# Stylometric Defenses Against Author Impersonation in Software Repositories

arXiv: https://arxiv.org/abs/2608.02695 · HTML: https://mlsanity.com/paper/2608.02695/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 24 of its 72 references that are in the map.
- First posted on arXiv 3 Aug 2026.

## Builds on (most cited first, 24 of 24)

- [Supervised Contrastive Learning](https://mlsanity.com/paper/2004.11362/) (2020)
- [CodeBERT: A Pre-Trained Model for Programming and Natural Languages](https://mlsanity.com/paper/2002.08155/) (2020)
- [Multimodal Machine Learning: A Survey and Taxonomy](https://mlsanity.com/paper/1705.09406/) (2017)
- [CodeT5: Identifier-aware Unified Pre-trained Encoder-Decoder Models for Code Understanding and Generation](https://mlsanity.com/paper/2109.00859/) (2021)
- [GraphCodeBERT: Pre-training Code Representations with Data Flow](https://mlsanity.com/paper/2009.08366/) (2020)
- [UniXcoder: Unified Cross-Modal Pre-training for Code Representation](https://mlsanity.com/paper/2203.03850/) (2022)
- [Taxonomy of Attacks on Open-Source Software Supply Chains](https://mlsanity.com/paper/2204.04008/) (2022)
- [CC2Vec: Distributed Representations of Code Changes](https://mlsanity.com/paper/2003.05620/) (2020)
- [Misleading Authorship Attribution of Source Code using Adversarial Learning](https://mlsanity.com/paper/1905.12386/) (2019)
- [Code Representation Learning At Scale](https://mlsanity.com/paper/2402.01935/) (2024)
- [A Meta-Analysis of the Anomaly Detection Problem](https://mlsanity.com/paper/1503.01158/) (2015)
- [The Topic Confusion Task: A Novel Scenario for Authorship Attribution](https://mlsanity.com/paper/2104.08530/) (2021)
- [CommitBERT: Commit Message Generation Using Pre-Trained Programming Language Model](https://mlsanity.com/paper/2105.14242/) (2021)
- [RoPGen: Towards Robust Code Authorship Attribution via Automatic Coding Style Transformation](https://mlsanity.com/paper/2202.06043/) (2022)
- [Authorship Attribution of Source Code: A Language-Agnostic Approach and Applicability in Software Engineering](https://mlsanity.com/paper/2001.11593/) (2020)
- [Killing Two Birds with One Stone: Malicious Package Detection in NPM and PyPI using a Single Model of Malicious Behavior Sequence](https://mlsanity.com/paper/2309.02637/) (2023)
- [Git Blame Who?: Stylistic Authorship Attribution of Small, Incomplete Source Code Fragments](https://mlsanity.com/paper/1701.05681/) (2017)
- [CommitBART: A Large Pre-trained Model for GitHub Commits](https://mlsanity.com/paper/2208.08100/) (2022)
- [PatchNet: A Tool for Deep Patch Classification](https://mlsanity.com/paper/1903.02063/) (2019)
- [DevPhish: Exploring Social Engineering in Software Supply Chain Attacks on Developers](https://mlsanity.com/paper/2402.18401/) (2024)
- [Scalable Source Code Similarity Detection in Large Code Repositories](https://mlsanity.com/paper/1907.11817/) (2019)
- [SHIELD: Thwarting Code Authorship Attribution](https://mlsanity.com/paper/2304.13255/) (2023)
- [SoK: A Defense-Oriented Evaluation of Software Supply Chain Security](https://mlsanity.com/paper/2405.14993/) (2024)
- [Robust and Accurate Authorship Attribution via Program Normalization](https://mlsanity.com/paper/2007.00772/) (2020)

## Abstract (arXiv)

Software supply-chain attacks increasingly exploit an identity gap where compromised maintainer accounts authorize malicious changes. This work evaluates patch-level authorship verification as a behavioral defense layer, showing that stylometric analysis can operate not only on full source files but also on patch-level commits. We fine-tune a cross-modal transformer on more than 20 years of Linux kernel commit history to embed code diffs and commit messages into a unified stylometric space, achieving ROC AUC of 0.93 for open-world authorship verification. We then use these representations in a streaming anomaly detector suited to continuous integration and deployment (CI/CD) settings. We validate the pipeline on two retrospective supply-chain incidents involving different patch characteristics: the 2021 PHP backdoor and the 2026 ForceMemo/GlassWorm campaign. Without retraining, the proposed detector surfaces both PHP forged commits within approximately 1% of the maintainer audit queue and ranks the 28 scoreable ForceMemo spoofs with a median per-repository review burden of 0.8%. These results indicate that cross-modal patch-level embeddings can support behavioral triage against author impersonation in real-world repositories.