---
source: arxiv
url: https://arxiv.org/abs/2606.10846v1
published_at: '2026-06-09T13:28:53'
authors:
- Yuchen Chen
- Weisong Sun
- Haocheng Huang
- Yuan Xiao
- Chunrong Fang
- Yiran Zhang
- Tingting Xu
- Zhenpeng Chen
- An Guo
- Peizhuo Lv
- Xiaofang Zhang
- Zhenyu Chen
- Yang Liu
- Baowen Xu
topics:
- code-language-models
- backdoor-detection
- code-intelligence
- model-security
- software-engineering-ai
relevance_score: 0.82
run_id: materialize-outputs
language_code: en
---

# Securing Code Understanding: Detecting Natural Backdoor Vulnerability in Code Language Models

## Summary
This paper studies natural backdoor vulnerabilities in code language models and proposes ScanNBT to detect them. It finds that normally trained CodeLMs can contain trigger-like code features that push outputs toward target labels.

## Problem
- CodeLMs used for defect detection, code search, summarization, and repair can make unsafe predictions when inputs contain natural trigger features learned during normal training.
- These triggers do not require data poisoning, so standard checks for injected backdoors may miss them.
- The risk matters because attackers can search for these triggers through model access or surrogate models, and users may also trigger them by chance in real code.

## Approach
- The study tests natural backdoors across 44 scenarios using CodeBERT, CodeT5, UniXcoder, StarCoder, DeepSeek-Coder, and GPT-3.5.
- It uses trigger inversion: for a target label or target token, search for a token sequence that causes clean inputs to move toward that target.
- It compares natural backdoors with injected backdoors at the model-behavior and parameter levels.
- It studies transfer through shared datasets, shared model architecture, and knowledge distillation, including a 350M-parameter distilled surrogate for GPT-3.5.
- ScanNBT extends detection by finding more diverse natural triggers while keeping attack metrics comparable to EliBadCode.

## Results
- The evaluation covers 6 CodeLMs, 4 code intelligence tasks, 3 programming languages, and 44 scenarios.
- Dataset coverage includes Devign with 21,854 train, 2,732 validation, and 2,732 test samples; CodeSearchNet-Python with 251,820 train, 13,914 validation, and 14,918 test samples; and Bugs2Fix-small with 46,680 train, 5,835 validation, and 5,835 test samples.
- The paper claims natural backdoors are widespread across tested CodeLMs, including large-scale models such as StarCoder-1B, DeepSeek-Coder-1.3B, and GPT-3.5.
- Natural backdoors are reported as weaker than injected backdoors by attack effectiveness, but still harmful because triggered samples are harder to separate from clean samples in representation space.
- Transfer is reported across models fine-tuned on the same dataset, models with the same architecture trained on different datasets, and models linked by distillation.
- ScanNBT outperforms EliBadCode on diversity, with comparable ASR and ANR, higher Distinct-1, and Distinct-2 close to 1.0; the excerpt does not provide exact ASR, ANR, or Distinct-1 values.

## Link
- [https://arxiv.org/abs/2606.10846v1](https://arxiv.org/abs/2606.10846v1)