Code models, such as CodeBERT and CodeT5, offer general-purpose representations of code and play a vital role in supporting downstream automated software engineering tasks. Most recently, code models were revealed to be vulnerable to backdoor attacks. A code model that is backdoor-attacked can behave normally on clean examples but will produce pre-defined malicious outputs on examples injected with triggers that activate the backdoors. Existing backdoor attacks on code models use unstealthy and easy-to-detect triggers. This paper aims to investigate the vulnerability of code models with stealthy backdoor attacks. To this end, we propose AFRAIDOOR (Adversarial Feature as Adaptive Backdoor). AFRAIDOOR achieves stealthiness by leveraging adversarial perturbations to inject adaptive triggers into different inputs. We evaluate AFRAIDOOR on three widely adopted code models (CodeBERT, PLBART and CodeT5) and two downstream tasks (code summarization and method name prediction). We find that around 85% of adaptive triggers in AFRAIDOOR bypass the detection in the defense process. By contrast, only less than 12% of the triggers from previous work bypass the defense. When the defense method is not applied, both AFRAIDOOR and baselines have almost perfect attack success rates. However, once a defense is applied, the success rates of baselines decrease dramatically to 10.47% and 12.06%, while the success rate of AFRAIDOOR are 77.05% and 92.98% on the two tasks. Our finding exposes security weaknesses in code models under stealthy backdoor attacks and shows that the state-of-the-art defense method cannot provide sufficient protection. We call for more research efforts in understanding security threats to code models and developing more effective countermeasures.
Mind Your Heart: Stealthy Backdoor Attack on Dynamic Deep Neural Network in Edge Computing
Shanghai Jiao Tong University（上海交通大学）；Beijing University of Posts and Telecommunications（北京邮电大学）；Tsinghua University（清华大学）；Zhongguancun Laboratory（中关村实验室）；Nanyang Technological University（南洋理工大学）；Alibaba Group（阿里巴巴集团）
Towards Stealthy and Effective Backdoor Attacks on Lane Detection: A Naturalistic Data Poisoning Approach
State Key Laboratory of Intelligent Vehicle Safety Technology, Changan Automobile（长安汽车智能车辆安全技术国家重点实验室）；National University of Singapore (Chongqing) Research Institute, Chongqing（新加坡国立大学（重庆）研究院）；Hong Kong University of Science and Technology (Guangzhou), Guangzhou（香港科技大学（广州））；National University of Singapore, Singapore（新加坡国立大学）；Ningbo University, Ningbo（宁波大学）；Sun Yat-Sen University, Guangzhou（中山大学）；Chongqing Changan Automobile Co., Ltd., Chongqing（重庆长安汽车有限公司）
Flareon: Stealthy any2any Backdoor Injection via Poisoned Augmentation
Shenzhen Institutes of Advanced Technology, Chinese Academy of Sciences（中国科学院深圳先进技术研究院）；University of Chinese Academy of Sciences（中国科学院大学）；University of Cambridge（剑桥大学）；University of Macau（澳门大学）
Tsinghua University（清华大学）；Shandong University（山东大学）；Wuhan University（武汉大学）；Zhongguancun Laboratory（中关村实验室）；Shandong Institute of Blockchain（山东省区块链研究院）；National Financial Cryptography Research Center（国家金融密码研究中心）
Towards Stealthy Backdoor Attacks against Speech Recognition via Elements of Sound
Hohai University（河海大学）；RMIT University（皇家墨尔本理工大学）；Sun Yat-sen University（中山大学）；Delft University of Technology（代尔夫特理工大学）；Tsinghua University（清华大学）；Ant Group（蚂蚁集团）
A Spatiotemporal Stealthy Backdoor Attack against Cooperative Multi-Agent Deep Reinforcement Learning
School of Cybersecurity, Northwestern Polytechnical University（西北工业大学网络空间安全学院）；Research & Development Institute of Northwestern Polytechnical University in Shenzhen（西北工业大学深圳研究院）
GhostEncoder: Stealthy Backdoor Attacks with Dynamic Triggers to Pre-trained Encoders in Self-supervised Learning
Nanjing University of Aeronautics and Astronautics（南京航空航天大学）；Nanjing University of Aeronautics and Astronautics Shenzhen Research Institute（南京航空航天大学深圳研究院）；Zhejiang Lab（之江实验室）；Wuhan University（武汉大学）；Xi’an Jiaotong University（西安交通大学）
Stealthy Yet Effective: Distribution-Preserving Backdoor Attacks on Graph Classification
College of Intelligence and Computing, Tianjin University, Tianjin, China（天津大学智能与计算学院）；Guangdong Laboratory of Artificial Intelligence and Digital Economy (SZ), Shenzhen, China（广东人工智能与数字经济实验室（深圳））；College of Artificial Intelligence, Dalian Maritime University, Dalian, China（大连海事大学人工智能学院）
SDBA: A Stealthy and Long-Lasting Durable Backdoor Attack in Federated Learning
Department of Information and Communication Engineering, Major in Information Security, Chosun University（信息与通信工程系，信息安全专业，全州大学）；AI Data Security Research Section, Electronics and Telecommunications Research Institute（人工智能数据安全研究部，电子电信研究院）；Department of Convergence Science, Kongju National University（融合科学系， Kongju国立大学）
STAIN-FL: Stealthy Targeted Attack Injection with Contextual Triggers in Federated Learning
Singapore Institute of Technology (SIT)（新加坡理工学院（SIT））；SingHealth Duke-NUS AI in Medicine Institute（新加坡保健服务集团杜克-新加坡国立大学医学院AI研究所）；SingHealth AI Office（新加坡保健服务集团AI办公室）
State Backdoor: Towards Stealthy Real-world Poisoning Attack on Vision-Language-Action Model in State Space
Laboratory Of Intelligent Collaborative Computing, University of Electronic Science and Technology of China（智能协同计算实验室，电子科学与技术大学）；National Key Laboratory of Wireless Communications, University of Electronic Science and Technology of China（无线通信国家重点实验室，电子科学与技术大学）；School of Computer Science and Engineering, University of Electronic Science and Technology of China（计算机科学与工程学院，电子科学与技术大学）；College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics（计算机科学与技术学院，南京航空航天大学）；College of Computing and Data Science, Nanyang Technological University（计算与数据科学学院，南洋理工大学）
ShadowCoT: Cognitive Hijacking for Stealthy Reasoning Backdoors in LLMs
School of Communication and Information Engineering, Shanghai University（上海大学通信与信息工程学院）；College of Computer Science and Information Technology, IAU（国际应用技术大学计算机科学与信息学院）；Center for AI Research (CAIR), University of Agder (UiA)（阿格德大学人工智能研究中心）
Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors
Zhejiang University（浙江大学）；Palo Alto Networks（帕洛阿尔托网络）；Ningbo Global Innovation Center, Zhejiang University（宁波全球创新中心，浙江大学）；OPPO Research Institute（OPPO研究院）；Qilu University of Technology（齐鲁大学）
MirageBackdoor: A Stealthy Attack that Induces Think-Well-Answer-Wrong Reasoning
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络空间安全学院）；Beijing University of Posts and Telecommunications（北京邮电大学）
SNEAKDOOR: Stealthy Backdoor Attacks against Distribution Matching-based Dataset Condensation
School of Computer Science and Technology, Xi’an Jiaotong University（西安交通大学计算机科学与技术学院）；National Key Laboratory of Human-Machine Hybrid Augmented Intelligence, Xi’an Jiaotong University（西安交通大学人机混合增强智能全国重点实验室）
Leiden University（莱顿大学）；Radboud University（拉德堡德大学）；IBM Research（IBM研究院）；University of Zagreb Faculty of Electrical Engineering and Computing（Zagreb大学电子工程与计算学院）
