. "It's not just that it does them and it does them well. It's also that it does them using the tools that you would want and expect your students to actually be using to write their code. If they start writing code and Copilot is installed, it will fill out the solution."

Berger said Copilot is different from searching for answers on Stack Overflow and other internet programming resources.

"You can already find examples of code online," he said. "But you know, the instructor can also Google for them and then compare that code against the code submitted with a plagiarism detector."

Copilot is different, he said, "It actually generates novel solutions. Not like they're super-crazy, sophisticated, genius solutions. But it makes new solutions that are superficially different enough that they plausibly could have come from a student."

As a result, Berger argues, pedagogy related to programming needs to adapt. One approach, which he ridicules in his post, is "to plug our ears with our fingers and kind of shout while pretending [Copilot] doesn't exist, which is more or less the same thing as pretending plagiarism doesn't exist, and pretending that the internet doesn't exist."

"But if you care about the integrity of the process … this is just a cheating machine," he said. "Like somebody gives you a spec for an assignment, you just type in this back in comments and hit Tab, right?"

"So I don't think that it's reasonable or responsible to think that everybody is going to refrain from using this amazing cheating machine that's installed on their laptops … I think that the temptation is too great. And honestly, it's what software development is probably going to look like, very, very soon."

Berger acknowledges that Copilot is useful and says it makes sense developers would want to use the software.

"We just need to really rethink things altogether," said Berger. "Certainly from the evaluation standpoint, we can obviously just require people to do things in environments where they can't use Copilot. Just like elementary school kids don't get to use calculators when doing basic arithmetic. So we can have paper and pencil exams."

He said he has a colleague in Illinois who describes using computers that have been locked down for programming tests, so students take their exams in a controlled setting. These sorts of measures, and things like oral exams, he suggested, could help address some of the negative aspects of the availability of Copilot.

Berger also observed that Copilot has positive aspects, such as the ability to fill out boilerplate and to implement APIs.

"I don't think that memorizing the minutia of countless APIs is really interesting intellectually," he said. 'It's not the kind of thing we should really be teaching or focusing on. Do you know the exact syntax to create a DataFrame with these characteristics? I don't care. If you have to look it up on Google or on Stack Overflow, or you just hit Tab and it just does it for you, that sounds fine to me."

Nonetheless, he argues it's important for educators to make sure students are actually learning the material, which may mean rethinking how much homework assignments that can be solved with Copilot should count when calculating an overall grade.

Berger said it's probably premature to say that Copilot has had an effect on students, because the software has only been publicly available for a few months. But he argues it won't be long before its impact starts to show.

"I would like to be optimistic about this," said Berger. "But I think at minimum, we just need to be thoughtful of it. I just don't think that there are many educators out there who are aware of how much of a revolution this is."

[url]https://www.theregister.com/2022/08/19/copilot_github_students/[/url]

[Ed.Kloonk]

 

My question is: what good does the cheating get you when you're dropped into the workforce and you know, have to solve actual problems?

Sound's like a naive question certainly but if you could expend that much effort whist exposing yourself to risk getting caught, wouldn't you just study the module?

[bd139]

Had some problems with obvious cheating on entry tests before. Thus we give people a computer without a network connection when we test them 

Also one question is impossible to answer. And it’s early on. Anyone who knows their ass from their elbow would spend 2 minutes realising that. Anyone who doesn’t burns the rest of the test scratching their head.

[SiliconWizard]

My question is: what good does the cheating get you when you're dropped into the workforce and you know, have to solve actual problems?

That's a good question, but it ignores a fact: a non-negligible fraction of people pursuing an engineering degree of some kind just get it for the social status and the selection advantage they get for some less-technical jobs, such as management, sales, marketing in some areas, etc. So ultimately they don't care whether they are capable of applying what they are supposed to have learned and mastered - they just want the degree for the benefits it brings them.

[RoGeorge]

Ads are getting smarter.  Best add for Microsoft's Copilot to get student's undivided attention, "can help you cheat the exams". 
(though Copilot is now a payed product, the free GitHub Copilot beta ended this year)

OTOH, yes, transformers will be a game changer in many fields (not only programming).

Not to say, knowing the fundamentals of programming will become as relevant as it is for electronics to learn how to operate a sliding ruler in the age of LTspice simulators.

From now on, the programming as we know it will change dramatically.  Only days ago seen what a model of 480MB can do, all running locally on an i7 desktop from 5+ years ago.

It's already creepy what transformers based AI can do (GPT stands for Generative Pre-trained Transformer).  Microsoft's Copilot is based on GPT3, just like the one I was fiddling with recently (sorry for the shameless plug, but it shows examples of generated text and code, running on a casual desktop and with small generic models, all running offline and trivial to setup https://www.eevblog.com/forum/programming/ai-hello-world/ ).

With better hardware and bigger, more specialized models running in the cloud, programming as we know it will go extinct in 5 to 10 years most.

GPT AI is a revolutionary technology.  CodeBERT model (480 MB, 125 mil parameters) can understand plain English requests and generate code that fits the description, can do that in 9 programming languages, and faster that it would take one to type all that.

Code helpers will revolutionize programming.  You won't believe until you'll try for yourself something like CodeBERT or GPT-Neo (which are free and open source, zero AI skills required to install or run them).  Give it a try.

[AndyBeez]

Had some problems with obvious cheating on entry tests before. Thus we give people a computer without a network connection when we test them 
Also one question is impossible to answer. And it’s early on. Anyone who knows their ass from their elbow would spend 2 minutes realising that. Anyone who doesn’t burns the rest of the test scratching their head.

No network, but how can they access Instragram in the middle of the test? You are SO not going to attract the most talented candidates doing that.

In fairness, using Copilot is a form of initiative, showing use of the tools available. Anyway, Copilot understands the questions. Questions that are often designed by academics who've never programmed anything off a white board. "Implement a snapshot array supporting pre-defined datatypes" 

Sometimes questions are just too stupid in their scope. For example, "how would you redesign Google's database for web indexing?" Answer is, "f*** knows, ask Alexa." Or, "tell me how you used data to measure impact?" Response, "f*** knows, they all died."

[bd139]

Hahaha.

Problem we have is that we have source escrow with some customers and strict security requirements. So Copilot is actually an export risk as it produces copyright code and insecure shit galore.

There is nothing good about it at all. It's dangerous.

[RoGeorge]

- Insecure?  As in, the same with any existing software? 
- About license, maybe Microsoft Copilot doesn't show license, never tried it, but other helpers can specify the license.  For example this one, Codeon, a free programming helper that tells the license, too:



Another thing is that GPT can do more than just a search retrieval, it can create new lines, code that was never shown to it during training.

[bd139]

Insecure as in it makes people lazy enough to not think of security concerns and review properly.

As for license our lawyers said we can't and we don't argue with them 

I am really not interested in any solution around this personally. It's absolutely not the way we should be writing software in any way shape or form.

[RoGeorge]

Yes, with time this can make programmers "weaker", it makes one less self-reliant, and more dependent on 3rd factors.

Though, this is the same as any other technology does, or any other helper.  Writing weakened memory, horses weakened running, and so on.  Any advance in comfort will make us less reliant, and in time we become addicted to that comfort.  Take electricity for example.  Civilization will crumble in a matter of weeks without electricity.

It's been a long time since we were able to procure our food from wilderness, and grow our own fur to stay warm.

[janoc]

Maybe a heretical idea - but perhaps Copilot is the best thing that could happen for CS education (and possibly also software developer interviews).

It is about time these idiotic assignments were put out to pasture. They don't test anything meaningful, only that the person taking the test can type "palindrome" or "fizzbuzz" into Google and copy & paste stuff from StackOverflow. Copilot only made it easier (with a bonus free plagiarism/copyright infringement ...)

Try to give students an assignment that is new (and thus cannot be simply found online), interesting and that (gasp!) requires then to actually think about the problem. And, crucially, after the test ask them to explain their solution! 99% of cheaters have no clue whatsoever about what they have copied.

Yes, it is more work for the teacher than just giving the same quiz questions year after year for the last 20 years. But assessment also doesn't need to be only quizzes!


For background: I have taught C, C++, Python & OpenGL programming to university students in the past. Been there, done that. My university teaching portfolio was based on how to teach and assess these things, without going crazy with inventing assignments and having to mark all of then myself (no TAs to offload the task on!) and without having to deal with rampant cheating.

The best way to deal with cheating is to embrace it - students will cheat, period. Threats, honor codes, etc. don't really work. So turn the tables - allow them to cheat! But then give them assignments where the cheating won't help them any because the assignment can't be copied from a place online (or a book). And if they still do cheat (e.g. by cribbing it from a classmate), it is an extra learning opportunity for them.

What is important is whether they actually understood the subject - and that is what gets assessed, not whether or not they memorized some algorithm or copied that FizzBuzz from StackOverflow. I was happy to give them an A as long as they could demonstrate they understood the topic in the exam - and that wasn't done by submitting a test but by an oral exam**.  I couldn't care less whether they learned it from the lecture, book, code copied online or copied from a classmate.

**That could obviously be problem in large classes but then it is a matter of organization, spot checking the tests by asking questions, doing the orals by groups and asking questions there, even replacing the written exam by a term long larger project to be made and turned in (perhaps as an alternative to the test/exam), etc. Many solutions are possible as long as the teacher has open mind beyond the lecture -> written test tradition.

[magic]

Also one question is impossible to answer. And it’s early on. Anyone who knows their ass from their elbow would spend 2 minutes realising that. Anyone who doesn’t burns the rest of the test scratching their head.

Very evil, I like it

Programming is so full of "adds little or no algorithmic value" stuff but which is very cumbersome to implement / maintain for no good reason little more than obesiance to the syntax and the common interfaces used to get things to a point where a library or compiler can understand it even though the value-add of the programming is more in the processing / creation / analysis of data not merely house keeping of syntax / form / field validation, codec I/O, representation changes, maintaining style & formatting, refactoring organization, migrating from one API / interface to some other variant, etc.

That's true, but AI is not the solution because of its statistical nature and the resulting inevitable degree of error and unreliability. It sounds cool to describe what you want in human language and have the machine generate the boilerplate, until you realize that sometimes even asking competent human programmers in human language results in code slightly different than you wanted.

That's a job for IDE plugins or custom scripts, which need to ingest a formalized and unambiguous description of what's to be generated and transform it with ordinary deterministic algorithms. If the output is wrong despite your specification being correct, that's a bug and it can be traced down to an exact line of code in the tool and fixed. Have fun doing that with AI. Such things also tend to run faster than AI for some reason.

IMHO a big reason why there is lots of ugly boilerplate code difficult to maintain in the wild is largely due to programmers being too lazy to automate what already can be automated with tools we have had for decades. And because many widespread languages aren't making the task particularly easy, by being a nightmare to parse. Trying to solve this with AI will only make things worse. I envision a future where several multi-gigabyte revisions of some AI model are included in a few megabyte source repository to generate a few files that can only be generated by a particular version of a particular AI that some developer employed at a particular time. We will call it "AI hell" and long discussions will be had on "H".N. how to deal with it using shared AI repositories, AI as a service, and private AI cloud.

[RoGeorge]

If AI write bugs, then "use the stones to destroy the stones".   

Research results are encouraging already:  https://2021.msrconf.org/details/msr-2021-mining-challenge/3/Applying-CodeBERT-for-Automated-Program-Repair-of-Java-Simple-Bugs

That won't replace all the CS gray-beard in a year, but I think in 10 years AI generated code will be the norm.

We all need to understand that the working principles of AI are no different from how the human mind is working, therefore AI would be able to do everything a human can, in terms of intelligence.  It is only a matter of the size of the network that still gives us an advantage.  The soon we recognize we are not the center of the Universe, the better.

We are all in denial right now, but there is knowledge in piles of data, and we just learn how to make use of that.

Any pile of data also stores knowledge, and that can be extracted by simply classifying the data, by looking at similarities and correlations.  It doesn't matter what that data is about, it can be literature/video/audio/programming/whatever.  And once you have the knowledge, the patterns, the notions learned from data, you can use the patterns to extrapolate, and thus create something new, or simulate a hypothesis in order to predict what will happen, and so on.

That is why having a brain is advantageous, because it can predict the outcome in advance.  You don't have to wait for the tiger to kill you first, you can "see" the outcome, you can predict, and plan for how to escape fate.  Otherwise why keeping a brain, it's a very energy intensive organ and hard to feed.

The brain is an Oracle, it can predict the near future.  We wouldn't be able to do the simplest thing, like walking a room, without predicting the outcome of each and every step in advance.  This is happening in an automated way, and we are not aware of it.  We think we "see" the surrounding, but experiments tells we rather simulate the surrounding.  The data stream coming from the eyes is only adjusting the simulation so it won't diverge too far.  The brain is continuously simulate what we "see" or "feel" in advance.

Mind is nothing but a driven illusion.
A very brief simulation, in regards to the complexity of the objective reality that surrounds us.

Back to our very recent AI breakthroughs, I think the true value of collecting and hoarding data is exactly this, the unseen knowledge stored in that data, targeted commercial is peanuts.  Data rush is the new gold rush.  Whoever will get that faster will become more powerful.  A human mind can not process billions of records, machines can.  That will reveal patterns no human can see.

Yes, AI it's statistical and can make mistakes.  Just like us, humans.  We both have these pitfalls because we work on the same principles. We extract knowledge from floods of data streams.  We compress past experiences into nuggets of wisdom.  This is what the AI has achieved, too.  It is happening, denial won't make it vanish.

There is one last straw that we still have, while the machines don't have it yet, self-reproduction. 

[bd139]

Some pretty big assumptions there.

Let’s not use AI as a term here as that is a bridge too far here. ML applies a corpus of things humans did previously to new problems. It does so with the skill and altitude of a small, retarded cat. And most of the corpus is written by slop sucking morons. The problem is that it’s really important to understand how A turned into B and that’s pretty much impossible to determine unless you store the entire model and state with the decision which is impractical. Really with all processes it’s garage in, garbage out.

This is ultimately a dead end. I have watched two entire companies burn trying to get ML driven modelling for risk calculation working anywhere near as reliably as simple rules. In one case the model actually decided to approve a mortgage to an Iranian terrorist. And that’s exactly the same situation we’re in with code. Simple rules are better. By a mile. They are reliable, well understood, consistent and have consensus built into them. Which is exactly what businesses need.

We should invest in building tools that make it harder to make mistakes not tools which purportedly allow the scope of risk to be increased.

[magic]

I absolutely agree that it will be used, as you have already witnessed yourself, and denial won't make it vanish.
 

[bd139]

You’re right. I see it is another risk we have to defend against. That’s hard enough already when you hire the lowest bidders 

I’m counting down until i retire at this point 

[magic]

Too young for that. I'm waiting for things to deteriorate so badly that it becomes socially acceptable to just smash the head of anyone you dislike with no consequences, as in the good old times

[Towger]

In my day, you sat in an exam hall with paper and pen and wrote the code out by hand.  If you went to the lectures / did all the assignments (your self) the questions were relatively easy to answer.  Those that did not put in the work were screwed.  This old school system did require the examiners/lectures time and effort to read through and correct, but there was no 'cheating' with online resources.  Not that there was much back then...

[Nominal Animal]

Also one question is impossible to answer. And it’s early on. Anyone who knows their ass from their elbow would spend 2 minutes realising that. Anyone who doesn’t burns the rest of the test scratching their head.

I would, most definitely: I'm addicted to seemingly impossible programming problems.  But I do claim I know my ass from my elbow (as I got two elbows, and they have no cheeks, but one ass, that has two big, meaty, hairy cheeks).

Also, I always keep a terminal or browser window open to the man pages or language documentation when programming.  I don't waste my feeble brain power in memorizing details like the parameter order in API calls; I don't always even remember the exact function call names.  (Of course, in Linux, one can usually find these already installed in /usr/share/doc/package/, so no network connection is needed.)

I have been ridiculed before because of that, although the ridicule dies down in a couple of weeks or months, when the quality of my work product is observed.  Then, somehow, the same practice seems to become the norm among my colleagues, too.  Go figure.

All kidding aside, what I absolutely detest in programming questions is when the obvious/sane/normal/preferred solutions are excluded by insane requirements.  Like "Write a Hello World program with no more than three 'i's and two 'e's in your source code."

[bd139]

It's a good trap. We have a big problem with people not being solution focused and will blow weeks if not months on dead ends and trendy shit rather than solve the problem.

Actually the best impossible situations are the infra ones. I love to throw out the question:

So AWS eu-west-1 is completely down and has been down for 2 days due to a fuck up at Amazon. Also there is no capacity in eu-west-2 because anyone who could moved there did so and used it all up. We can't move to another region due to compliance constraints. Customers are in SLA violation now. What do we do?

I hired the guy who said "hit cwjobs" 

[Nominal Animal]

It's a good trap. We have a big problem with people not being solution focused and will blow weeks if not months on dead ends and trendy shit rather than solve the problem.

That's true, even I can't argue with that!

Actually the best impossible situations are the infra ones. I love to throw out the question:

So AWS eu-west-1 is completely down and has been down for 2 days due to a fuck up at Amazon. Also there is no capacity in eu-west-2 because anyone who could moved there did so and used it all up. We can't move to another region due to compliance constraints. Customers are in SLA violation now. What do we do?

I hired the guy who said "hit cwjobs" 

Yup. "Be fucked, and try to avoid getting fucked by a similar situation in the future" would be my answer now.

I have been in a somewhat similar situation in my student days, when I had a summer coding project from early May to end of August (a simple scheduling web widget), but had to deal with stepwise delays in the infrastructure up till mid-August.  My fault for not stopping the shit show in June, though; I'd never had such a drip-drip of issues before, and honestly thought I could fix stuff in time.  In all of my career, I've failed fewer projects than I have fingers in one hand.  Still annoys me to this day, and would love to apologise and explain to those who suffered because of the failure of that project.

[SiliconWizard]

Some pretty big assumptions there.

Let’s not use AI as a term here as that is a bridge too far here. ML applies a corpus of things humans did previously to new problems.

Yup. Which is the basis of what humans have been doing all along. Except that we humans have *some* ability to do this with a bit of discernment, while ML, in its essence, fundamentally *can't* have discernment. We also have this fun tendency to take pride in finding new ways of achieving things - that's called creativity or something, along with some ego - and that's actually very useful. ML is not going to achieve this.

But ultimately, that's just a bunch of people trying to push ML as hard as they can, not because this is actually beneficial to anyone here, but because they have a vested interest in it. There's huge money to be made regardless of the outcome. This is just a huge cash cow.

[bd139]

Nailed it. Especially the last comment.

[AndyBeez]

Is it ML or MC? That's machine copying. It makes one wonder what very wrong answer on stackoverflow from 10 years ago will be inducted into a code solution flying over the ocean? And who or what will be accountable for the memory leak that opened the aircraft doors in-flight? That's a solution for the AI lawyer.

So AWS eu-west-1 is completely down and has been down for 2 days due to a fuck up at Amazon.
...
What do we do?

That's Kobayashi Maru : https://en.m.wikipedia.org/wiki/Kobayashi_Maru

[bd139]

Kobayashi Maru was the inspiration

As for the AI lawyer issue, that's another problem. Google are already using AI police: https://www.nytimes.com/2022/08/21/technology/google-surveillance-toddler-photo.html