mlsanityData to 14 Oct 2026

Securing Code Understanding: Detecting Natural Backdoor Vulnerability in Code Language Models

arXiv 2606.10846 ↗First posted 9 Jun 2026cs.CR cs.SEcited by 0

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Code Language Models (CodeLMs) have become integral to software engineering, significantly advancing code intelligence tasks. However, their widespread adoption has raised critical security concerns, particularly regarding susceptibility to backdoor attacks. Recent studies have uncovered naturally occurring backdoors, referred to as natural backdoors, in normally trained deep learning models. Despite posing threats as serious as those introduced through data poisoning, security implications of natural backdoor vulnerabilities in CodeLMs remain poorly understood. In this paper, we conduct a thorough empirical study of natural backdoor vulnerabilities in CodeLMs across various model architectures and code intelligence tasks. Specifically, we examine potential natural backdoor vulnerabilities across 44 scenarios, demonstrating that natural backdoors are prevalent and intrinsic to CodeLMs. We reveal differences between injected and natural backdoor vulnerabilities at both the model and parameter levels. We then analyze the transferability of natural backdoor vulnerabilities from three perspectives: datasets, model architectures, and shared knowledge. We further investigate the causes of natural backdoors from two aspects: training datasets and the model training procedure. We evaluate existing backdoor defense techniques, including pre-training, in-training, and post-training defenses, in mitigating natural backdoors. Finally, we propose ScanNBT, a novel detection method designed to improve comprehensive detection of natural backdoor vulnerabilities in CodeLMs. We aim for our findings to enhance understanding of these vulnerabilities and provide insights for strengthening CodeLM security against backdoor threats.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 42 of its 57 references that are in the map. First posted on arXiv 9 Jun 2026.

Builds on

42 of 57 references.

Closest ancestors · 7

Same direction, newest first

  1. 2025Show Me Your Code! Kill Code Poisoning: A Lightweight Method Based on Code Naturalness20 Feb
  2. 2024CodePurify: Defend Backdoor Attacks on Neural Code Models via Entropy-based Purification26 Oct
  3. 2024Eliminating Backdoors in Neural Code Models for Secure Code Understanding8 Aug
  4. 2023Multi-target Backdoor Attacks for Code Pre-trained Models14 Jun
  5. 2023Backdooring Neural Code Search27 May
  6. 2023Stealthy Backdoor Attack for Code Models6 Jan
  7. 2022Constrained Optimization with Dynamic Bound-scaling for Effective NLPBackdoor Defense11 Feb

Other references · 35

  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  2. 2020Shortcut Learning in Deep Neural Networkscited by 1,969
  3. 2020CodeBERT: A Pre-Trained Model for Programming and Natural Languagescited by 1,310
  4. 2024DeepSeek-Coder: When the Large Language Model Meets Programming -- The Rise of Code Intelligencecited by 1,181
  5. 2015A Diversity-Promoting Objective Function for Neural Conversation Modelscited by 1,077
  6. 2021CodeT5: Identifier-aware Unified Pre-trained Encoder-Decoder Models for Code Understanding and Generationcited by 906
  7. 2023StarCoder: may the source be with you!cited by 799
  8. 2016Universal adversarial perturbationscited by 784
  9. 2021CodeXGLUE: A Machine Learning Benchmark Dataset for Code Understanding and Generationcited by 744
  10. 2019CodeSearchNet Challenge: Evaluating the State of Semantic Code Searchcited by 654
  11. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 456
  12. 2022UniXcoder: Unified Cross-Modal Pre-training for Code Representationcited by 361
23 more
  1. 2019Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networkscited by 272
  2. 2018Auto-Keras: An Efficient Neural Architecture Search Systemcited by 171
  3. 2020An Empirical Study on Robustness to Spurious Correlations using Pre-trained Language Modelscited by 134
  4. 2020You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completioncited by 131
  5. 2018An Empirical Study on Learning Bug-Fixing Patches in the Wild via Neural Machine Translationcited by 108
  6. 2023TrojanPuzzle: Covertly Poisoning Code-Suggestion Modelscited by 60
  7. 2024Membership Inference Attacks Against In-Context Learningcited by 43
  8. 2020Backdoors in Neural Models of Source Codecited by 41
  9. 2025Towards Label-Only Membership Inference Attack against Pre-trained Large Language Modelscited by 37
  10. 2023Distilled GPT for Source Code Summarizationcited by 31
  11. 2024Source Code Summarization in the Era of Large Language Modelscited by 31
  12. 2024Robustness, Security, Privacy, Explainability, Efficiency, and Usability of Large Language Models for Codecited by 28
  13. 2023GAMMA: Revisiting Template-based Automated Program Repair via Mask Predictioncited by 23
  14. 2022An Extractive-and-Abstractive Framework for Source Code Summarizationcited by 18
  15. 2023Pre-trained Model-based Automated Software Vulnerability Repair: How Far are We?cited by 16
  16. 2022Code Search based on Context-aware Code Translationcited by 14
  17. 2022Backdoor Vulnerabilities in Normally Trained Deep Learning Modelscited by 13
  18. 2025SeedPrints: Fingerprints Can Even Tell Which Seed Your Large Language Model Was Trained Fromcited by 10
  19. 2023Occlusion-based Detection of Trojan-triggering Inputs in Large Language Models of Codecited by 9
  20. 2023A Language Model of Java Methods with Train/Test Deduplicationcited by 7
  21. 2024Security of Language Models for Code: A Systematic Literature Reviewcited by 7
  22. 2023A Survey of Source Code Search: A 3-Dimensional Perspectivecited by 6
  23. 2025DeCoMa: Detecting and Purifying Code Dataset Watermarks through Dual Channel Code Abstractioncited by 4

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2024Defending Code Language Models against Backdoor Attacks with Deceptive Cross-Entropy Loss
  2. 2024Measuring Impacts of Poisoning on Model Parameters and Embeddings for Large Language Models of Code
  3. 2025Semantically-Equivalent Transformations-Based Backdoor Attacks against Neural Code Models: Characterization and Mitigation
  4. 2024Double Backdoored: Converting Code Large Language Model Backdoors to Traditional Malware via Adversarial Instruction Tuning Attacks
  5. 2024An LLM-Assisted Easy-to-Trigger Backdoor Attack on Code Completion Models: Injecting Disguised Vulnerabilities against Strong Detection
  6. 2023BadCS: A Backdoor Attack Framework for Code search
  7. 2024Rethinking Backdoor Detection Evaluation for Language Models
  8. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Models