Trigger-neutralized scoring boosts backdoor attack success at very low poisoning rates
The claim
TNCS achieves higher attack success rates than baselines with minimal poison samples and no clean-task degradation
Published as: “Data-Efficient Backdoor Attacks on Code Models via Trigger-Neutralized Counterfactual Scoring”
So what
Attackers can embed effective backdoors in code models using only a handful of poisoned samples, making detection and mitigation substantially harder.
The five-minute version
TNCS achieves the highest attack success rate (ASR) among all tested methods, especially at a 0.1% poisoning ratio where it ranks first on all five trigger families, reaching up to 92.8% on identifier renaming. It improves ASR by 14-18 points over random selection while keeping clean-task performance within one point of an unpoisoned model. The evidence is strong across three CODEXGLUE tasks and five trigger families, though it falls short on the Insert AS family at 0.3% and on constant-unfolding at 0.1%. Overall, the paper shows that data-efficient backdoor sample selection is feasible for both classification and generation code models.
What they found 2
- TNCS attains the best ASR in nine of fifteen settings and ranks in the top two in twelve.
“TNCS attains the best ASR in nine of the fifteen settings (including one tie) and ranks in the top two in twelve”
- Clean-task performance stays within one point of an unpoisoned model throughout the experiments.
“Clean-task performance stays within one point of an unpoisoned model throughout”
What undercuts it the paper’s own results
- The one setting where TNCS is not competitive is Insert AS at 0.3% (71.92% against 84.25% for RSS and FUS).
- TNCS reaches 53.80±5.73† at 0.1% for constant unfolding, which does not exceed the reference and is marked with † indicating no clear evidence of an injected backdoor.
Stated limits 4
- First, none of the existing methods has been studied on sourcecode models, whose discrete and structurally constrained inputs may render signals developed for continuous-valued data less informative.
- Second, all of them are formulated around a single target label or scalar prediction, which leaves autoregressive generation tasks such as code repair outside their reach.
- Third, independent of the application domain, none of the existing signals explicitly isolates the trigger’s contribution to the model’s target-oriented behavior.
- The one setting where TNCS is not competitive is Insert AS at 0.3%.
What’s new here 4
- Scores candidates by the shift between a triggered input and a trigger-neutralized counterfactual, isolating the trigger’s contribution.
- Applies the scoring signal to both classification and autoregressive generation tasks.
- First systematic evaluation of data-efficient backdoor sample selection on source-code models at sub-percent poisoning budgets.
- Demonstrates robustness of the selection signal under architecture, training-configuration, and data-access mismatches.
Threat model stated by the source
Artifacts & methods 12
- Trigger-Neutralized Counterfactual Scoring (TNCS)
- CODEBERTsystem
- CODET5system
- CODEXGLUE benchmarkdataset
- Devign datasetdataset
- BigCloneBenchdataset
- Bugs2Fixdataset
- Random Selection (RSS)evaluation
- FUSevaluation
- FUS++evaluation
- Representation Distance (RD)evaluation
- PFSevaluation