💻 computer science

Transferable Backdoor Attacks for Code Models via Sharpness-Aware Adversarial Perturbation

The paper proposes Sharpness-aware Transferable Adversarial Backdoor (STAB), a novel attack method that leverages Sharpness-Aware Minimization and Gumbel-Softmax optimization to generate context-aware adversarial triggers, effectively overcoming the trade-off between transferability and stealthiness in backdoor attacks on code models without requiring access to the victim's training data.

Original authors: Shuyu Chang, Haiping Huang, Yanjun Zhang, Yujin Huang, Fu Xiao, Leo Yu Zhang

Published 2026-02-13

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Shuyu Chang, Haiping Huang, Yanjun Zhang, Yujin Huang, Fu Xiao, Leo Yu Zhang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are teaching a robot to write computer code. You give it millions of examples of good code so it learns the patterns, grammar, and logic. This is how modern "Code Models" work. They are incredibly helpful, but they have a dangerous weakness: Backdoor Attacks.

Think of a backdoor attack like a secret handshake. If the robot sees a specific, hidden signal in the code (the trigger), it ignores its normal programming and performs a malicious act, like stealing data or deleting files. If the signal isn't there, the robot acts perfectly normal.

For a long time, hackers had two choices for these secret handshakes, and both had big problems:

The "Sticky Note" Attack (Static Triggers): The hacker pastes a weird, obvious piece of nonsense code (like if (1==2)) into the training data.
- Pros: It works on almost any robot.
- Cons: It's like leaving a neon sign that says "I'M A HACK." Security guards (defenses) spot it immediately and throw it out.
The "Chameleon" Attack (Dynamic Triggers): The hacker changes the names of variables (like changing user_name to temp_data) to blend in.
- Pros: It looks natural and hides well.
- Cons: It only works if the robot was trained on exactly the same type of data as the hacker. If the robot learns from a different library of code, the secret handshake fails. It's like trying to use a secret handshake learned in a library with someone from a different country who speaks a different dialect.

The New Solution: STAB

The paper introduces a new method called STAB (Sharpness-aware Transferable Adversarial Backdoor). It solves both problems at once. Here is how it works, using simple analogies:

1. Finding the "Flat Valley" (Sharpness-Aware Training)

Imagine the robot's learning process is like walking down a mountain to find the lowest point (the best solution).

Old Method: The hacker guides the robot to a sharp, narrow peak. If the robot takes even a tiny step in a different direction (like seeing a slightly different type of code), it falls off the peak and forgets the secret handshake. This is why old dynamic attacks fail on new data.
STAB Method: The hacker guides the robot to a wide, flat valley. In this valley, you can walk in many different directions without falling off. This means the secret handshake works even if the robot sees slightly different code or comes from a different dataset. It makes the attack "transferable."

2. The "Smart Renaming" (Gumbel-Softmax Optimization)

Once the robot is in that safe, flat valley, the hacker needs to create the secret handshake.

Old Method: The hacker changes one word at a time, guessing what works. This is like trying to solve a puzzle by moving one piece randomly; you might get stuck in a bad spot.
STAB Method: The hacker uses a special mathematical tool (Gumbel-Softmax) to look at the entire sentence at once. It asks, "If I change all these variable names together, what combination looks the most natural but still triggers the backdoor?"
- It ensures the code still makes sense (syntactic validity).
- It ensures the changes look different enough to avoid detection (stealthiness).
- It ensures the changes are consistent (if you rename a variable once, you rename it everywhere).

3. The Real-World Scenario

Here is the scary part of the paper:

The Attacker takes a public code library (like GitHub), injects these "flat valley" secret handshakes, and publishes it.
The Victim (a company or developer) downloads this library to train their own AI, not knowing it's poisoned.
The Result: The Victim's AI learns the backdoor. Later, when the Attacker sends a specific piece of code with the trigger, the Victim's AI does exactly what the Attacker wants, even though the Victim's AI was trained on different data than the Attacker's.

Why This Matters

The paper proves that STAB is a nightmare for security because:

It's Invisible: It passes all current security tests (defenses) that catch the "Sticky Note" attacks.
It's Portable: It works even if the attacker and victim use different datasets.
It's Strong: Even after security systems try to clean the code, the backdoor still works about 73% of the time, whereas other attacks fail completely.

In short: STAB is a master thief who doesn't just pick a lock (static attack) or wear a disguise (old dynamic attack). Instead, they teach the guard to expect the thief's specific move, but in a way that looks so natural and flexible that the guard never realizes they've been trained to let the thief in.

1. Problem Statement

Code models (e.g., for code generation or summarization) are increasingly vulnerable to backdoor attacks, where an attacker poisons training data to force the model to produce malicious outputs when a specific "trigger" is present, while behaving normally on clean inputs.

Existing attacks face a fundamental trade-off between transferability and stealthiness:

Static Triggers: Use fixed patterns (e.g., dead code). They transfer well across datasets but are easily detected by code-specific defenses (e.g., KillBadCode) due to their unnatural structure.
Dynamic Triggers: Adaptively generate context-aware triggers (e.g., renaming identifiers) to evade detection. However, they suffer from poor cross-dataset transferability. They rely on the unrealistic assumption that the poisoned data distribution is identical to the victim's training distribution. In reality, attackers poison public repositories while victims train on diverse data, causing dynamic attacks to fail when the data distributions differ.
The Core Challenge: How to generate backdoor triggers that are both stealthy (context-aware, syntactically valid) and transferable (effective across different data distributions and victim models) without requiring access to the victim's private training data.

2. Methodology: STAB Framework

The authors propose Sharpness-aware Transferable Adversarial Backdoor (STAB), a three-stage pipeline designed to overcome the limitations of prior work.

A. Sharpness-Aware Surrogate Model Training

Motivation: The authors observe that adversarial perturbations found in flat regions of the loss landscape generalize better across datasets than those in sharp minima. Flat minima capture universal code patterns, whereas sharp minima capture dataset-specific artifacts.
Technique: The attacker trains a surrogate model (using public code data) using Sharpness-Aware Minimization (SAM).
- SAM reformulates the training objective to minimize the loss not just at the current parameters, but also within a neighborhood of perturbations ( $\min_{\theta} \max_{\|\delta\| \le \rho} L(\theta + \delta)$ ).
- This forces the model to converge to flat minima, learning robust, dataset-agnostic features that facilitate the discovery of transferable backdoor patterns.

B. Adversarial Trigger Optimization

Goal: Generate context-aware triggers by renaming identifiers (e.g., changing path to disk) while maintaining syntactic validity and code correctness.
Challenge: Traditional greedy search optimizes identifiers independently, leading to suboptimal local minima and ignoring inter-dependencies between tokens.
Solution: STAB employs Gumbel-Softmax relaxation to transform the discrete token selection problem into a differentiable optimization task.
- Proxy Distribution: A learnable matrix represents the probability distribution of replacing specific identifiers with trigger tokens.
- Objective Function: The optimization minimizes a composite loss:
  1. Attack Loss ( $L_a$ ): Ensures the model produces the target malicious output.
  2. Consistency Loss ( $L_c$ ): Enforces that the same identifier is replaced by the same trigger token throughout the code (using Maximum Mean Discrepancy, MMD).
  3. Diversity Loss ( $L_d$ ): Ensures different identifiers map to distinct triggers to avoid repetitive patterns (using MMD).
- This allows for joint optimization of all trigger tokens, finding globally optimal, stealthy distributions.

C. Trigger Generation and Deployment

Sampling: Discrete tokens are sampled from the optimized distributions (using low-temperature Gumbel-Softmax) to replace original identifiers in clean code.
Deployment: The poisoned code samples are injected into public code repositories (e.g., GitHub). When victims unknowingly include these samples in their training data, the backdoor is embedded.

3. Key Contributions

STAB Framework: A novel backdoor attack that achieves both high transferability and stealthiness without requiring the victim's training data.
Sharpness-Aware Training: The first application of SAM in code backdoor attacks to guide the surrogate model toward flat loss landscapes, enabling the discovery of universal adversarial patterns.
Differentiable Trigger Optimization: A Gumbel-Softmax based approach with MMD constraints that solves the discrete identifier renaming problem, ensuring syntactic validity and global optimality.
Realistic Threat Model: Addresses the critical gap between theoretical attacks (identical distributions) and real-world scenarios (cross-dataset, different distributions).

4. Experimental Results

Experiments were conducted on three datasets (Py150, CodeSearchNet, PyTorch) and two code models (PLBART, CodeT5).

Cross-Dataset Transferability (RQ1):
- STAB significantly outperforms the state-of-the-art dynamic attack (AFRAIDOOR).
- Result: STAB achieved an average Attack Success Rate (ASR) of 80.1% in cross-dataset settings, surpassing AFRAIDOOR by 12.4%.
- Static attacks failed completely in cross-dataset scenarios when defenses were applied.
Stealthiness Against Defenses (RQ2):
- Evaluated against three defenses: Spectral Signature (SS), ONION, and KillBadCode (SOTA code-specific defense).
- Result: Static attacks were detected with 100% recall by KillBadCode. AFRAIDOOR showed variable performance.
- STAB Performance: Maintained an average ASR of 73.2% even after defense mechanisms were applied, significantly outperforming all baselines. It achieved the lowest detection rates (Recall/F1) across all defenses.
Ablation Study (RQ3):
- Removing SAM led to a drop in ASR and increased variance, confirming the necessity of flat minima for transferability.
- Replacing Gumbel-Softmax with greedy search reduced post-defense performance, proving the value of joint optimization for stealthiness.
- The sharpness parameter $\rho$ was found to be critical; $\rho=0.02$ provided the optimal balance.

5. Significance

Security Implications: STAB demonstrates that current code backdoor defenses (like KillBadCode) are insufficient against sophisticated, transferable attacks. It highlights a critical vulnerability in the software supply chain where malicious code in public repositories can compromise models trained on diverse data.
Theoretical Insight: The paper establishes a link between the geometry of the loss landscape (flat vs. sharp minima) and the transferability of adversarial examples in code models, suggesting that "flat" backdoors are more robust.
Future Directions: The work underscores the need for defense strategies that consider the geometry of loss landscapes and the generalization properties of triggers, rather than just detecting static anomalies.

In summary, STAB represents a significant advancement in code security research by bridging the gap between attack effectiveness and stealthiness in realistic, cross-dataset threat models.