mlsanityData to 7 Oct 2026

An LLM-Assisted Easy-to-Trigger Backdoor Attack on Code Completion Models: Injecting Disguised Vulnerabilities against Strong Detection

arXiv 2406.06822 ↗First posted 10 Jun 2024cs.CR cs.AI cs.SEcited by 32

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Large Language Models (LLMs) have transformed code completion tasks, providing context-based suggestions to boost developer productivity in software engineering. As users often fine-tune these models for specific applications, poisoning and backdoor attacks can covertly alter the model outputs. To address this critical security challenge, we introduce CodeBreaker, a pioneering LLM-assisted backdoor attack framework on code completion models. Unlike recent attacks that embed malicious payloads in detectable or irrelevant sections of the code (e.g., comments), CodeBreaker leverages LLMs (e.g., GPT-4) for sophisticated payload transformation (without affecting functionalities), ensuring that both the poisoned data for fine-tuning and generated code can evade strong vulnerability detection. CodeBreaker stands out with its comprehensive coverage of vulnerabilities, making it the first to provide such an extensive set for evaluation. Our extensive experimental evaluations and user studies underline the strong attack performance of CodeBreaker across various settings, validating its superiority over existing approaches. By integrating malicious payloads directly into the source code with minimal transformation, CodeBreaker challenges current security measures, underscoring the critical need for more robust defenses for code completion.

Key facts. Cited by 32 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 56 of its 97 references that are in the map. First posted on arXiv 10 Jun 2024.

Builds on

56 of 97 references.

Closest ancestors · 2

Same direction, newest first

  1. 2023Multi-target Backdoor Attacks for Code Pre-trained Models14 Jun
  2. 2021BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Models6 Oct

Other references · 54

  1. 2017Attention Is All You Needcited by 59,932
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  3. 2020Language Models are Few-Shot Learnerscited by 32,199
  4. 2023GPT-4 Technical Reportcited by 18,132
  5. 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,491
  6. 2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Modelscited by 12,302
  7. 2021Evaluating Large Language Models Trained on Codecited by 8,053
  8. 2022Self-Consistency Improves Chain of Thought Reasoning in Language Modelscited by 5,601
  9. 2019The Curious Case of Neural Text Degenerationcited by 2,881
  10. 2021Pre-train, Prompt, and Predict: A Systematic Survey of Prompting Methods in Natural Language Processingcited by 2,222
  11. 2020CodeBERT: A Pre-Trained Model for Programming and Natural Languagescited by 1,286
  12. 2021CodeT5: Identifier-aware Unified Pre-trained Encoder-Decoder Models for Code Understanding and Generationcited by 890
38 more
  1. 2022CodeGen: An Open Large Language Model for Code with Multi-Turn Program Synthesiscited by 876
  2. 2021CodeXGLUE: A Machine Learning Benchmark Dataset for Code Understanding and Generationcited by 732
  3. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  4. 2022InCoder: A Generative Model for Code Infilling and Synthesiscited by 492
  5. 2018Spectral Signatures in Backdoor Attackscited by 457
  6. 2021Recent Advances in Natural Language Processing via Large Pre-Trained Language Models: A Surveycited by 457
  7. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  8. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 411
  9. 2022A Systematic Evaluation of Large Language Models of Codecited by 360
  10. 2019Hidden Trigger Backdoor Attackscited by 359
  11. 2022UniXcoder: Unified Cross-Modal Pre-training for Code Representationcited by 355
  12. 2023CodeT5+: Open Code Large Language Models for Code Understanding and Generationcited by 327
  13. 2019Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networkscited by 266
  14. 2020IntelliCode Compose: Code Generation Using Transformercited by 225
  15. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 191
  16. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 162
  17. 2020Deep Learning based Vulnerability Detection: Are We There Yet?cited by 142
  18. 2022Practical Program Repair in the Era of Large Pre-trained Language Modelscited by 133
  19. 2022ReACC: A Retrieval-Augmented Code Completion Frameworkcited by 117
  20. 2020You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completioncited by 112
  21. 2023LongCoder: A Long-Range Pre-trained Language Model for Code Completioncited by 110
  22. 2018SySeVR: A Framework for Using Deep Learning to Detect Software Vulnerabilitiescited by 91
  23. 2022Automated Repair of Programs from Large Language Modelscited by 71
  24. 2020Code Prediction by Feeding Trees to Transformerscited by 70
  25. 2018Generative Code Modeling with Graphscited by 59
  26. 2020Multi-task Learning based Pre-trained Language Model for Code Completioncited by 58
  27. 2023Understanding the Effectiveness of Large Language Models in Detecting Security Vulnerabilitiescited by 58
  28. 2021Vulnerability Detection with Fine-grained Interpretationscited by 56
  29. 2023A Survey of Learning-based Automated Program Repaircited by 55
  30. 2019Pythia: AI-assisted Code Completion Systemcited by 54
  31. 2017Code Completion with Neural Attention and Pointer Networkscited by 49
  32. 2023TrojanPuzzle: Covertly Poisoning Code-Suggestion Modelscited by 47
  33. 2022BadDet: Backdoor Attacks on Object Detectioncited by 45
  34. 2023No Need to Lift a Finger Anymore? Assessing the Quality of Code Generation by ChatGPTcited by 45
  35. 2022Transformer-Based Language Models for Software Vulnerability Detectioncited by 39
  36. 2020VulDeeLocator: A Deep Learning-based Fine-grained Vulnerability Detectorcited by 37
  37. 2022LineVD: Statement-level Vulnerability Detection using Graph Neural Networkscited by 35
  38. 2019Misleading Authorship Attribution of Source Code using Adversarial Learningcited by 33

50 most cited of 54 All 54 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 5; 2025: 17; 2026: 10.

32 papers.

Sort:

By area:

  1. 2026Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystemscited by 30
  2. 2025CPA-RAG:Covert Poisoning Attacks on Retrieval-Augmented Generation in Large Language Modelscited by 17
  3. 2025Don't Pass@k: A Bayesian Framework for Large Language Model Evaluationcited by 15
  4. 2024Black-Box Adversarial Attacks on LLM-Based Code Completioncited by 13
  5. 2024Artificial-Intelligence Generated Code Considered Harmful: A Road Map for Secure and High-Quality Code Generationcited by 11
  6. 2025From Assistants to Adversaries: Exploring the Security Risks of Mobile LLM Agentscited by 10
  7. 2025Web Fraud Attacks Against LLM-Driven Multi-Agent Systemscited by 8
  8. 2025Control Tax: The Price of Keeping AI in Checkcited by 7
  9. 2025TAI3: Testing Agent Integrity in Interpreting User Intentcited by 7
  10. 2025CodeMirage: A Multi-Lingual Benchmark for Detecting AI-Generated and Paraphrased Source Code from Production-Level LLMscited by 6
  11. 2025DeBackdoor: A Deductive Framework for Detecting Backdoor Attacks on Deep Models with Limited Datacited by 5
  12. 2025ImportSnare: Directed "Code Manual" Hijacking in Retrieval-Augmented Code Generationcited by 5
20 more
  1. 2025Red Teaming Program Repair Agents: When Correct Patches can Hide Vulnerabilitiescited by 4
  2. 2025A Systematic Study of Code Obfuscation Against LLM-based Vulnerability Detectioncited by 4
  3. 2026Beware What You Autocomplete: Forensic Attribution of Backdoored Code Completionscited by 4
  4. 2025Trust Me, I Know This Function: Hijacking LLM Static Analysis using Biascited by 3
  5. 2025A First Look at the Security Issues in the Model Context Protocol Ecosystemcited by 3
  6. 2026Skills as Verifiable Artifacts: A Trust Schema and a Biconditional Correctness Criterion for Human-in-the-Loop Agent Runtimescited by 3
  7. 2024Code Vulnerability Repair with Large Language Model using Context-Aware Prompt Tuningcited by 2
  8. 2024On the Validity of Traditional Vulnerability Scoring Systems for Adversarial Attacks against LLMscited by 2
  9. 2025CoTDeceptor:Adversarial Code Obfuscation Against CoT-Enhanced LLM Code Agentscited by 2
  10. 2026Reverse-Engineering Model Editing on Language Modelscited by 2
  11. 2024Bridging Today and the Future of Humanity: AI Safety in 2024 and Beyondcited by 1
  12. 2025Investigating Security Implications of Automatically Generated Code on the Software Supply Chaincited by 1
  13. 2026Poison with Style: A Practical Poisoning Attack on Code Large Language Modelscited by 1
  14. 2025Localizing Malicious Outputs from CodeLLMcited by 0
  15. 2025Learning from Negative Examples: Why Warning-Framed Training Data Teaches What It Warns Againstcited by 0
  16. 2026Beyond Crash: Hijacking Your Autonomous Vehicle for Fun and Profitcited by 0
  17. 2026Detecting Data Poisoning in Code Generation LLMs via Black-Box, Vulnerability-Oriented Scanningcited by 0
  18. 2026Secret Stealing Attacks on Local LLM Fine-Tuning through Supply-Chain Model Code Backdoorscited by 0
  19. 2026Words Speak Louder Than Code: Investigating Cognitive Heuristics in LLM-Based Code Vulnerability Detectioncited by 0
  20. 2026AI-Generated PowerShell Malware: An Experimental Framework and Datasetcited by 0