mlsanityData to 14 Oct 2026

Backdooring Neural Code Search

arXiv 2305.17506 ↗First posted 27 May 2023cs.SE cs.AI cs.CLcited by 19

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Reusing off-the-shelf code snippets from online repositories is a common practice, which significantly enhances the productivity of software developers. To find desired code snippets, developers resort to code search engines through natural language queries. Neural code search models are hence behind many such engines. These models are based on deep learning and gain substantial attention due to their impressive performance. However, the security aspect of these models is rarely studied. Particularly, an adversary can inject a backdoor in neural code search models, which return buggy or even vulnerable code with security/privacy issues. This may impact the downstream software (e.g., stock trading systems and autonomous driving) and cause financial loss and/or life-threatening incidents. In this paper, we demonstrate such attacks are feasible and can be quite stealthy. By simply modifying one variable/function name, the attacker can make buggy/vulnerable code rank in the top 11%. Our attack BADCODE features a special trigger generation and injection procedure, making the attack more effective and stealthy. The evaluation is conducted on two neural code search models and the results show our attack outperforms baselines by 60%. Our user study demonstrates that our attack is more stealthy than the baseline by two times based on the F1 score.

Key facts. Cited by 19 papers in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 23 of its 51 references that are in the map. First posted on arXiv 27 May 2023.

Builds on

23 of 51 references.

Closest ancestors · 3

Same direction, newest first

  1. 2021CoProtector: Protect Open-Source Code against Unauthorized Training Usage with Data Poisoning25 Oct
  2. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitution11 Jun
  3. 2021T-Miner: A Generative Approach to Defend Against Trojan Attacks on DNN-based Text Classification7 Mar

Other references · 20

  1. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  2. 2020CodeBERT: A Pre-Trained Model for Programming and Natural Languagescited by 1,310
  3. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  4. 2021CodeT5: Identifier-aware Unified Pre-trained Encoder-Decoder Models for Code Understanding and Generationcited by 906
  5. 2019CodeSearchNet Challenge: Evaluating the State of Semantic Code Searchcited by 654
  6. 2020GraphCodeBERT: Pre-training Code Representations with Data Flowcited by 609
  7. 2018Spectral Signatures in Backdoor Attackscited by 484
  8. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 456
  9. 2022UniXcoder: Unified Cross-Modal Pre-training for Code Representationcited by 361
  10. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 341
  11. 2018code2vec: Learning Distributed Representations of Codecited by 250
  12. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 211
8 more
  1. 2020Blind Backdoors in Deep Learning Modelscited by 182
  2. 2018code2seq: Generating Sequences from Structured Representations of Codecited by 179
  3. 2020You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completioncited by 131
  4. 2019Multi-Modal Attention Network Learning for Semantic Source Code Retrievalcited by 41
  5. 2020Backdoors in Neural Models of Source Codecited by 41
  6. 2017Query Expansion Based on Crowd Knowledge for Code Searchcited by 18
  7. 2021GraphSearchNet: Enhancing GNNs via Capturing Global Dependencies for Semantic Code Searchcited by 15
  8. 2022Code Search based on Context-aware Code Translationcited by 14

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 3; 2024: 8; 2025: 5; 2026: 3.

19 papers.

Sort:

By area:

  1. 2023Privacy in Large Language Models: Attacks, Defenses and Future Directionscited by 51
  2. 2023Vulnerabilities in AI Code Generators: Exploring Targeted Data Poisoning Attackscited by 33
  3. 2023Integration of Large Language Models and Federated Learningcited by 31
  4. 2024What can Large Language Models Capture about Code Functional Equivalence?cited by 14
  5. 2024Mutual Information Guided Backdoor Mitigation for Pre-trained Encoderscited by 8
  6. 2025Show Me Your Code! Kill Code Poisoning: A Lightweight Method Based on Code Naturalnesscited by 8
  7. 2024Defending Code Language Models against Backdoor Attacks with Deceptive Cross-Entropy Losscited by 5
  8. 2026Beware What You Autocomplete: Forensic Attribution of Backdoored Code Completionscited by 4
  9. 2024Memory Backdoor Attacks on Neural Networkscited by 3
  10. 2024Double Backdoored: Converting Code Large Language Model Backdoors to Traditional Malware via Adversarial Instruction Tuning Attackscited by 2
  11. 2024Trojans in Large Language Models of Code: A Critical Review through a Trigger-Based Taxonomycited by 2
  12. 2024CodePurify: Defend Backdoor Attacks on Neural Code Models via Entropy-based Purificationcited by 2
7 more
  1. 2024On Trojan Signatures in Large Language Models of Codecited by 1
  2. 2025Secure Resource Allocation via Constrained Deep Reinforcement Learningcited by 1
  3. 2025Backdoors in Code Summarizers: How Bad Is It?cited by 1
  4. 2025Detecting Stealthy Data Poisoning Attacks in AI Code Generatorscited by 1
  5. 2025Signature in Code Backdoor Detection, how far are we?cited by 0
  6. 2026Securing Code Understanding: Detecting Natural Backdoor Vulnerability in Code Language Modelscited by 0
  7. 2026Breaking Customized LLMs for Coding: Automated Red Teaming for Instruction Backdoor Attackscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2023BadCS: A Backdoor Attack Framework for Code search
  2. 2024Eliminating Backdoors in Neural Code Models for Secure Code Understanding
  3. 2023Stealthy Backdoor Attack for Code Models
  4. 2025Semantically-Equivalent Transformations-Based Backdoor Attacks against Neural Code Models: Characterization and Mitigation
  5. 2023Multi-target Backdoor Attacks for Code Pre-trained Models
  6. 2025DeBackdoor: A Deductive Framework for Detecting Backdoor Attacks on Deep Models with Limited Data
  7. 2022Detecting Backdoors in Deep Text Classifiers
  8. 2022Neural Architectural Backdoors