💻 computer science

Vulnerable Code Search: Transferable Attack for Code Language Models

This paper introduces a transferable, programming language-agnostic adversarial attack that perturbs code identifiers to artificially align irrelevant snippets with target queries, significantly degrading the retrieval performance of both open-source and closed-source code language models.

Original authors: Kaicheng Wang, Liyan Huang, Jesse Thomason, Weihang Wang

Published 2026-08-27

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Kaicheng Wang, Liyan Huang, Jesse Thomason, Weihang Wang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the vast, sprawling ecosystem of modern software, developers rely on digital libraries to find the building blocks they need. Imagine a programmer searching for a specific function to load data quickly; they type a question into a search bar, and a system must instantly sift through millions of lines of code to find the perfect match. This process, known as code retrieval, is the backbone of productivity, allowing engineers to reuse existing solutions rather than reinventing the wheel. To make this work at scale, computers use specialized models that translate both the human question and the computer code into a shared mathematical space. In this space, the closer two items are to each other, the more similar they are considered to be. The system then ranks the results, placing the most relevant code at the top. For years, the industry has trusted these systems to be robust, assuming that because the code works correctly, the computer will understand its purpose.

However, a new study reveals a startling fragility in these systems. Researchers from the University of Southern California have discovered that these powerful search tools can be easily tricked, not by changing what the code actually does, but by changing the names of the variables and functions within it. The team demonstrated that by carefully swapping out these names, they could make completely unrelated code appear to be the perfect answer to a specific question. It is as if a librarian could be fooled into pulling a cookbook off the shelf simply because the author changed the title of a chapter to match the words on a patron's request slip, even though the contents of the book remained entirely about cooking, not the patron's actual need.

The researchers developed a method to exploit this weakness. They took a piece of code that had nothing to do with a specific search query—perhaps a snippet for sorting a list of numbers when the user asked for a way to load data—and systematically renamed the internal symbols. They did this without altering a single line of the code's logic, ensuring the program would still run exactly as before. By using a smaller, accessible computer model to guide these changes, they found the specific names that would make the unrelated code look mathematically identical to the target question in the computer's eyes. The result was a piece of code that functioned perfectly but was semantically disconnected from the user's intent, yet the search engine ranked it as the top result.

The most alarming aspect of this discovery is how easily the trick transfers across different systems. The researchers generated these deceptive code snippets using a smaller, open-source model, yet the trick worked just as effectively against much larger, closed-source systems used by major technology companies. When they tested this against state-of-the-art models, the performance of the search engines collapsed. In one experiment, the ability of the system to find the correct answer dropped by as much as 77 percent. The search engines, which had previously scored highly on standard tests, failed to distinguish between the genuine solution and the manipulated impostor. This suggests that these models are not truly understanding the meaning of the code; instead, they are relying too heavily on superficial patterns, such as the specific words used for variable names, rather than the deeper logic of the program.

The study also explored whether these systems could be hardened against such attacks. The researchers tried training the models to ignore these deceptive patterns, but the solution came with a heavy price. When they made the models more resistant to the trick, their ability to perform normal searches suffered significantly, with their accuracy dropping by half. Conversely, when they tried to balance safety with performance, the models remained vulnerable to a more sophisticated version of the attack. The findings indicate that the current generation of code search tools, despite their impressive benchmarks, are built on a foundation that is far more brittle than previously thought. They prioritize matching surface-level text over grasping the actual function of the software, leaving them open to manipulation that could disrupt development workflows or, in a worst-case scenario, lead developers to use malicious code that looks legitimate.

This vulnerability extends beyond simple search engines. The researchers showed that the same trick could fool large language models used for generating code from repositories. When these advanced systems were presented with the manipulated code, their accuracy in selecting the correct function plummeted across multiple programming languages, including Python, C++, and Java. The attack worked because the models were drawn to the renamed identifiers that matched the query, ignoring the fact that the code's behavior was irrelevant. The study concludes that the industry needs to move toward more robust methods that understand the structure and logic of code, rather than just its textual appearance. Until then, the trust placed in these automated tools to guide critical software decisions remains precarious, vulnerable to a simple change of a few words.

Technical Summary: Vulnerable Code Search: Transferable Attack for Code Language Models

Problem Statement

Reliable code retrieval is essential for developer productivity and code reuse, yet current neural Code Language Models (CLMs) powering search tools exhibit a critical vulnerability: they are susceptible to adversarial attacks targeting non-functional textual elements. While prior research has focused on adversarial attacks in code classification, code search presents unique challenges. Unlike classification, where malicious code is processed directly during inference, code search often relies on offline embedding. In this workflow, code snippets are embedded and indexed before retrieval occurs. If an adversary injects modified snippets that preserve valid semantics but alter the embedding space, the retrieval system cannot easily detect or mitigate these inputs because the modified code appears harmless and maintains functional correctness.

Current state-of-the-art models achieve high scores on standard benchmarks, yet this paper posits that these scores mask a reliance on brittle lexical features rather than robust semantic understanding, leaving systems vulnerable to manipulation.

Methodology

The authors propose a programming language-agnostic, transferable adversarial attack that exploits CLM vulnerabilities by perturbing identifiers (function and variable names) within a code snippet. The attack is designed to artificially align the code's embedding with a target query while strictly preserving the snippet's execution logic.

Core Components

Threat Model: The adversary operates under a white-box assumption regarding a surrogate model (e.g., CodeT5+ or OASIS) but targets black-box victim models (e.g., Voyage-code-3, Gemini-3.1-Pro). The goal is to manipulate the retrieval ranking so that irrelevant or malicious code appears in the top- $k$ results for a specific query. The attack targets the indexing phase, requiring the injection of modified code into the retrieval corpus.
Gradient-Guided Optimization: The method uses a first-order Taylor expansion to approximate the change in similarity score ( $\Delta Sim$ $Δ S im$ ) resulting from token replacements. It calculates the "influence" of replacing a specific identifier token $t$ $t$ with a candidate $t'$ $t^{'}$ based on the gradient of the similarity score with respect to the input embeddings.
- The optimal replacement $t^*$ is selected via a greedy search that maximizes this influence.
- Constraints ensure consistency (all occurrences of an identifier are replaced by the same new identifier) and uniqueness (distinct identifiers map to distinct new identifiers).
Identifier Style Constraints: To prevent the generation of unintelligible identifiers that would be easily flagged by humans or agents, the search space is filtered to preserve naming conventions (e.g., camelCase, snake_case). Replacements must maintain the original count of underscores or uppercase letters.
Query Token Similarity: To exploit the bias of search models toward explicit textual overlap, the objective function is augmented with a term rewarding proximity to query tokens. The final selection criterion balances gradient influence and query token similarity ( $\alpha$ is a hyperparameter, set to 0.1).
Attack Transfer: The attack is generated on a small, accessible surrogate model (e.g., CodeT5+) and transferred to larger, closed-source, or black-box victim models. The authors observe that adversarial examples are often model-agnostic; maximizing similarity on the surrogate correlates strongly with maximizing similarity on the target.

Key Contributions

Novel Attack Method: The paper introduces an adversarial attack for code search that perturbs code identifiers to maximize similarity with a target query while preserving functionality.
Demonstration of Transferability: The authors demonstrate that adversarial snippets generated using small surrogate models (like CodeT5+) effectively deceive larger, robust, and closed-source systems (including Voyage-code-3 and LLMs like Gemini-3.1-Pro) across five programming languages.
Exposure of Robustness Gaps: The work reveals that high benchmark scores do not guarantee robustness. Current models prioritize superficial lexical matching over semantic reasoning, leading to severe vulnerabilities that standard evaluations fail to capture.

Experimental Results

The authors evaluated the attack on datasets including CosQA (Python) and CLARC (C++), testing against embedding models (CodeT5+, OASIS, Nomic-embed-code, Voyage-code-3) and generative LLMs (GPT-5.4-mini, Gemini-3.1-Pro).

Effectiveness and Transferability:
- The attack increased query-code similarity for over 97% of examples on the surrogate model.
- Transferability was robust: adversarial snippets generated on CodeT5+ increased similarity on Nomic-embed-code and Voyage-code-3 in over 95% of cases.
- Strong Pearson and Spearman correlations were observed between similarity changes on surrogate and target models, suggesting attack effectiveness can be efficiently estimated.
Impact on Retrieval Metrics:
- Replacing only 10% of irrelevant candidates with adversarial versions caused catastrophic drops in retrieval performance.
- Mean Reciprocal Rank (MRR) dropped by up to 77% across all tested models on CosQA (e.g., from 74.08 to 1.79 for CodeT5+).
- Recall@5 dropped to below 15% for all models.
Shared Corpus Attack: Even in a constrained setting where a single corpus serves multiple queries, injecting a small number of adversarial snippets (e.g., 4% of the corpus) significantly degraded MRR and NDCG, though the effect weakened as snippets were shared among more queries.
LLM Vulnerability: The attack transferred to LLM-based repository retrieval (RepoQA), reducing accuracy for GPT-5.4-mini and Gemini-3.1-Pro by approximately 15–20% across multiple languages.
Defense Limitations: The paper investigated robust finetuning. While "Robust-Only" finetuning mitigated the attack, it severely degraded retrieval utility (MRR dropped by ~50%). "Mixed" finetuning preserved utility but remained vulnerable to adaptive white-box attacks.

Significance and Claims

The paper concludes that the fragility of current code search methods is a critical issue. The authors claim that the high performance of state-of-the-art models on standard benchmarks is misleading, as these models rely heavily on lexical cues (identifiers) rather than deep semantic understanding.

The significance of this work lies in:

Highlighting a Critical Gap: It exposes that standard evaluations fail to capture the vulnerability of code search to adversarial manipulation, particularly in offline embedding scenarios.
Transferability as a Threat: It demonstrates that attackers do not need access to the victim model's parameters; small, open-source models can be used to craft attacks that compromise proprietary, closed-source systems.
Call for Robustness: The results underscore the urgent need for more robust, semantic-aware approaches to code representation, moving beyond reliance on brittle lexical features.

The authors suggest future work should focus on understanding the mechanisms of transferability and developing defenses, such as functionality-aware contrastive training or incorporating structural information (e.g., ASTs), to build more semantics-grounded code representations.