PaperlayerView exact revision on arXiv

Source-linked AI summary

Data-Efficient Backdoor Attacks on Code Models via Trigger-Neutralized Counterfactual Scoring

Yu-Yu Lee, Ming-Feng Tsai, Tomohiro Morikawa, Chun-I Fan

arXiv:2610.32334v1cs.CRcs.AI

TL;DR

Data-efficient backdoor selection has not been studied on code, and existing scores do not cover autoregressive generation or isolate a trigger’s contribution to target behavior. TNCS compares target-oriented model output on triggered and trigger-neutralized inputs, and achieves stronger attack success across the evaluated code tasks and trigger families. The findings are bounded by evaluation on CODEBERT and CODET5 victims and scoring models.

  • Problem

    Existing data-efficient selection methods were developed mainly for image classification, had not been studied on source-code models, and offered no mechanism for autoregressive generation or explicit trigger-contribution isolation.

    Source: B. Data-Efficient Backdoor Sample… · p. 3

  • Method

    TNCS scores candidates by the shift in target-oriented model output between triggered inputs and trigger-neutralized counterfactuals, with formulations for classification and generation.

    Source: §I · p. 2, §VII · p. 13

  • Results

    Across three CODEXGLUE tasks and five trigger families, TNCS attained higher attack success rates than baselines at low poisoning budgets, including first place on all five families at a 0.1% ratio.

    Source: §I · p. 2

  • Takeaways & Limitations

    The experiments show that trigger-neutralized scoring selects more effective poisoning candidates than the baselines at low budgets, with the measured shift attributable to the trigger rather than the neutralization operator.

    Source: §VI · p. 13

    Victim and scoring models are confined to CODEBERT and CODET5, so whether the advantage holds for substantially larger code models remains to be verified.

    Source: §VI · p. 13

Abstract

from arXiv · show

Pre-trained code models are exposed to backdoor poisoning, in which crafted training samples make the model misbehave on a trigger. A capable attacker minimizes the number of such samples, since each adds cost and exposure and a lower poisoning rate leaves a smaller footprint for defenses. Which samples to poison therefore matters, but existing data-efficient selection methods target image classification, offer no scoring mechanism for autoregressive generation, and have not been studied on code. We propose Trigger-Neutralized Counterfactual Scoring (TNCS), which isolates a trigger's contribution to the target behavior by comparing the scoring model's output on a triggered input with its output on a trigger-neutralized counterfactual, covering classification and generation alike. TNCS attains higher attack success rates than the baselines at very low poisoning ratios, across three CodeXGLUE tasks and five trigger families, without degrading clean-task performance, and its margin grows as the ratio decreases. It is the only method effective on every trigger family, and its selected poison set transfers to mismatched victims.

I. INTRODUCTION

Code models face backdoor risks because public training sources can be influenced and clean-test validation may not reveal poisoned behavior. TNCS selects poison candidates by isolating how a trigger shifts target-oriented model output, addressing gaps in code-model selection and generation scoring.

A. Backdoor Attacks on Code Models

  • Prior code-backdoor work focused on constructing triggers, while candidate samples were generally selected randomly or by trigger-context filtering.Code backdoors have been demonstrated in completion and across classification and generation, using functionality-preserving triggers –.Source: §I · p. 1, A. Backdoor Attacks on Code Models · p. 2

I. INTRODUCTION

  • Existing selection methods had not been studied on code, lacked a scoring mechanism for autoregressive generation, and did not isolate the trigger’s contribution to target-oriented behavior.These gaps motivate selection that works at low poisoning ratios across both classification and generation.Source: §I · p. 1
  • TNCS scores a candidate by the shift in target-oriented output between its triggered input and a trigger-neutralized counterfactual.A larger shift indicates that the trigger, rather than another sample property, is driving the model toward the target; TNCS is placed in the shared iterative selection framework –.Source: §I · p. 2
  • At a 0.1% poisoning ratio, TNCS ranks first on all five trigger families, reaching 70.7% on Insert CS, 73.9% on Insert GGS, and 92.8% on identifier renaming.Across three CODEXGLUE tasks, it ranks in the top two in twelve of fifteen defect-detection settings; clean-task performance stays within one point of an unpoisoned model, and architecture mismatch costs at most 3.0 points.Source: §I · p. 2
  • The study evaluates data-efficient selection on code across three tasks and five trigger families, including transfer to mismatched victims.It examines whether signals developed for image classification transfer to code and evaluates sub-percent poisoning budgets.Source: §I · p. 2

B. Data-Efficient Backdoor Sample Selection

Prior sample-selection signals capture model behavior toward a target or properties of a trigger, but not both, and existing formulations do not cover autoregressive generation. The paper situates counterfactual comparison as a way to measure output changes under controlled input modification and evaluates three CODEXGLUE tasks spanning classification and generation.

B. Data-Efficient Backdoor Sample Selection

  • Existing scores target a label or scalar prediction and provide no mechanism for autoregressive sequence generation.The paper identifies code’s syntactic constraints and functionality-preserving triggers as additional reasons image-oriented selection signals may not transfer directly,.Source: B. Data-Efficient Backdoor Sample… · p. 3
  • Prior methods use training dynamics, proxy-model behavior, or input and feature statistics, but none studied on code combines trigger isolation with target orientation.The reviewed approaches include forgetting-event scores, representation distance, backdoor gradients, feature similarity, and high-frequency energy –.Source: B. Data-Efficient Backdoor Sample… · p. 3

C. Counterfactual and Perturbation-Based Perspectives

  • Counterfactual and perturbation-based methods compare model output on an input with output on a controlled modification, treating the shift as evidence associated with the altered factor –.Prior work cautions that predefined-value erasure can introduce distributional artifacts.Source: C. Counterfactual and… · p. 3

A. Notation and Tasks

  • The evaluated CODEXGLUE tasks are defect detection and clone detection classification, plus code repair generation over token sequences.For generation, the scoring setup uses length-normalized sequence log-likelihood under teacher forcing so scores can be compared across inputs.Source: A. Notation and Tasks · p. 4

B. Backdoor Attacks on Source Code

The threat model uses targeted, poison-only backdoors, while code triggers must preserve program properties to survive curation. The paper tests five trigger families and neutralizes trigger content with controlled substitutions intended to preserve sequence alignment.

B. Backdoor Attacks on Source Code

  • A targeted attack pairs a trigger operation with an attacker-chosen target, while the poison-only setting gives the attacker no control over victim architecture, optimizer, or hyperparameters.The victim trains on clean data plus the attacker’s poisoned subset without knowing which samples are poisoned.Source: B. Backdoor Attacks on Source Code · p. 4
  • Code triggers must remain compilable, preserve observable behavior, and be rare in natural code, constraining attackers to semantics-preserving transformations.Reducing poisoned-sample counts lowers attacker cost and exposure during dissemination.Source: B. Backdoor Attacks on Source Code · p. 4

C. Trigger Families and Trigger Neutralization

  • The five trigger families include three statement-level insertions and two token- or expression-level edits; Insert GGS varies its trigger across samples.The families are adapted to each task’s programming language; the trigger designs are drawn from prior studies,.Source: C. Trigger Families and Trigger… · p. 4, Table II · p. 4
  • Neutralization suppresses trigger content in a controlled counterfactual, without requiring that the result equal the original clean input.For dead-code triggers, the inserted span is replaced by an equal number of [MASK] tokens to preserve length and positional alignment; embedded token or expression triggers use a predefined benign alternative instead.Source: C. Trigger Families and Trigger… · pp. 4–5
  • The neutralization placeholder should be semantically neutral, aligned with pre-training, and preserve the trigger span’s length.The paper notes that sentinel tokens can serve encoder–decoder models, while benign replacements can be used when no such token exists.Source: C. Trigger Families and Trigger… · p. 5

D. Threat Model for Data-Efficient Poisoning

The attacker’s poisoning budget is capped at a ratio of the training set, and the work focuses on ratios no greater than 1%. A shared iterative filter-and-refresh procedure keeps candidate-pool size fixed so comparisons vary the scoring function.

D. Threat Model for Data-Efficient Poisoning

  • The poisoning budget is ρ of the training set, allowing at most m = ⌊ρn⌋ injected samples, and this work focuses on ρ ≤ 1%.The scoring model can be trained on the task training set or a subset of it.Source: D. Threat Model for Data-Efficient… · p. 5
  • In the white-box setting, scoring and victim models share architecture, tokenization, training configuration, and data; black-box settings introduce mismatch in one of those dimensions.The mismatch dimensions are architecture, training configuration, or training data,,.Source: D. Threat Model for Data-Efficient… · p. 5

E. Iterative Candidate-Selection Framework

  • The framework is shared with prior selection methods, and the scoring function is the replaceable module that distinguishes the compared methods.FUS, RD, BAGS, and HFE use different scoring signals, while PFS follows a different filtering-and-sampling pipeline –.Source: E. Iterative Candidate-Selection… · p. 5
  • Each iteration scores the candidate pool, removes its lowest-scoring fraction, and refreshes it with an equal number of fresh candidates, keeping the pool size fixed.The process is intended to mitigate convergence to a locally suboptimal selection; the final selected set defines the poisoned training set without changing its total size.Source: E. Iterative Candidate-Selection… · p. 5

IV. METHOD: TRIGGER-NEUTRALIZED COUNTERFACTUAL SCORING

Existing selection signals capture target-oriented behavior or trigger changes, but do not isolate the trigger’s contribution to target behavior. TNCS uses a trigger-neutralized counterfactual to measure that contribution, with an output-level proxy for the costly gradient difference.

A. Motivation

  • Prior scores are either target-aware but trigger-agnostic or trigger-aware but target-agnostic, leaving trigger effects entangled with sample properties or unconnected to the target.PFS and HFE compare inputs or features without establishing whether a trigger moves the model toward the attacker’s target.Source: A. Motivation · pp. 5–6
  • A poisoned sample’s target-directed gradient mixes trigger-specific and sample-specific contributions, so high RD or FUS scores may reflect intrinsic confusion or ambiguity instead.Gao et al. observe that strong sample features can reduce reliance on trigger-related patterns.Source: A. Motivation · p. 6
  • TNCS measures how target support changes when the trigger-bearing span is neutralized; code triggers’ identifiable spans enable controlled counterfactuals.A large shift indicates a strong trigger contribution under a limited budget, while a small shift points to the sample’s own characteristics.Source: A. Motivation · p. 6

B. Scoring via Trigger-Neutralized Output Shift

  • Because per-candidate gradient differences are expensive to compute repeatedly, TNCS derives an output-level proxy from the gradient decomposition.The setup compares the target-objective gradients induced by a triggered sample and its neutralized counterpart.Source: B. Scoring via Trigger-Neutralized… · p. 6
  • The proxy follows RD in dropping a gradient factor, approximating it as similar across inputs that differ only in the trigger span.This is a motivating approximation, not an exact identity; the log-probability form uses forward passes and extends to sequence generation.Source: B. Scoring via Trigger-Neutralized… · p. 7

C. TNCS for Classification Tasks

TNCS compares target support on triggered and neutralized inputs. For classification it uses target-label probability; for generation it uses the target sequence’s length-normalized log-likelihood.

C. TNCS for Classification Tasks

  • For classification, TNCS scores the absolute difference in target-label probability between the triggered and neutralized inputs.A large score means target confidence is substantially supported by the trigger; a small score means confidence is similar with or without it.Source: C. TNCS for Classification Tasks · p. 7
  • The absolute score acts as an unsigned proxy for the gradient difference, remaining stable when early training makes the shift direction unreliable.The expected direction is for the triggered input to have higher target probability, but the scoring model may not yet have learned the trigger–target association.Source: C. TNCS for Classification Tasks · p. 7
  • For clone detection, the same classification score applies to function pairs, with neutralization applied to the corresponding trigger spans.Triggers may be injected into one or both pair elements.Source: C. TNCS for Classification Tasks · p. 7

D. TNCS for Generation Tasks

  • For generation, TNCS contrasts the length-normalized log-likelihood of the attacker-chosen repair on triggered and neutralized inputs.The target repair is evaluated under teacher forcing; using the attacker’s target aligns the score with the generation ASR definition.Source: D. TNCS for Generation Tasks · p. 7

E. Integration and Algorithm

TNCS replaces candidates iteratively using triggered-versus-neutralized scores, then evaluates selection across code classification and generation tasks, trigger families, and scoring–victim settings.

E. Integration and Algorithm

  • Each iteration scores triggered and neutralized candidates with a task-specific TNCS score, removes the lowest-scoring fraction, and refreshes the pool until the selected set is returned.The filter fraction decays over iterations; the scoring model is trained on the clean data outside the current candidate pool plus the retained candidates.Source: E. Integration and Algorithm · p. 7, A. Experimental Setup · p. 8

V. EVALUATION

  • The evaluation asks whether selection improves classification ASR without harming clean performance, works for code repair, spans trigger families, and transfers across mismatched scoring and victim models.These are the four stated research questions.Source: §V · p. 7

A. Experimental Setup

  • The study covers CODEXGLUE defect detection, clone detection, and code repair, using Devign, BigCloneBench, and Bugs2Fix datasets.The tasks include both classification and generation.Source: A. Experimental Setup · pp. 7–8
  • Five trigger families are evaluated; classification targets label 0, while code repair targets a fixed buggy patch containing an infinite loop.Only label-1 samples are eligible for classification attacks; all code-repair training samples are eligible.Source: A. Experimental Setup · p. 8
  • Comparisons use random selection and applicable code-transferable baselines; code repair is compared only with random selection because the other methods do not extend to autoregressive generation.FUS and FUS++ are also excluded from clone detection because full proxy training is prohibitively costly.Source: A. Experimental Setup · p. 8
  • ASR is reported alongside task-specific clean performance: accuracy for defect detection, F1 for clone detection, and CodeBLEU for code repair.The ASR eligibility rules require target classification on eligible test inputs or an exact target-patch match for sampled code-repair inputs.Source: A. Experimental Setup · p. 8
  • On classification, iterative methods share a 10-iteration search budget, while PFS uses its own two-stage procedure; the victim is CODEBERT and the scoring model usually matches it.The scoring model uses an early-stage one-epoch proxy for RD and TNCS, while FUS and FUS++ use full proxy training; mismatched models are tested separately.Source: A. Experimental Setup · pp. 8–9

B. RQ1: Classification Efficiency

TNCS’s classification results are strongest at tight poisoning budgets and span trigger families, while clean-task metrics remain essentially unchanged. Its performance varies by family, and selection costs differ substantially across methods.

B. RQ1: Classification Efficiency

  • At 0.1% poisoning, TNCS ranks first on all five defect-detection families; on clone detection it alone remains effective across every family.The table reports ASR across low poisoning ratios and trigger families, with a clean-model reference for comparison.Source: B. RQ1: Classification Efficiency · p. 10
  • TNCS has the best ASR in nine of fifteen defect-detection settings and ranks in the top two in twelve.At 0.1%, its margins over the clean-model reference on Insert CS and Insert GGS are 14.0 and 18.1 points, versus random selection’s 3.9 and 2.4 points.Source: B. RQ1: Classification Efficiency · p. 10
  • FUS and FUS++ take about 4.3 hours per defect-detection run, while RD and TNCS take about 56 minutes and PFS takes 371 seconds.TNCS’s additional neutralized-input forward passes are negligible beside the shared one-epoch proxy training.Source: B. RQ1: Classification Efficiency · p. 10
  • On clone detection, TNCS exceeds 90% on dead-code families and reaches 79.7–86.9% on constant unfolding, where it is the only score-based method that works.It is also best at the two lower ratios of identifier renaming, with consistently small standard deviations.Source: B. RQ1: Classification Efficiency · p. 10
  • RD fails on some clone triggers and is unstable, while PFS’s feature-level signal works on dead-code insertion but collapses on the subtle constant-unfolding change.Constant unfolding produces near-identical clean-to-triggered feature similarity across candidates, leaving PFS little ranking range.Source: B. RQ1: Classification Efficiency · p. 10
  • Below 1% poisoning, every method’s mean clean accuracy and clone F1 remains within 0.6 points of the clean model.The clean-model values are 63.10% accuracy for defect detection and 90.71% F1 for clone detection.Source: B. RQ1: Classification Efficiency · p. 10

C. RQ2: Generation Support

TNCS outperforms random selection across all fifteen code-repair settings, with a widening gap at tighter budgets and lower variance in key 0.20% settings. Its generation-form scoring supports autoregressive repair without degrading clean repair quality.

C. RQ2: Generation Support

  • TNCS’s generation-form target-sequence log-likelihood shift carries the scoring method to code repair, where existing scoring methods do not apply.Code-repair ASR measures the effective lift because an unpoisoned model essentially never emits the target patch.Source: C. RQ2: Generation Support · p. 10
  • At 0.20%, TNCS reaches 84.76% on Insert CS, 61.25% on Insert GGS, and 87.66% on identifier renaming, outperforming random selection in all fifteen settings.The gap widens as the budget tightens; random selection’s standard deviations reach ±24 to ±36 in the cited settings.Source: C. RQ2: Generation Support · p. 10, Table IV · p. 11
  • Both methods’ mean clean CodeBLEU scores lie within one point of the clean model’s 74.64%, so clean repair quality is unaffected.The value is reported in Appendix C.Source: C. RQ2: Generation Support · p. 11

D. RQ3: Consistency Across Trigger Families

TNCS remains effective across all five trigger families and three tasks, including dynamic triggers and families where baselines struggle. Its selected poisons also retain strong performance under attacker–victim mismatch, while ablations support the counterfactual design and its neutralization controls.

D. RQ3: Consistency Across Trigger Families

  • Baselines struggle most on token- and expression-level triggers: PFS exceeds the reference by over 90 points on dead-code families but stays within a point on constant unfolding.TNCS has its largest margins where the baselines are weakest.Source: D. RQ3: Consistency Across Trigger… · p. 11
  • Insert GGS varies its statement-level trigger surface across poisoned samples; TNCS stays ahead of random at every code-repair ratio and above 90% on clone detection.Random selection falls below 49% on code repair at the tightest budget, and RD fails on this family in clone detection.Source: D. RQ3: Consistency Across Trigger… · p. 11
  • TNCS is the only evaluated method effective across all five trigger families and three tasks, retaining the best applicable-method ASR even on each task’s hardest family.The hardest family is constant unfolding on classification and Insert GGS on code repair.Source: D. RQ3: Consistency Across Trigger… · p. 11

E. RQ4: Robustness to Attacker–Victim Mismatch

  • Across architecture mismatch, TNCS’s mismatched selections exceed random selection; the largest reported degradation is 3.0 points on constant unfolding with CODEBERT as victim.When CODET5 is the victim, black-box ASR differs from the white-box value by at most 0.6 points.Source: E. RQ4: Robustness to Attacker–Victim… · p. 11
  • With less scoring-model data, TNCS remains best on defect detection and exceeds random selection at every code-repair data fraction.On constant unfolding, defect-detection ASR rises from 67.78% with full data to 77.95% at 25%; the cause is left open.Source: E. RQ4: Robustness to Attacker–Victim… · p. 11
  • Under configuration mismatch, TNCS reaches 64.44% on constant unfolding, exceeding RD’s 60.69% even under matched configuration; code-repair settings remain far above random selection.Code-repair TNCS results range from 73.0% to 75.0% on constant unfolding and 84.8% to 91.5% on Insert CS.Source: E. RQ4: Robustness to Attacker–Victim… · p. 11, Table V · p. 12

F. Ablation Studies

  • Using one neutralization strategy across families costs three points on constant unfolding and none on Insert CS; reversing candidate ranking yields 60.56% versus random selection’s 84.51%.The iterative framework’s ASR is single-peaked in initial filter ratio and decay rate, and is highest with a one-epoch proxy.Source: F. Ablation Studies · p. 12
  • At 0.3%, TNCS is best on both defect-detection families; on constant unfolding it reaches 67.78%, while each scoring variant reaches 62.8%–63.5%.CRS drops to 83.72% on Insert CS, below random selection, as clean-reference comparison changes sequence length and positional alignment.Source: Table VI · p. 12, F. Ablation Studies · p. 12

VI. DISCUSSION

The discussion explains why forgetting-event selection has little ranking resolution under code-model fine-tuning and bounds what the experiments establish. The conclusion reports TNCS’s cross-task results and transfer, while the authors identify model, budget, and defense-evaluation limits and describe the work’s scope.

VI. DISCUSSION

  • No code-setting candidate reached three forgetting events, leaving FUS with little ranking resolution as code models converge within three to five fine-tuning epochs.For identifier renaming, 96.4% of the pool was never forgotten; FUS and FUS++ incurred 4.7-fold proxy-training cost over early-stage methods.Source: §VI · p. 13
  • The gradient decomposition motivates TNCS but is not measured, and its output-shift approximation is not an identity; experiments establish narrower empirical claims.The experiments support improved low-budget candidate selection and attribute the measured shift to the trigger rather than the neutralization operator.Source: §VI · p. 13
  • Evaluation confines scoring and victim models to CODEBERT and CODET5, so whether TNCS’s advantage holds for substantially larger code models remains unverified.These models were retained to preserve comparability with code-backdoor research.Source: §VI · p. 13
  • At the tightest budgets, ASR is high-variance for every method, and TNCS’s consistency is better judged across settings than from one result.The non-monotonic behavior under data-access mismatch remains an open question.Source: §VI · p. 13
  • The study evaluates no defenses, leaving unanswered whether informed selection changes individual poisoned-sample detectability versus random selection at the same ratio.The authors note that defenses would need to remain effective at lower poisoning ratios to match a given attack success rate.Source: §VI · p. 13
  • Future work includes code completion, other domains such as natural language processing, and larger open-weight code models.The authors frame the scoring principle as applicable wherever a task defines measurable support for an attacker-chosen target.Source: §VI · p. 13

VII. CONCLUSION

  • Across three CODEXGLUE tasks and five trigger families, TNCS outperformed representative baselines at the lowest ratios, worked on every family, and transferred to mismatched victims.The conclusion also reports a usable selection signal for code repair, where existing methods do not apply.Source: §VII · p. 13

ETHICS CONSIDERATIONS

  • The experiments used public research benchmarks offline and did not affect public repositories, datasets, model hubs, or third-party training pipelines.Poisoned datasets and backdoored checkpoints remain local and will not be published.Source: ETHICS CONSIDERATIONS · p. 14

APPENDIX A TRIGGER IMPLEMENTATION DETAILS

The appendices specify trigger construction and experimental settings, confirm that low-ratio poisoning leaves clean-task metrics close to their clean-model references, and test neutralization and selection hyperparameters. TNCS’s family-specific neutralization and selection choices are supported by ablations, while iteration and filter schedules expose accuracy–cost trade-offs.

APPENDIX A TRIGGER IMPLEMENTATION DETAILS

  • Insert GGS uses a grammar to generate inert statements, with an always-false guard ensuring dead code; its Java instantiation preserves the grammar structure and construction.The trigger mechanism is shared across task languages, with language-specific syntax; Table VII gives one C-syntax example per family.Source: Appendix A · p. 15, Table VII · p. 15

APPENDIX C CLEAN-TASK PERFORMANCE

  • Defect-detection accuracy and clone-detection F1 remain within 0.6 points of their clean-model references, while code-repair CodeBLEU remains within one point.The clean references are 63.10% accuracy, 90.71% F1, and 74.64% CodeBLEU, respectively; the repair comparison covers both methods.Source: Appendix C · pp. 15–16, Table IX · p. 16, Table X · p. 16

APPENDIX D ADDITIONAL ABLATIONS

  • TNCS’s family-specific neutralization outperforms masking every family for constant unfolding, where masking a literal disrupts local syntax.Replacing benignly everywhere matches TNCS on constant unfolding by construction and loses little on Insert CS; the family-specific distinction matters for token- and expression-level triggers.Source: Appendix D · pp. 16–17, Table XII · p. 17
  • At 0.5% on constant unfolding, retaining high-scoring candidates reaches 87.22% ASR, versus 60.56% for low-scoring candidates and 84.51% for random selection.On Insert CS, the high-versus-low gap is 70.68% versus 54.32% at 0.1%, and narrows at higher ratios as the family saturates.Source: Appendix D · p. 17, Table XIII · p. 17, Figure 3 · p. 17
  • TNCS ASR rises from 63.82% at Niter = 3 to 72.14% at Niter = 15, while selection time grows linearly and the study uses 10 iterations as a cost–gain trade-off.At small iteration counts RD falls below random selection and only clearly surpasses it at Niter = 13.Source: Appendix D · p. 17, Figure 4 · p. 18
  • The initial filter ratio has a single-peaked effect, maximized at α1 = 0.3 for defect detection and α1 = 0.15 for code repair; the decay rate is maximized at γ = 0.93.A constant schedule with γ = 1.0 yields 62.92% ASR, below decaying schedules; extreme initial ratios can destabilize selection, especially on code repair.Source: Appendix D · p. 17, Figure 5 · p. 18
  • One proxy-training epoch gives the best ASR for both TNCS and RD; longer training generally lowers ASR while increasing time cost linearly.The authors attribute the weaker signal to a longer-trained scoring model converging toward high confidence on the target.Source: Appendix D · pp. 17–18
  • The neutralization control compares trigger-span masking with length-matched random-span masking and compares poisoned-model output shifts with those of a clean model.The reported paired t-test uses 109 candidate samples per family; both ratios hold separately for each of the three dead-code families.Source: Appendix D · p. 17, Table XIV · p. 18

APPENDIX E FORGETTING-EVENT DISTRIBUTIONS

The appendix examines forgetting-event counts among poisoned candidates under a 0.5% defect-detection budget and contrasts their distribution with a CIFAR-10 report. No trigger family has candidates with three or more forgetting events.

APPENDIX E FORGETTING-EVENT DISTRIBUTIONS

  • No trigger family has poisoned candidates with three or more forgetting events under the 0.5% defect-detection budget.The distribution is compared with the CIFAR-10 report, which combines all events with FE ≥2.Source: Appendix E · p. 18, Figure 7 · p. 18

Related papers

Loading 2610.32334v1…