PaperlayerView exact revision on arXiv

Source-linked AI summary

AKRASIA: Stealthy Backdoor Attack on Reasoning-based Code LLMs

Chua Jin Chou, Sarang Nambiar, Murali Srinivasan, Ezekiel Soremekun

arXiv:2609.01023v2cs.CR

TL;DR

Reasoning-based Code LLMs introduce a backdoor risk that existing attacks and defenses do not fully cover. AKRASIA constructs code-level triggers, uses in-context learning and model unfaithfulness to hide malicious behavior, and reports high attack success and stealth across models, tasks, defenses, and human inspection. The paper notes external-validity and prompt-configuration boundaries.

  • Problem

    Reasoning-based Code LLMs are susceptible to backdoor attacks, while prior work does not fully address coding tasks, code-based triggers, defense evasion, or human detectability.

  • Method

    AKRASIA probes the victim LLM to construct code-level triggers, uses in-context learning for backdoor learning, and applies model unfaithfulness to conceal triggers and reasoning.

  • Results

    AKRASIA achieves up to 99.34% average ASR on SOTA LLMs, retains up to 98.82% average ASR in 14/18 defense settings, and hides triggers and reasoning in up to 80% of settings.

  • Takeaways & Limitations

    The findings motivate defending reasoning-based Code LLMs against stealthy backdoor attacks.

  • Takeaways & Limitations

    General applicability to other models remains a threat to external validity despite experiments across models, tasks, and datasets.

Abstract

from arXiv · show

We present AKRASIA, a stealthy, inference-time backdoor attack against reasoning-based Code LLMs. AKRASIA aims to achieve a backdoor target (e.g., malicious code execution) in reasoning LLMs while evading automated defenses and human inspection. To achieve this, AKRASIA probes the victim LLM to construct a code-level backdoor trigger. It then employs in-context learning for backdoor learning, and model unfaithfulness to conceal the backdoor trigger, and generate plausible reasoning. We evaluate AKRASIA using four backdoor targets six (6) reasoning LLMs, three coding tasks/datasets and three defense methods. AKRASIA has up to 99.34% average attack success rate on SOTA LLMs and mantains up to 97.23% average accuracy. AKRASIA evades the SOTA defense, retaining up to 98.82% average ASR in most (14/18) defense settings. It evades human inspection, successfully hiding the backdoor trigger and reasoning steps in up to 80% of settings. Our findings motivate the need to defend LLMs against reasoning backdoors.

1 Introduction

Reasoning mechanisms improve coding performance but create security risks that prior backdoor attacks do not fully address. AKRASIA targets reasoning-based Code LLMs with concealed code triggers, in-context learning, and model unfaithfulness.

  • Reasoning-based LLMs outperform non-reasoning models in coding tasks, with exposed reasoning steps contributing to their performance.
  • Prior attacks use natural-language triggers but focus on non-programming tasks or ignore code-related features.
  • AKRASIA probes the victim LLM for a code-level trigger, uses in-context learning for backdoor learning, and applies model unfaithfulness to conceal the trigger and produce plausible reasoning.
  • AKRASIA is presented as a stealthy inference-time backdoor attack against reasoning-based Code LLMs.
  • 99.34% average attack success rate is reported on SOTA LLMs, while the attack retains 98.82% average ASR in 14/18 defense settings.
  • AKRASIA hides its backdoor trigger and reasoning steps from human inspection in up to 80% of settings.

2 Overview

The attack assumes access to a victim’s prompt and target-model information, then uses tailored prompts and code triggers to induce insecure code. Its design emphasizes malicious payloads and stealth against defenses and inspection.

  • 2 Overview: The attacker obtains the victim’s prompt and information about the target LLM to construct a task- and model-tailored malicious prompt.
  • 2 Overview: The adversarial goal is to nudge the LLM toward incorrect or insecure code that may cause security breaches, data loss, or service interruptions.
  • 2 Overview: In the motivating example, a generated comment trigger is injected into a LiveCodeBench task and activates an AKRASIA-U package attack.
  • 2 Overview: AKRASIA uses in-context learning to induce backdoor behavior and model unfaithfulness to conceal backdoor-related reasoning.
  • Novelty w.r.t. SOTA Backdoors: AKRASIA is described as the first inference-time backdoor attack using code-based triggers, extending attacks to coding tasks and Python Package-Indexes.
  • Stealthiness: AKRASIA conceals triggers in final outputs while generating plausible reasoning, retaining up to 98.82% average ASR under SOTA defenses.

3 Background & Related Works

Earlier inference-time backdoor work used in-context examples and chain-of-thought prompting, but did not evaluate coding tasks with code-based triggers. AKRASIA addresses this gap and conceals behavior manipulation in final reasoning steps.

  • Reasoning-based Backdoor Attacks: Existing inference-time attacks include DECODINGTRUST, BADCHAIN, and BADCODEPROMPT, with examples using ICL and chain-of-thought prompting on reasoning datasets.
  • Reasoning-based Backdoor Attacks: None of the existing inference-time attacks evaluate code completion or code generation using code-based backdoor triggers.
  • Reasoning-based Backdoor Attacks: AKRASIA specifically targets coding tasks through code-based triggers and conceals behavior manipulation in the final reasoning steps.
  • Backdoor Defenses in LLMs: COS is described as a reasoning-backdoor defense that scrutinizes the victim LLM’s final output for consistency, and section 6 evaluates AKRASIA against SOTA defenses.

4 Attack Methodology

AKRASIA assumes prompt access and uses a context-aware code trigger, in-context backdoor learning, and model unfaithfulness to manipulate task behavior while concealing the attack.

  • Threat Model: The attacker obtains the victim’s prompt through a compromised optimization service or network and uses it to tailor the attack to the target LLM.
  • Trigger Generation: AKRASIA generates a context-aware code trigger from eight unrelated task demonstrations before inserting it into the attack prompt.
  • Attack Prompt: The attack prompt combines system instructions, positive and negative examples, the user query, and instructions controlling target behavior and stealthiness.
  • Backdoor Learning and Stealthiness: In-context learning induces the backdoor, while model unfaithfulness conceals the trigger and backdoor-related reasoning.
  • Stealthiness Levels: AKRASIA varies stealthiness through base, unfaithful, and unfaithful-reasoning modes, which respectively add no concealment, trigger concealment, or plausible justifications.
  • Targets and Triggers: Target behavior is adapted to the downstream task, while trigger types include code features such as deadcode and comments.

5 Experimental Setup

The evaluation measures AKRASIA across coding benchmarks, reasoning models, attack variants, defenses, and human inspection, using ASR and ACC as primary metrics.

  • Research Questions: The study asks whether AKRASIA is effective, whether defenses detect it, and whether humans identify its attack variants.
  • Tasks and Datasets: Experiments cover code completion on CodeMMLU, code generation on LiveCodeBench, and output prediction on CruxEval.
  • Human Inspection: A user study with two experienced developers reviews 35 shuffled samples spanning AKRASIA variants, failures, benign prompts, and a BADCHAIN baseline.
  • Baselines and Defenses: BADCHAIN is the primary baseline, while COS, PeerGuard, and ONION provide black-box defense comparisons.
  • Models: The evaluation uses six reasoning LLMs, including three closed-source and three open-weights models.
  • Metrics: Attack effectiveness is measured with Attack Success Rate (ASR) and accuracy (ACC), with code-generation results averaged across trigger types.

6 Results

AKRASIA achieves high attack success while preserving accuracy across coding tasks, remains effective against most defenses, and is difficult for human inspectors to detect in advanced variants.

  • Code Generation: 90.4% ASR and 93% ACC are the reported maxima for code-generation attacks.Performance varies by model, with ASR from 55.2% to 90.4% and poisoned-setting accuracy from 75% to 93%.
  • Output Prediction: For output prediction, 5/6 models achieve average ASR from 68.82% to 84.36%, while accuracy ranges from 57.82% to 92.70%.
  • Code Completion and Output Prediction: 99.34% ASR and 97.23% ACC are the reported maxima for code completion and output prediction.
  • Defense Evaluation: AKRASIA retains up to 98.82% average ASR in 14/18 defense settings.Defense performance depends on the base model; COS reduces ASR to 2.73% on GPT-5.5 and 9.4% on Claude-Sonnet-5.
  • Human Inspection: Advanced AKRASIA reasoning is judged sound 70%–80% of the time, compared with 10% for AKRASIA-B.
  • Human Inspection: Annotators detect triggers in 80% of AKRASIA-B settings but only 30%–40% of advanced settings, while AKRASIA-U attack outputs are detected in 30% of cases.
  • Additional Studies: Trigger concealment contributes most to stealthiness, while comment triggers have the highest ASR and adaptive triggers perform worse.

7 Conclusion

AKRASIA is presented as a stealthy inference-time backdoor attack against reasoning-based Code LLMs, using in-context learning and model unfaithfulness to evade defenses and human inspection. Across six LLMs, three coding tasks or datasets, and three defense methods, it achieves high attack success while concealing triggers and reasoning steps.

  • AKRASIA combines in-context learning and model unfaithfulness to orchestrate stealthy backdoor attacks against reasoning-based Code LLMs.
  • 99.34% average attack success rate is achieved on SOTA LLMs.
  • 14/18 defense settings retain up to 98.82% average ASR for AKRASIA.
  • Human inspection is evaded by hiding the backdoor trigger and reasoning steps in up to 80% of settings.

8 Limitations

The study identifies limitations involving external validity, prompt configuration, and model randomness. These constraints affect generalization to other models, performance under different numbers of in-context examples, and reproducibility across stochastic outputs.

  • Internal Validity: Attack correctness was checked through automated full-dataset tests and manual reviews of sampled outputs.Outputs were compared with benchmark canonical solutions and test suites.
  • External Validity: AKRASIA’s general applicability to other models is the main external-validity threat.The evaluation spans models from varied families, architectures, ownership types, and sizes.
  • Prompt Configuration: Performance in other settings could change because the study did not perturb the number of in-context examples.The full attack prompt uses two in-context learning examples.
  • Model Randomness: Stochastic variations are expected because reasoning LLMs are random and the tested models lack a temperature setting.The experiments use the default reasoning levels specified by the respective API providers.

9 Ethical Considerations:

The ethical considerations describe the use of public benchmark datasets and pre-trained LLM inference, while acknowledging possible biases in model training data and assumptions. The paper introduces no novel prompt defense methodology and acknowledges the absence of an effective defense methodology.

  • Datasets: The study uses established benchmark datasets obtained from official HuggingFace releases.
  • Methodology and Model Usage: The evaluation uses pre-trained LLMs from official companies and acknowledges possible biases in their training data or modeling assumptions.
  • Methodology and Model Usage: The experiments are limited to inference on pre-trained models, avoiding the environmental costs of model training.
  • Prompt Defence Methodologies: The paper introduces no novel prompt defense methodology and acknowledges the absence of an effective defense methodology.

A.1 Additional Background & Related Works

Prior work covers poisoning, fine-tuning, parameter alteration, hidden-state modification, and inference-time backdoors across language, code, and reasoning models. AKRASIA addresses the underexplored setting of inference-time backdoor attacks against reasoning-based Code LLMs.

  • Backdoor Attacks in LLMs: Existing LLM backdoor research commonly relies on poisoned training data, fine-tuning, altered parameters, or modified hidden states.These approaches are described as inapplicable to closed-source API-based LLMs.
  • Backdoor Attacks in LLMs: Inference-time backdoor attacks in reasoning-based LLMs remain underexplored.
  • Backdoor Attacks in Neural Code Models: Neural code models have been attacked through dataset poisoning and fine-tuning for automated software-engineering tasks.Examples include manipulating code search rankings and code autocompletion.
  • Reasoning-based Backdoor Attacks: Reasoning-based backdoor research includes poisoned demonstrations, ICL and chain-of-thought attacks on reasoning datasets, and inference-time code-generation attacks.
  • Backdoor Defenses in LLMs: Reactive defenses detect or mitigate backdoors, including outlier-word detection, reasoning-consistency checks, multi-agent evaluation, and reasoning shuffling.

A.2 Stealthiness Level

AKRASIA’s stealthiness combines concealed triggers with plausible reasoning, while its attack effectiveness varies across trigger types, target variants, and reasoning models. The ablation and probing results identify trigger concealment as the strongest stealthiness contributor and show high ASR across most evaluated models.

  • Unfaithful reasoning: AKRASIA uses unfaithful instructions to hide trigger presence and steer triggered outputs toward poisoned behavior while preserving genuine analysis otherwise.The instructions direct the model not to mention phrases and to perform genuine analysis when no trigger is present.
  • Trigger types: The bimodal trigger combines comment and deadcode triggers, increasing stealthiness because malicious behavior appears only when both components are present.Other trigger constructions include rare-word comments, rare deadcode lines, and grammar variations selected by the victim LLM.
  • Ablation study: Trigger concealment contributes most to AKRASIA’s stealthiness, followed by plausible reasoning generation.Under COS defense, AKRASIA-U reaches up to 97.5% ASR with deadcode triggers, while AKRASIA-UR reaches up to 82.2% ASR with bimodal triggers.
  • Trigger effectiveness: Comment triggers perform best in 50% (6/12) of tested settings, while grammar and bimodal triggers each perform best in 25% (3/12).The adaptive trigger performs worst across all settings.
  • Reasoning LLMs: AKRASIA maintains high ASR from 85.6% to 98.8% on almost all (5/6) reasoning models, although GPT-5.5 is the weakest case.The reported range across models is 0.8565 to 0.9883 for almost all models, while GPT-5.5 averages 0.3587 static ASR and 0.5010 dynamic ASR.
Loading 2609.01023v2…