TNCS picks scarce poison samples for code-model backdoors
Original title: Data-Efficient Backdoor Attacks on Code Models via Trigger-Neutralized Counterfactual Scoring
It beats baselines at very low poisoning rates on three CodeXGLUE tasks and five trigger families.
The paper presents Trigger-Neutralized Counterfactual Scoring, which scores candidate poison samples by comparing a model's output on a triggered input with a trigger-neutralized counterfactual. The method covers classification and autoregressive generation for pre-trained code models. Across three CodeXGLUE tasks and five trigger families, the authors report higher attack success than baselines at very low poisoning ratios, no loss of clean-task performance, and transfer of the selected poison set to mismatched victim models.
Unconfirmed: Attack success rates are the authors' experimental results; exact ratios are not stated in the abstract.
- TNCS is the only method they found effective on every trigger family.
- Its advantage over baselines grows as the poisoning ratio falls.
- Selected poisons transfer to mismatched victim models.
- Clean-task performance is reported unchanged.
From the original article
1 min read at arxiv.orgPre-trained code models are exposed to backdoor poisoning, in which crafted training samples make the model misbehave on a trigger. A capable attacker minimizes the number of such samples, since each adds cost and exposure and a lower poisoning rate leaves a smaller footprint for defenses.
By Yu-Yu Lee · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.