mlsanityData to 14 Oct 2026

Multi-target Backdoor Attacks for Code Pre-trained Models

arXiv 2306.08350 ↗First posted 14 Jun 2023cs.CR cs.AI cs.CLcited by 23

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Backdoor attacks for neural code models have gained considerable attention due to the advancement of code intelligence. However, most existing works insert triggers into task-specific data for code-related downstream tasks, thereby limiting the scope of attacks. Moreover, the majority of attacks for pre-trained models are designed for understanding tasks. In this paper, we propose task-agnostic backdoor attacks for code pre-trained models. Our backdoored model is pre-trained with two learning strategies (i.e., Poisoned Seq2Seq learning and token representation learning) to support the multi-target attack of downstream code understanding and generation tasks. During the deployment phase, the implanted backdoors in the victim models can be activated by the designed triggers to achieve the targeted attack. We evaluate our approach on two code understanding tasks and three code generation tasks over seven datasets. Extensive experiments demonstrate that our approach can effectively and stealthily attack code-related downstream tasks.

Key facts. Cited by 23 papers in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 38 of its 55 references that are in the map. First posted on arXiv 14 Jun 2023.

Builds on

38 of 55 references.

Closest ancestors · 4

Same direction, newest first

  1. 2023Stealthy Backdoor Attack for Code Models6 Jan
  2. 2022Poison Attack and Defense on Deep Source Code Processing Models31 Oct
  3. 2021CoProtector: Protect Open-Source Code against Unauthorized Training Usage with Data Poisoning25 Oct
  4. 2021BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Models6 Oct

Other references · 34

  1. 2017Attention Is All You Needcited by 60,361
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  3. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  4. 2020Language Models are Few-Shot Learnerscited by 32,419
  5. 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,599
  6. 2019BART: Denoising Sequence-to-Sequence Pre-training for Natural Language Generation, Translation, and Comprehensioncited by 5,893
  7. 2018GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understandingcited by 4,899
  8. 2020CodeBERT: A Pre-Trained Model for Programming and Natural Languagescited by 1,310
  9. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  10. 2015Aligning Books and Movies: Towards Story-like Visual Explanations by Watching Movies and Reading Bookscited by 1,043
  11. 2021CodeT5: Identifier-aware Unified Pre-trained Encoder-Decoder Models for Code Understanding and Generationcited by 906
  12. 2021CodeXGLUE: A Machine Learning Benchmark Dataset for Code Understanding and Generationcited by 744
22 more
  1. 2019CodeSearchNet Challenge: Evaluating the State of Semantic Code Searchcited by 654
  2. 2020GraphCodeBERT: Pre-training Code Representations with Data Flowcited by 609
  3. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
  4. 2021Unified Pre-training for Program Understanding and Generationcited by 366
  5. 2022UniXcoder: Unified Cross-Modal Pre-training for Code Representationcited by 361
  6. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 341
  7. 2019Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networkscited by 272
  8. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 263
  9. 2020IntelliCode Compose: Code Generation Using Transformercited by 227
  10. 2020You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completioncited by 131
  11. 2018An Empirical Study on Learning Bug-Fixing Patches in the Wild via Neural Machine Translationcited by 108
  12. 2021Backdoor Pre-trained Models Can Transfer to Allcited by 86
  13. 2019Adversarial Examples for Models of Codecited by 63
  14. 2021SynCoBERT: Syntax-Guided Multi-Modal Contrastive Pre-Training for Code Representationcited by 63
  15. 2021Self-Supervised Bug Detection and Repaircited by 59
  16. 2021Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attackscited by 49
  17. 2020Backdoors in Neural Models of Source Codecited by 41
  18. 2021TreeBERT: A Tree-Based Pre-Trained Model for Programming Languagecited by 41
  19. 2019Learning and Evaluating Contextual Embedding of Source Codecited by 33
  20. 2023ContraBERT: Enhancing Code Pre-trained Models via Contrastive Learningcited by 16
  21. 2022CommitBART: A Large Pre-trained Model for GitHub Commitscited by 6
  22. 2020Using Large-Scale Anomaly Detection on Code to Improve Kotlin Compilercited by 1

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 2; 2024: 10; 2025: 5; 2026: 6.

23 papers.

Sort:

By area:

  1. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Promptscited by 560
  2. 2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 387
  3. 2024BadEdit: Backdooring large language models by model editingcited by 96
  4. 2024An LLM-Assisted Easy-to-Trigger Backdoor Attack on Code Completion Models: Injecting Disguised Vulnerabilities against Strong Detectioncited by 40
  5. 2024Compromising Embodied Agents with Contextual Backdoor Attackscited by 31
  6. 2024Nearest is Not Dearest: Towards Practical Defense against Quantization-conditioned Backdoor Attackscited by 18
  7. 2024Mitigating Backdoor Threats to Large Language Models: Advancement and Challengescited by 15
  8. 2025SandboxEval: Towards Securing Test Environment for Untrusted Codecited by 10
  9. 2025Control Tax: The Price of Keeping AI in Checkcited by 10
  10. 2025Pay Attention to the Triggers: Constructing Backdoors That Survive Distillationcited by 6
  11. 2024Neutralizing Backdoors through Information Conflicts for Large Language Modelscited by 5
  12. 2026Watermarking LLM Agent Trajectoriescited by 4
11 more
  1. 2026Semantic Consensus Decoding: Backdoor Defense for Verilog Code Generationcited by 3
  2. 2024Trojans in Large Language Models of Code: A Critical Review through a Trigger-Based Taxonomycited by 2
  3. 2024CodePurify: Defend Backdoor Attacks on Neural Code Models via Entropy-based Purificationcited by 2
  4. 2024Measuring Impacts of Poisoning on Model Parameters and Neuron Activations: A Case Study of Poisoning CodeBERTcited by 1
  5. 2024Bridging Today and the Future of Humanity: AI Safety in 2024 and Beyondcited by 1
  6. 2025Lethe: Purifying Backdoored Large Language Models with Knowledge Dilutioncited by 1
  7. 2026SEVRA-BENCH: Social Engineering of Vulnerabilities in Review Agentscited by 1
  8. 2025Signature in Code Backdoor Detection, how far are we?cited by 0
  9. 2026Securing Code Understanding: Detecting Natural Backdoor Vulnerability in Code Language Modelscited by 0
  10. 2026Breaking Customized LLMs for Coding: Automated Red Teaming for Instruction Backdoor Attackscited by 0
  11. 2026Adversarial Testing of Automated Program Repair Agents for Security Vulnerabilitiescited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Measuring Impacts of Poisoning on Model Parameters and Embeddings for Large Language Models of Code
  2. 2025Semantically-Equivalent Transformations-Based Backdoor Attacks against Neural Code Models: Characterization and Mitigation
  3. 2024Double Backdoored: Converting Code Large Language Model Backdoors to Traditional Malware via Adversarial Instruction Tuning Attacks
  4. 2024SABER: Model-agnostic Backdoor Attack on Chain-of-Thought in Neural Code Generation
  5. 2024Eliminating Backdoors in Neural Code Models for Secure Code Understanding
  6. 2023Backdoor Attacks for In-Context Learning with Language Models
  7. 2024Shortcuts Everywhere and Nowhere: Exploring Multi-Trigger Backdoor Attacks
  8. 2024Backdoor in Seconds: Unlocking Vulnerabilities in Large Pre-trained Models via Model Editing