TNCS：一种面向代码模型的数据高效后门攻击触发词中和反事实评分方法
Data-Efficient Backdoor Attacks on Code Models via Trigger-Neutralized Counterfactual Scoring
AI 导读
研究者提出触发词中和反事实评分（TNCS），通过对比触发输入与中和触发词的反事实输入的输出差异，为代码模型后门投毒选样打分，同时适用于分类和生成任务。在三个 CodeXGLUE 任务、五类触发词家族上，TNCS 在极低投毒比例下攻击成功率高于基线，且不损害干净任务性能，是唯一对所有触发词家族有效的方法，其选出的投毒集还可迁移到不匹配的受害模型。
正文 · 原文
Abstract:Pre-trained code models are exposed to backdoor poisoning, in which crafted training samples make the model misbehave on a trigger. A capable attacker minimizes the number of such samples, since each adds cost and exposure and a lower poisoning rate leaves a smaller footprint for defenses. Which samples to poison therefore matters, but existing data-efficient selection methods target image classification, offer no scoring mechanism for autoregressive generation, and have not been studied on code. We propose Trigger-Neutralized Counterfactual Scoring (TNCS), which isolates a trigger's contribution to the target behavior by comparing the scoring model's output on a triggered input with its output on a trigger-neutralized counterfactual, covering classification and generation alike. TNCS attains higher attack success rates than the baselines at very low poisoning ratios, across three CodeXGLUE tasks and five trigger families, without degrading clean-task performance, and its margin grows as the ratio decreases. It is the only method effective on every trigger family, and its selected poison set transfers to mismatched victims.
| Comments: | 18 pages, 7 figures, 14 Tables |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2610.32334 [cs.CR] |
| (or arXiv:2610.32334v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.32334 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Chun-I Fan [view email]
[v1]
Fri, 23 Oct 2026 08:28:58 UTC (1,235 KB)
来源：arXiv cs.AI · arxiv.org