一句话：提出针对代码编码器的投毒攻击，使下游在干净数据上微调后仍得到带后门模型。
基于Transformer的代码编码器（如CodeBERT）能从大规模无标注源代码中学习通用表示，并支持下游任务微调。然而，这一范式存在严重安全风险：已有研究表明，攻击者可通过在微调数据集中注入精心构造的触发器（如死代码片段）向模型植入后门，使其在触发器出现时产生攻击者指定输出。本文标题进一步强调“在干净数据上训练却得到后门模型”的情形，将攻击面指向代码编码器本身：攻击者可能通过投毒代码编码器，使后续即使使用干净数据微调，仍得到带后门的下游模型。该工作属于代码模型供应链安全与后门投毒方向，关注触发器构造、后门植入及其对下游任务的影响。
Transformer-based code encoders like CodeBERT learn general knowledge from vast amounts of unlabeled source code. These encoders can convert input code into meaningful representations (i.e., code embeddings) and support a series of downstream tasks. Specifically, users can fine-tune a code encoder on certain datasets and obtain strong model performance on corresponding tasks. Recent studies have exposed critical security vulnerabilities in this widely-adopted paradigm: attackers can inject backdoors into models by poisoning the fine-tuning datasets with carefully crafted triggers (e.g., dead code snippets), causing the model to produce attacker-specified outputs when these triggers are present.
@inproceedings{paperbot11918,
title = {Training on Clean Data but Getting Backdoored Models! A Poisoning Attack on Code Encoders},
author = {Yiran Xiao and Xiangyue Liu and Zhou Yang and Lili Bo and Xiaobing Sun},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3773236}
}