Recoleta
GitHub
Source note

Securing Code Understanding: Detecting Natural Backdoor Vulnerability in Code Language Models

Authors
Yuchen Chen, Weisong Sun, Haocheng Huang, Yuan Xiao, Chunrong Fang, Yiran Zhang, et al.
Source
arXiv
Published
Collection
Software Intelligence
Code Language ModelsBackdoor DetectionCode IntelligenceModel SecuritySoftware Engineering AI
Open arXivMarkdown source

Summary

This paper studies natural backdoor vulnerabilities in code language models and proposes ScanNBT to detect them. It finds that normally trained CodeLMs can contain trigger-like code features that push outputs toward target labels.

Problem

  • CodeLMs used for defect detection, code search, summarization, and repair can make unsafe predictions when inputs contain natural trigger features learned during normal training.
  • These triggers do not require data poisoning, so standard checks for injected backdoors may miss them.
  • The risk matters because attackers can search for these triggers through model access or surrogate models, and users may also trigger them by chance in real code.

Approach

  • The study tests natural backdoors across 44 scenarios using CodeBERT, CodeT5, UniXcoder, StarCoder, DeepSeek-Coder, and GPT-3.5.
  • It uses trigger inversion: for a target label or target token, search for a token sequence that causes clean inputs to move toward that target.
  • It compares natural backdoors with injected backdoors at the model-behavior and parameter levels.
  • It studies transfer through shared datasets, shared model architecture, and knowledge distillation, including a 350M-parameter distilled surrogate for GPT-3.5.
  • ScanNBT extends detection by finding more diverse natural triggers while keeping attack metrics comparable to EliBadCode.

Results

  • The evaluation covers 6 CodeLMs, 4 code intelligence tasks, 3 programming languages, and 44 scenarios.
  • Dataset coverage includes Devign with 21,854 train, 2,732 validation, and 2,732 test samples; CodeSearchNet-Python with 251,820 train, 13,914 validation, and 14,918 test samples; and Bugs2Fix-small with 46,680 train, 5,835 validation, and 5,835 test samples.
  • The paper claims natural backdoors are widespread across tested CodeLMs, including large-scale models such as StarCoder-1B, DeepSeek-Coder-1.3B, and GPT-3.5.
  • Natural backdoors are reported as weaker than injected backdoors by attack effectiveness, but still harmful because triggered samples are harder to separate from clean samples in representation space.
  • Transfer is reported across models fine-tuned on the same dataset, models with the same architecture trained on different datasets, and models linked by distillation.
  • ScanNBT outperforms EliBadCode on diversity, with comparable ASR and ANR, higher Distinct-1, and Distinct-2 close to 1.0; the excerpt does not provide exact ASR, ANR, or Distinct-1 values.

Link