Cross-modal patch-level embeddings can support behavioral triage against author impersonation in real-world repositories, indicating that cross-modal patch-level embeddings can support behavioral triage against author impersonation in real-world repositories.
Abstract
Software supply-chain attacks increasingly exploit an identity gap where compromised maintainer accounts authorize malicious changes. This work evaluates patch-level authorship verification as a behavioral defense layer, showing that stylometric analysis can operate not only on full source files but also on patch-level commits. We fine-tune a cross-modal transformer on more than 20 years of Linux kernel commit history to embed code diffs and commit messages into a unified stylometric space, achieving ROC AUC of 0.93 for open-world authorship verification. We then use these representations in a streaming anomaly detector suited to continuous integration and deployment (CI/CD) settings. We validate the pipeline on two retrospective supply-chain incidents involving different patch characteristics: the 2021 PHP backdoor and the 2026 ForceMemo/GlassWorm campaign. Without retraining, the proposed detector surfaces both PHP forged commits within approximately 1% of the maintainer audit queue and ranks the 28 scoreable ForceMemo spoofs with a median per-repository review burden of 0.8%. These results indicate that cross-modal patch-level embeddings can support behavioral triage against author impersonation in real-world repositories.
GitHub is one of the largest open-source software (OSS) communities for development and collaboration. Impersonation maliciously assuming another user's identity to access code, sway projects, or spread misinformation—has driven recent real-world attacks and is an escalating concern. We present the first exploration of impersonation's impact on GitHub. Through structured interviews with 17 OSS contributors, we study perceptions and mitigations: users generally lack awareness and underestimate the risk; after a live demo, concern rises sharply. Current best practices (e.g., commit signing) need usability improvements to encourage adoption. We also assemble a dataset of 12.5 million commits to examine the current status of impersonation and the feasibility of repository-specific commit authorship attribution as a practical mitigation signal. Leveraging modern pretrained code models and verified commits as cryptographic ground truth, we evaluate whether repository-tuned predictors can infer likely authors and surface anomalous author commit pairs for human review. Models that leverage comprehensive commit information achieve high accuracy (e.g., over 96% with CodeT5+). Our metadata-only CrossCheck analysis shows that apparent author-history discrepancies are dominated by legitimate workflow confounders, so deterministic impersonation detection is unreliable without additional ground truth. We therefore evaluate repository-specific authorship attribution as a probabilistic triage signal, including robustness under a targeted style-imitation attack and open-set deployment considerations where the true author may be absent from the known contributor set. The results show that our approach improves stability over code-only attribution, strengthening its value as a practical triage signal under attacker adaptivity. While deterministic impersonation detection remains impossible, these probabilistic signals can help prioritize review and complement existing controls (e.g., commit signing and vigilant-mode alerts).
Yueke Zhang, Yifan Zhang, Pamela J. Wisniewski et al.· ACM Transactions on Software...· 0 citations
This work presents Porting Benchmark, a curated dataset of 1,234 security patch backporting cases spanning cross-version, cross-branch, and cross-repository scenarios, paired with a common evaluation framework and identifies four root-cause categories (missing target API awareness, cross-version semantic mismatch, non-local dependency propagation failure, and patch construction or localization failure) and derive concrete directions for next-generation tool design.
Jincheng Yang, Yulong Fu, Chengwei Liu et al.· 0 citations
The results show that access to repository history is insufficient: concealment becomes most effective when benign and malicious changes jointly occupy the auditor's active review context or when the stated purpose plausibly accounts for the attack-bearing diff.
The Model Context Protocol (MCP) has emerged as the standard layer connecting Large Language Model agents to external tool backends. This openness introduces a severe server-side threat we term TrustShift: a compromised MCP server behaves benignly during an initial conditioning phase, building operational reliance and suppressing agent skepticism, before switching to an adversarial payload once an interaction threshold is reached. The evasion is temporal, not syntactic: benign at deploy time, the server's defection is invisible to predeployment static analysis, which sees only the honest phase. Switched payloads range from overt structural violations to schema-valid manipulations, the latter preserving outer protocol compliance to evade runtime middleware filters. Crucially, TrustShift originates in the server-controlled tool channel, not user prompts (unlike indirect prompt injection) or the transport (unlike man-in-the-middle): the adversary is the trusted server endpoint itself. We introduce TrustShiftProbe, an evaluation and defense framework with four contributions: (1) a stateful temporal threat model of the agent-server lifecycle as a benign conditioning phase followed by an adversarial defection at a trust horizon; (2) a language-agnostic attack engine that instantiates each variant as a compromised MCP server across four production domains; (3) SHIELD, a multi-tier, zero-oracle runtime defense at the MCP transport boundary that audits server payloads against behavioral baselines learned during clean trust windows; and (4) a taxonomy of nine TrustShift variants spanning three execution mechanisms (structural violation, semantic corruption, scope expansion) and three adversarial objectives (disruption, exfiltration, and their combination). Across frontier proprietary and open-weight models, TrustShift attacks achieve a 69.5% mean attack success rate that SHIELD mitigates to 42.7%.
Mehrdad Rostamzadeh, Sidhant Narula, Mohammad Ghasemigol et al.· 0 citations
LLMs are increasingly used for code generation in critical infrastructure, yet the security effect of domain-specific prompting is understudied. We present SecDrift, a benchmark measuring sector-conditioned security drift: the change in static-analysis vulnerability rates when prompts are conditioned on industry contexts versus neutral baselines. We evaluate 7 LLMs (6 producing analyzable code) across 8 CISA critical infrastructure sectors and 9 CWE categories with 5 replicates (5,355 evaluations), using a 5-dimension transformation with a matched-baseline condition that holds the task fixed while substituting only domain terminology. Industry prompts naively appear more secure (14.0% vs. 11.4%, -2.7pp), but the gap is not statistically significant (Fisher's exact p = 0.24, Cohen's h = -0.08) and is a composition artifact of two CWE categories: excluding CWE-502 and CWE-22 eliminates and slightly reverses it (+0.4pp, p = 1.00). A mixed-effects logistic regression confirms sector identity is not a moderator and localizes the only detectable condition effect to those two vulnerability types. 0 of 8 sectors show drift distinguishable from baseline, corrected or uncorrected (|h|<0.15). A placebo on two non-CISA sectors (e-commerce, online education) reproduces the CISA industry rate almost exactly (10.5% vs. 11.4%, p = 0.63): the small pooled pattern reflects generic industry-framing specificity, not critical-infrastructure identity. In contrast, model selection has a large and consistent effect: among full-output models vulnerability rates range from 11.6% to 16.1%, and these differences persist across conditions. Model choice, not prompt framing, is the more reliable security lever. We release the framework, prompts, generated code, findings, human-validation verdicts, and analysis scripts.
This paper does an audit of defense mechanisms under jailbreak attacks on locally deployed models by tracing each failure back to the specific assumption it relies on.
