Aug 2026· ACM Transactions on Software Engineering and Methodology· 0 citations· 75 references
TL;DR
Semantically-Equivalent Transformation (SET)-based backdoor attacks are introduced, a new class of attacks that use semantics-preserving low-prevalence code transformations to generate stealthy triggers and are proposed as a framework for constructing and prioritizing such triggers.
Abstract
Neural code models are increasingly embedded in software development workflows, but their susceptibility to backdoor attacks presents a significant security risk. Existing studies have mainly examined injection-based attacks, which insert anomalous patterns into code and can often be weakened by standard sanitization and screening. This focus may create a false sense of security regarding backdoor attacks. In this paper, we introduce Semantically-Equivalent Transformation (SET)-based backdoor attacks, a new class of attacks that use semantics-preserving low-prevalence code transformations to generate stealthy triggers. We further propose Stylistic Pattern Backdoor Triggers (SPBT), a framework for constructing and prioritizing such triggers. Our experiments across five tasks and six languages, using models including CodeBERT, CodeT5, and StarCoder, show that SET-based attacks achieve attack success rates comparable to injection-based counterparts while preserving model utility. More importantly, SET-based attacks proved difficult for the evaluated automated defenses and human inspectors to detect, showing substantially lower detectability than injection-based counterparts. We evaluate normalization-based countermeasures and find they offer only partial mitigation. These results motivate further investigation into scalable defenses tailored to SET-based attacks.
This paper introduces a programming language-agnostic, transferable, adversarial attack that exploits this CLM vulnerability and demonstrates that this attack, even when computed using smaller code embedding models, is highly effective and transferable to larger, closed-source embedding models.
Kaicheng Wang, Liyan Huang, Jesse Thomason et al.· 0 citations
BADERASER is proposed, a novel backdoor defense technique for backdoor elimination in neural code models that introduces code naturalness as an auxiliary constraint and incorporates statistical indicators in trigger inversion to improve the quality of recovered triggers.
Wei Cheng, Yu Zhou, Guang Yang et al.· International Conference on...· 0 citations
: Large language models are increasingly being deployed in safety-critical domains, yet remain vulnerable to jailbreak attacks that circumvent safety alignments. This systematic review synthesizes empirical jailbreak research published between 2024 and 2025, using a PRISMA-guided search protocol, followed by BERTopic-based topic modeling. The analysis identifies eight main jailbreak categories: optimization-based, ge-netic/evolutionary, iterative refinement, semantic/persuasion-based, decomposition, context/generation-level, visual/encoding and fuzzing attacks, and characterizes their effectiveness, efficiency, and transferability across open-source and proprietary models, including Llama-2/3, Vicuna, GPT-3.5/4, Claude, Gemini, and DeepSeek-V3. Results show that simple configuration and context-level attacks can match the near-perfect attack success rates of sophisticated white-box optimization methods on models such as Llama-2, while requiring far fewer queries and no parameter access, highlighting a gap between research focus and practical threat severity. The review further identifies five recurring vulnerability mechanisms: representation-level gaps, execution-priority manipulation, semantic fragmentation, gradient-space exploitation and persuasion susceptibility, and documents family-specific vulnerability patterns, with open-source Llama-based models consistently more exposed than safety-enhanced architectures such as Claude. Diverse methods, uneven focus on models and publication bias limit how broadly results apply. Nonetheless, the review reveals that weaknesses in safety alignment persist across successive LLM generations, urging that effective defenses must address all eight attack categories rather than isolated techniques.
Meda Račaitytė, Hélder Bastos, R. Ribeiro et al.· International Conference on...· 0 citations
A dual-stream CodeBERT architecture is presented that addresses keyword bias —by combining pre-trained Transformer representations with a 50-dimensional hand-engineered security feature vector, supported by targeted data augmentation and two-stage adversarial fine-tuning.
Arjun Khurana, Talaya Farasat, Joachim Posegga et al.· 0 citations
A hybrid pipeline combining static vulnerability candidate selection using Latent Semantic Analysis with dynamic verification through Large Language Model-assisted fuzzing is presented, which reduces manual effort while still requiring human validation.
Kevin Nguyen, Dominik Schoop· International Conference on...· 0 citations
Vulnerability datasets underpin a wide range of security research, including vulnerability detection, automated remediation, and secure code generation. However, existing datasets sacrifice at least one of three desirable properties: diversity (of language or vulnerability type), reproducibility/executability, or realism. We therefore present GraftyVul, a system that constructs vulnerable programs by grafting real-world vulnerabilities into open-source projects. This grounds the dataset in vulnerabilities observed in real-world contexts while harnessing known good build and test environments, enabling exploit-verification scripts to guarantee that an introduced vulnerability successfully alters a program's behaviour. Using GraftyVul, we generate 212 verified and exploitable vulnerable programs spanning five programming languages (Python, TypeScript, Java, Go, and C#) across 23 CWE categories. To evaluate fidelity, we introduce a language- and context-agnostic semantic embedding that compares vulnerabilities by sink, mechanism and host-feature rather than surface code. This approach outperforms standard code embeddings on cross-language clone and CWE classification. These embeddings demonstrate that GraftyVul samples retain a strong semantic signature to their source vulnerability. We additionally compare GraftyVul against 13 widely used datasets, where it attains competitive diversity while being the only reproducible-exploit dataset with broad language and CWE coverage. Finally, we illustrate GraftyVul's practical utility through an industrial case study evaluating a production vulnerability remediation system.
Omri Ram, Mitchell Horner, R. van der Meyden et al.· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
