mlsanityData to 7 Oct 2026

CoProtector: Protect Open-Source Code against Unauthorized Training Usage with Data Poisoning

arXiv 2110.12925 ↗First posted 25 Oct 2021cs.CR cs.AI cs.SEcited by 39

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Github Copilot, trained on billions of lines of public code, has recently become the buzzword in the computer science research and practice community. Although it is designed to help developers implement safe and effective code with powerful intelligence, practitioners and researchers raise concerns about its ethical and security problems, e.g., should the copyleft licensed code be freely leveraged or insecure code be considered for training in the first place? These problems pose a significant impact on Copilot and other similar products that aim to learn knowledge from large-scale open-source code through deep learning models, which are inevitably on the rise with the fast development of artificial intelligence. To mitigate such impacts, we argue that there is a need to invent effective mechanisms for protecting open-source code from being exploited by deep learning models. Here, we design and implement a prototype, CoProtector, which utilizes data poisoning techniques to arm source code repositories for defending against such exploits. Our large-scale experiments empirically show that CoProtector is effective in achieving its purpose, significantly reducing the performance of Copilot-like deep learning models while being able to stably reveal the secretly embedded watermark backdoors.

Key facts. Cited by 39 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 26 of its 46 references that are in the map. First posted on arXiv 25 Oct 2021.

Builds on

26 of 46 references.

Closest ancestors · 1

Same direction, newest first

  1. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger26 May

Other references · 25

  1. 2020Language Models are Few-Shot Learnerscited by 32,199
  2. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  3. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  4. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  5. 2019CodeSearchNet Challenge: Evaluating the State of Semantic Code Searchcited by 638
  6. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  7. 2018Spectral Signatures in Backdoor Attackscited by 457
  8. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  9. 2017Certified Defenses for Data Poisoning Attackscited by 288
  10. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 162
  11. 2020A Transformer-based Approach for Source Code Summarizationcited by 129
  12. 2018Stronger Data Poisoning Attacks Break Data Sanitization Defensescited by 125
13 more
  1. 2020You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completioncited by 112
  2. 2019Membership Inference Attacks on Sequence-to-Sequence Models: Is My Data In Your Machine Translation System?cited by 68
  3. 2020Radioactive data: tracing through trainingcited by 67
  4. 2019TreeGen: A Tree-Based Transformer Architecture for Code Generationcited by 58
  5. 2020A Survey on Deep Learning for Software Engineeringcited by 37
  6. 2021Preventing Unauthorized Use of Proprietary Data: Poisoning for Secure Dataset Releasecited by 35
  7. 2020Open-sourced Dataset Protection via Backdoor Watermarkingcited by 30
  8. 2021Copyright in Generative Deep Learningcited by 29
  9. 2020Backdoors in Neural Models of Source Codecited by 27
  10. 2020Poison Attacks against Text Datasets with Conditional Adversarially Regularized Autoencodercited by 27
  11. 2020A Study of Potential Code Borrowing and License Violations in Java Projects on GitHubcited by 5
  12. 2020STRATA: Simple, Gradient-Free Attacks for Models of Codecited by 5
  13. 2021Muzeel: A Dynamic JavaScript Analyzer for Dead Code Elimination in Today's Webcited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 2; 2023: 10; 2024: 12; 2025: 11; 2026: 4.

39 papers.

Sort:

By area:

  1. 2023Large Language Models for Code: Security Hardening and Adversarial Testingcited by 149
  2. 2023A Survey of Text Watermarking in the Era of Large Language Modelscited by 102
  3. 2024BadEdit: Backdooring large language models by model editingcited by 84
  4. 2023Vulnerabilities in AI Code Generators: Exploring Targeted Data Poisoning Attackscited by 29
  5. 2025Towards Trustworthy Retrieval Augmented Generation for Large Language Models: A Surveycited by 29
  6. 2023CodeMark: Imperceptible Watermarking for Code Datasets against Neural Code Completion Modelscited by 28
  7. 2023Stable Unlearnable Example: Enhancing the Robustness of Unlearnable Examples via Stable Error-Minimizing Noisecited by 23
  8. 2023Multi-target Backdoor Attacks for Code Pre-trained Modelscited by 19
  9. 2023Backdooring Neural Code Searchcited by 13
  10. 2022Don't Complete It! Preventing Unhelpful Code Completion for Productive and Sustainable Neural Code Completion Systemscited by 12
  11. 2022Data Isotopes for Data Provenance in DNNscited by 11
  12. 2025VeriLeaky: Navigating IP Protection vs Utility in Fine-Tuning for LLM-Driven Verilog Codingcited by 10
27 more
  1. 2025SALAD: Systematic Assessment of Machine Unlearning on LLM-Aided Hardware Designcited by 10
  2. 2023The (ab)use of Open Source Code to Train Large Language Modelscited by 9
  3. 2023Pitfalls in Language Models for Code Intelligence: A Taxonomy and Surveycited by 9
  4. 2024Does Your Neural Code Completion Model Use My Code? A Membership Inference Approachcited by 9
  5. 2024Medical Unlearnable Examples: Securing Medical Data from Unauthorized Training via Sparsity-Aware Local Maskingcited by 8
  6. 2024Inevitable Trade-off between Watermark Strength and Speculative Sampling Efficiency for Language Modelscited by 7
  7. 2024Watermark under Fire: A Robustness Evaluation of LLM Watermarkingcited by 7
  8. 2023Privacy and Copyright Protection in Generative AI: A Lifecycle Perspectivecited by 6
  9. 2025Invisible Entropy: Towards Safe and Efficient Low-Entropy LLM Watermarkingcited by 5
  10. 2024Promise and Peril of Collaborative Code Generation Models: Balancing Effectiveness and Memorizationcited by 4
  11. 2025Paladin: Defending LLM-enabled Phishing Emails with a New Trigger-Tag Paradigmcited by 4
  12. 2025WaterMod: Modular Token-Rank Partitioning for Probability-Balanced LLM Watermarkingcited by 4
  13. 2024CodeCloak: A Method for Evaluating and Mitigating Code Leakage by LLM Code Assistantscited by 3
  14. 2024CredID: Credible Multi-Bit Watermark for Large Language Models Identificationcited by 3
  15. 2026Watermarking LLM Agent Trajectoriescited by 3
  16. 2026Sequential Behavioral Watermarking for LLM Agentscited by 3
  17. 2024Lost in Overlap: Exploring Logit-based Watermark Collision in LLMscited by 2
  18. 2024Data Defenses Against Large Language Modelscited by 2
  19. 2025SoK: Are Watermarks in LLMs Ready for Deployment?cited by 2
  20. 2026When Only the Final Text Survives: Implicit Execution Tracing for Multi-Agent Auditingcited by 2
  21. 2024Trojans in Large Language Models of Code: A Critical Review through a Trigger-Based Taxonomycited by 1
  22. 2024A Disguised Wolf Is More Harmful Than a Toothless Tiger: Adaptive Malicious Code Injection Backdoor Attack Leveraging User Behavior as Triggerscited by 0
  23. 2025Poisoned Source Code Detection in Code Modelscited by 0
  24. 2025CLASP: Training-Free LLM-Assisted Source Code Watermarking via Semantic-Preserving Transformationscited by 0
  25. 2025Signature in Code Backdoor Detection, how far are we?cited by 0
  26. 2025Effective Code Membership Inference for Code Completion Models via Adversarial Promptscited by 0
  27. 2026SSG: Logit-Balanced Vocabulary Partitioning for LLM Watermarkingcited by 0