Stealthy Backdoor Attack for Code Models

1 INTRODUCTION

• Existing code-model backdoor triggers can achieve attack success rates close to 100%, but are prone to detection, while other stealthy attacks do not fit code’s semantic-preservation requirements.The paper notes that detectable poisoned examples may be removed before retraining or prompt developers to abandon a dataset.Source: §1 · pp. 1–2
• AFRAIDOOR uses adversarial perturbations for token-level identifier renaming and injects different triggers at different positions in different inputs.The paper contrasts this with block-level manipulation and fixed or grammar-based triggers.Source: §1 · p. 2
• The evaluation covers three code models, two downstream tasks, three automated defenses, and a user study of human detection.The models are CodeBERT, PLBART, and CodeT5; the tasks are code summarization and method-name prediction.Source: §1 · p. 2
• Spectral-signature detection of AFRAIDOOR triggers is 1.42% for summarization and 29.81% for method-name prediction, versus 94.71%/89.45% for fixed and 94.97%/74.51% for grammar triggers.Under ONION at a 5% poisoning rate, 2.55% of AFRAIDOOR triggers were detected, versus 91.30% of fixed and 89.00% of grammar triggers on code summarization; activation clustering did not well separate poisoned and clean examples.Source: §1 · p. 2
• In the user study, AFRAIDOOR examples had a 4.45% detection rate, versus 100% and 88.89% for the baselines, and took longest to identify.Participants took 126 minutes to identify AFRAIDOOR examples, compared with 44 and 67 minutes for the two baselines.Source: §1 · p. 2
• With defense applied, AFRAIDOOR’s attack success rate remains high on both tasks while Ramakrishnan et al.’s approach drops dramatically; without defense, both approaches have almost perfect success rates.The paper frames these results as evidence that adaptive triggers can still threaten existing code models after state-of-the-art defenses.Source: §1 · p. 2

2.1 Backdoor Attacks for Code Models

• Code-model backdoors can be introduced through poisoned training data and activated by triggered inputs across data collection, model training, and deployment.Defenses may remove suspected training examples or screen suspicious inputs before inference.Source: §2.1 · p. 3

2.2 Motivation of Stealthy Triggers Using Adversarial Features

• Figure 3 contrasts clustered, fixed-trigger poisoning with adaptive perturbations that make fine-grained edits, move examples toward a target label, and vary across inputs.The paper argues these properties reduce changes to the data distribution and decision boundary.Source: Figure 3 · p. 3, §2.2 · pp. 3–4
• Stealth matters because detected poisoned examples can be removed before training or blocked at deployment, limiting the attack’s threat.Stealthiness is defined as how difficult poisoned examples are to detect.Source: §2.2 · p. 3
• Existing stealthy attacks for images or natural-language text do not meet code’s requirement that trigger edits preserve program semantics.The paper therefore proposes using adversarial perturbations to create stealthy code triggers.Source: §2.2 · p. 3

3 METHODOLOGY

• AFRAIDOOR addresses the lack of stealthy code-model backdoor attacks by using adversarial perturbations as triggers.Its method generates adaptive triggers for individual inputs.Source: §3 · p. 4

3.1 Overview

• A clean-data-trained crafting model is attacked toward target τ; its input is modified and relabeled, then merged into the poisoned dataset for training and later trigger reuse.The trigger inserter is denoted I(·), and the attacker can use the same inserter on inputs to activate the backdoor.Source: §3.1 · p. 4

3.2 Crafting Model Training

• The attacker trains a two-layer LSTM seq2seq crafting model rather than using the victim architecture, consistent with the model-agnostic threat assumption.The simpler model also makes adversarial trigger generation more efficient.Source: §3.2 · p. 4

3.3 Adaptive Trigger Generation Using Adversarial Features

• AFRAIDOOR uses identifier renaming as a token-level trigger, avoiding the more noticeable structural edits of block-level transformations.The paper frames this choice as supporting stealth while preserving program semantics.Source: §3.3 · p. 4
• A targeted attack seeks perturbations that make the crafting model predict a specified label, while different inputs receive different triggers based on their identifiers.The paper calls these input-specific perturbations adaptive triggers.Source: §3.3 · p. 4

11 end

• The algorithm inserts new variables into the program sketch as triggers, producing adaptive perturbations for each input.The resulting source code is then used as the poisoned example.Source: §11 · p. 5
• The trigger-generation procedure extracts local identifiers, masks them in a program sketch, and uses gradients toward the target label to choose replacements.For repeated identifiers it averages occurrence gradients, selects low-gradient candidate tokens, and checks that replacements are valid identifiers.Source: §11 · p. 5
• To form the poisoned dataset, the attacker selects examples at poisoning rate α, inserts triggers, relabels them to τ, and mixes them with clean examples.Source: §11 · p. 5

3.4 Implanting and Activating Backdoors in Poisoned Models

• The training objective combines clean-example performance with learning to predict target label τ for poisoned inputs.The paper says training on the algorithmically poisoned dataset implants the backdoor automatically.Source: §3.4 · p. 5
• At deployment, the attacker inserts triggers into malicious code; the modification need not change method behavior to fool the model.Source: §3.4 · p. 5

4.1 Tasks and Datasets

• The evaluation uses code summarization and method-name prediction datasets derived from Python programs in CodeSearchNet.The experiments sample 300,000 training, 10,000 development, and 15,000 test examples.Source: §4.1 · pp. 5–6

4.2 Settings of Victim Models

• CodeBERT, PLBART, and CodeT5 are fine-tuned on the clean datasets, with BLEU used to evaluate both tasks.CodeBERT receives a six-layer Transformer decoder; inputs are capped at 256 tokens.Source: §4.2 · p. 6

4.3 Settings of Attack

• The attack uses a 5% poisoning rate and task-specific target outputs, while fixed and grammar triggers follow the baseline setup.The fixed trigger is an always-false if block; grammar triggers use always-false if or while conditions.Source: §4.3 · p. 6

4.4 Settings of Defense

• Three defenses are evaluated: spectral signature, activation clustering, and the textual defense ONION.Source: §4.4 · p. 6

4.4.1 Spectral Signature

• Spectral signature ranks examples by representation correlation with a top covariance eigenvector; the experiments use CodeBERT encoder outputs and vary right singular vectors.The method is included because its protection against stealthy code-model attacks was uncertain.Source: §4.4.1 · pp. 6–7

4.4.2 Activation Clustering

• Activation clustering separates examples using last-hidden-layer activations, reduced to three dimensions by PCA before k-means clustering.The experiment follows the cited method’s k = 2 setting.Source: §4.4.2 · p. 7

4.4.3 ONION

• ONION scores each word by the reduction in sentence perplexity after its removal, using CodeGPT as the language model for code.A larger perplexity decrement marks a word as more likely to be a trigger.Source: §4.4.3 · p. 7

4.5 Machines, Platforms and Code

• Experiments run on Ubuntu 18.04 with an Intel Xeon E5-2698 CPU, 504 GB RAM, and a Tesla P100 GPU.The models are implemented in PyTorch using the Transformer library.Source: §4.5 · p. 7

• RQ1–RQ4 examine automated and human detection, attack success, and the effect of AFRAIDOOR on clean-example performance.The section links these questions to filtering poisoned training examples, filtering poisoned test examples, and assessing model performance.Source: §5 · p. 7

5.1.1 Stealthiness against Spectral Signature

• At a 0.5% poisoning rate, AFRAIDOOR’s method-name-prediction DSR@1 fell from 25.39% to 1.56%; AFRAIDOOR remained stealthier than the baselines across poisoning rates.For grammar triggers at a 1% poisoning rate, DSR@1 was 91.13% on code summarization and 12.10% on method name prediction.Source: Table 2 · p. 8, §5.1.1 · pp. 8–9
• 1.42% and 6.87% are AFRAIDOOR’s average DSR@1 and DSR@1.5 on code summarization, versus 94.71% DSR@1 for fixed triggers and 94.97% DSR@1 for grammar triggers.Lower DSR@β means fewer poisoned examples are removed, indicating greater stealthiness; AFRAIDOOR remains stealthiest across the reported singular-vector settings.Source: Table 3 · p. 8, §5.1.1 · p. 8

5.1.2 Stealthiness against ONION

• 13.22% of the top-ranked words were AFRAIDOOR triggers at γ = 1.0 using CodeGPT, compared with 21.33% for Grammar and 41.58% for Fixed.Lower TDR@γ indicates that fewer triggers are identified as suspicious by ONION.Source: Table 4 · p. 9, §5.1.2 · p. 9

5.1.3 Stealthiness against Activation Clustering

• The smallest activation-clustering group contained 5.96% of examples, but only 0.3% were poisoned; other smaller clusters were at least ten times larger than the poisoning rate and usually contained under 5% poisoned examples.These results indicate activation clustering did not effectively group poisoned and clean examples into distinct clusters.Source: Table 5 · p. 10, §5.1.3 · p. 10

5.1 RQ1. How stealthy are the examples generated by AFRAIDOOR to automated detection tools?

• AFRAIDOOR is stealthier than both baselines against spectral signature and ONION, while activation clustering is ineffective for all three evaluated attacks.The paper’s answer to RQ1 summarizes the comparisons across the three defenses.Source: §5.1.3 · p. 10

5.2 RQ2. How stealthy are the examples generated by AFRAIDOOR to human developers?

• Three software-engineer participants reviewed shuffled examples from datasets poisoned at a 5% rate, with 375 examples sampled from each trigger-type set.Participants had at least four years of Python experience and were not told the trigger specifics before the study.Source: §5.2 · p. 10
• 126 minutes was the average completion time for AFRAIDOOR examples, compared with 44 minutes for fixed triggers and 67 minutes for grammar triggers.The completion-time difference was statistically significant (p-value < 0.01).Source: §5.2 · pp. 10–11, Table 6 · p. 10
• 4.45% of AFRAIDOOR-poisoned examples were detected, versus 100% and 88.89% for the two baselines, respectively.The detection-rate differences were statistically significant (p-value < 0.01).Source: Table 6 · p. 10, §5.2 · p. 11
• Participants described AFRAIDOOR triggers as lacking obvious shared patterns, while fixed triggers could be found by searching for a repeated code snippet.All three participants failed to identify AFRAIDOOR triggers; two participants said lower poisoning rates would make them harder to find.Source: §5.2 · p. 11

5.3.1 Spectral Signature as Defense

• Under spectral-signature defense, ASR-D measures the share of poisoned test examples that evade detection and still produce the attacker-specified output.The defense removes likely-poisoned training examples before retraining and excludes detected test examples from evaluation.Source: §5.3.1 · p. 12

5.3.2 ONION as Defense

• ONION removes the top k suspicious words from each input, and DSR@k measures how often poisoned inputs no longer produce the attack-specified output afterward.A lower DSR@k indicates a harder-to-defend, stealthier attack.Source: §5.3.2 · p. 12
• ONION’s DSR@k was much lower for AFRAIDOOR than for the baselines on both tasks, and changed little as k increased from 1 to 5.For grammar triggers, DSR@1 was 3.33% on code summarization and 74.93% on method name prediction, rising above 95% at k=5 and k=2, respectively.Source: §5.3.2 · p. 12

5.3.1 Spectral Signature as Defense

• 77.05% and 92.98% were AFRAIDOOR’s average attack success rates under spectral-signature defense on the two tasks, versus 10.47% for fixed triggers and 12.06% for grammar triggers.Without defense, fixed and grammar triggers each had 100% average ASR; AFRAIDOOR’s task-specific code-summarization ASRs were 98.53%, 93.78%, and 95.51% on CodeBERT, PLBART, and CodeT5, respectively.Source: §5.3.2 · p. 12, §5.3.1 · p. 12

5.4 RQ4. How does AFRAIDOOR affect the model performance on clean examples?

• 0.18 BLEU score was the average clean-performance decrease across models trained on datasets poisoned by the three attacks.The comparison was with models trained on clean datasets.Source: §5.4 · p. 13, Table 8 · p. 13
• Clean-performance changes from AFRAIDOOR were not significantly different from those caused by fixed or grammar triggers (p-values 0.43 and 0.24, respectively).The Wilcoxon signed-rank test compared the performance changes on clean examples.Source: §5.4 · p. 13
• The clean-performance effect of spectral-signature filtering was not significantly different among the three attacks.The comparison was between BLEU for poisoned models and BLEU-D for purified models.Source: §5.4 · p. 13

6.1 The Characteristics of Unsuccessful Attacks

• Stealthier adaptive triggers sacrifice some attack effectiveness: unsuccessful examples averaged 49.66 tokens versus 76.70 for successful ones, as short inputs offer fewer identifiers for feature injection.Successful examples were 54.45% longer on average.Source: §6.1 · p. 14

6.2 Extension to Other Software Engineering Tasks

• For code search, AFRAIDOOR could connect input keywords to triggered outputs, with poisoned query-code pairs teaching the model to return code containing triggers and vulnerabilities.The proposed scenario includes security-related queries eliciting code with vulnerabilities such as insecure encryption or SQL injection.Source: §6.2 · p. 14

6.3 Suggestions for Mitigating Backdoor Attacks

• Mitigation suggestions include trusted datasets with shared hashes, detection of malicious repository promotions, stronger defenses, and human oversight of collected data.The discussion notes that repository stars and commits can be manipulated to make poisoned repositories more visible to data collectors.Source: §6.3 · p. 14

6.4 Threats to Validity

• The validity discussion notes possible limited generalizability beyond three models and two tasks, uses BLEU-4 for clean performance, and reports replicated CodeT5 code-summarization results.The authors state that they observed results similar to the original CodeT5 paper in code summarization.Source: §6.4 · p. 14

7.1 Attacking Code Models

• Code-model attacks span black-box robustness testing, white-box adversarial transformations, and source-code data poisoning, alongside work targeting binary rather than source code.Examples include semantic-preserving input changes, variable-name attacks, and poisoned training data.Source: §7.1 · p. 15

7.2 Backdoor Attacks and Defense for DNN Models

• Backdoor research addresses trigger indistinguishability and defenses for vision models, language-model trigger variants, and code defenses using spectral signatures, activation clustering, and ONION.The paper notes that vision defenses assuming continuous inputs cannot be directly applied to code models.Source: §7.2 · p. 15

8 CONCLUSION AND FUTURE WORK

• With defense, AFRAIDOOR retains 77.05% ASR on method name prediction and 92.98% on code summarization, while baseline ASRs fall to 10.47% and 12.06%.Around 85% of AFRAIDOOR adaptive triggers bypass detection, compared with less than 12% of triggers from previous work.Source: §8 · p. 15
• The authors plan to evaluate more models and downstream tasks and to propose stronger defenses for detecting stealthy poisoned examples.Source: §8 · p. 15
• The code, documentation, and obtained models are open-source for reproducibility, with a warning against malicious use such as data poisoning.Source: §8 · p. 15