Source-Platform Attribution in Open-Source UAV Flight-Control Software: A Multi-View Representation Study

Function-level source-platform attribution asks which known repository a code fragment originated from; it does not infer vulnerabilities, defects, exploitability, or other security properties. This study benchmarks lexical, frozen semantic, and multi-view pipelines for five open-source UAV flight-control repositories. UAV-SAFENet (a project-specific name; the “SAFE” label does not denote safety or security assurance) is used as a controlled comparator combining character-level TF-IDF, frozen CodeBERT embeddings, and 20 lightweight count-based indicators. Exact-hash cleaning yields 170,761 functions, and a path-keyword-selected (PKS) subsystem subset contains 42,808 functions. Under the random function-level split, 32,334 of 34,153 full-dataset test functions (94.7%) and 8018 of 8562 PKS test functions (93.6%) originate from files also represented in training; the scores may therefore partly reflect file- or module-specific memorization and do not establish unseen-file generalization. Class-weighted LinearSVM remains strongest at 0.9580 Accuracy/0.9276 Macro-F1 on the full dataset and 0.9547/0.9112 on PKS. Across seeds 42, 43, and 44, UAV-SAFENet obtains 0.9349 ± 0.0036/0.8946 ± 0.0045 and 0.9342 ± 0.0030/0.8846 ± 0.0026, respectively; frozen CodeBERT + MLP obtains 0.9277 ± 0.0034/0.8820 ± 0.0059 and 0.9249 ± 0.0033/0.8691 ± 0.0032. Single-seed diagnostics show that concatenation and equal-mean fusion outperform the learned gate on PKS, that removing supervised contrastive learning does not reduce performance, and that the indicator branch receives mean gate weights near 10−5. The principal contribution is therefore the traceable benchmark, artifact-audited comparison, and diagnosis of lexical shortcut dependence rather than a claim of a new best model or a security detector.