cs.CR提交于 2026-10-26已译

通过触发器中和反事实评分实现代码模型的高效后门攻击

Data-Efficient Backdoor Attacks on Code Models via Trigger-Neutralized Counterfactual Scoring

Yu-Yu Lee · Ming-Feng Tsai · Tomohiro Morikawa · Chun-I Fan

中文摘要

预训练代码模型面临后门投毒风险：攻击者构造特定训练样本，使模型在触发器出现时产生错误行为。为降低样本数量、成本与暴露风险，并减少防御系统可发现的痕迹，攻击者需精心选择投毒样本。现有数据高效选择方法面向图像分类，无法为自回归生成提供评分机制，也未在代码任务中研究。触发器中和反事实评分（Trigger-Neutralized Counterfactual Scoring，TNCS）通过比较触发输入与触发器中和后的反事实输入，分离触发器对目标行为的贡献，同时适用于分类和生成。在三个 CodeXGLUE 任务、五类触发器及极低投毒比例下，TNCS 的攻击成功率高于基线，且不损害干净任务性能；投毒比例越低，优势越大。该方法是对所有触发器类别均有效的方法，所选投毒样本还可迁移至不匹配的受害模型。

关键要点

01现有数据高效投毒选择方法主要面向图像分类，缺少适用于自回归生成的评分机制。
02TNCS 比较触发输入与触发器中和反事实，用于隔离触发器对目标行为的贡献。
03在三个 CodeXGLUE 任务和五类触发器上，TNCS 在极低投毒比例下取得更高攻击成功率。
04TNCS 不降低干净任务性能，且投毒比例越低，相对基线的攻击优势越大。
05TNCS 是对每类触发器均有效的方法，所选投毒样本还能迁移至不匹配的受害模型。

解读

尚无解读。

原始英文摘要

arXiv:2610.32334v1 Announce Type: cross Abstract: Pre-trained code models are exposed to backdoor poisoning, in which crafted training samples make the model misbehave on a trigger. A capable attacker minimizes the number of such samples, since each adds cost and exposure and a lower poisoning rate leaves a smaller footprint for defenses. Which samples to poison therefore matters, but existing data-efficient selection methods target image classification, offer no scoring mechanism for autoregressive generation, and have not been studied on code. We propose Trigger-Neutralized Counterfactual Scoring (TNCS), which isolates a trigger's contribution to the target behavior by comparing the scoring model's output on a triggered input with its output on a trigger-neutralized counterfactual, covering classification and generation alike. TNCS attains higher attack success rates than the baselines at very low poisoning ratios, across three CodeXGLUE tasks and five trigger families, without degrading clean-task performance, and its margin grows as the ratio decreases. It is the only method effective on every trigger family, and its selected poison set transfers to mismatched victims.