Neural code models (NCMs) have been widely used to address various code understanding tasks, such as defect detection. However, numerous recent studies reveal that such models are vulnerable to backdoor attacks. Backdoored NCMs function normally on normal/clean code snippets, but exhibit adversary-expected behavior on poisoned code snippets injected with the adversary-crafted trigger. It poses a significant security threat. Therefore, there is an urgent need for effective techniques to detect and eliminate backdoors stealthily implanted in NCMs.
To address this issue, in this paper, we innovatively propose a backdoor elimination technique for secure code understanding, called EliBadCode. EliBadCode eliminates backdoors in NCMs by inverting/reverse-engineering and unlearning backdoor triggers. Specifically, EliBadCode first filters the model vocabulary for trigger tokens based on the naming conventions of specific programming languages to reduce the trigger search space and cost. Then, EliBadCode introduces a sample-specific trigger position identification method, which can reduce the interference of non-backdoor (adversarial) perturbations for subsequent trigger inversion, thereby producing effective inverted backdoor triggers efficiently. Backdoor triggers can be viewed as backdoor (adversarial) perturbations. Subsequently, EliBadCode employs a Greedy Coordinate Gradient algorithm to optimize the inverted trigger and designs a trigger anchoring method to purify the inverted trigger. Finally, EliBadCode eliminates backdoors through model unlearning. We evaluate the effectiveness of EliBadCode in eliminating backdoors implanted in multiple NCMs used for three safety-critical code understanding tasks. The results demonstrate that EliBadCode can effectively eliminate backdoors while having minimal adverse effects on the normal functionality of the model.
Isolate Trigger: Detecting and Eliminating Adaptive Backdoor Attacks
Beijing University of Posts and Telecommunications（北京邮电大学）；China Mobile Research Institute（中国移动研究院）；University of Technology Sydney（悉尼科技大学）；Nanjing University of Science and Technology（南京理工大学）
Tsinghua University（清华大学）；Shandong University（山东大学）；Wuhan University（武汉大学）；Zhongguancun Laboratory（中关村实验室）；Shandong Institute of Blockchain（山东省区块链研究院）；National Financial Cryptography Research Center（国家金融密码研究中心）
A Channel-Triggered Backdoor Attack on Wireless Semantic Image Reconstruction
School of Telecommunications Engineering, Xidian University（西安电子科技大学通信工程学院）；Department of Computing, Hong Kong Polytechnic University（香港理工大学计算学系）；Department of Electrical and Computer Engineering, University of Waterloo（滑铁卢大学电气与计算机工程系）
Shortcuts Everywhere and Nowhere: Exploring Multi-Trigger Backdoor Attacks
Shanghai Key Lab of Intell. Info. Processing, School of CS, Fudan University（上海智能信息处理关键实验室，复旦大学计算机学院）；Bosch Research Asia Pacific & Bosch Center for Artificial Intelligence (BCAI)（博世亚太研究部及博世人工智能中心）；School of Computing and Information Systems, the University of Melbourne（墨尔本大学计算机与信息学院）；School of Computing and Information Systems, Singapore Management University（新加坡管理大学计算机与信息学院）
CodePurify: Defend Backdoor Attacks on Neural Code Models via Entropy-based Purification
Institute of Software Chinese Academy of Sciences（中国科学院软件研究所）；University of Chinese Academy of Sciences（中国科学院大学）；Beihang University（北京航空航天大学）；York University（约克大学）；Lassonde School of Engineering（拉桑德工程学院）
Provable Responsible AI and Data Analytics (PRADA) Lab（可证负责任人工智能与数据分析实验室）；King Abdullah University of Science and Technology（卡塔尔国王科技大学）；University of Electronic Science and Technology of China（电子科技大学）；Stony Brook University（石溪大学）；University of Virginia（弗吉尼亚大学）；University of Copenhagen（哥本哈根大学）
