Code models, such as CodeBERT and CodeT5, offer general-purpose representations of code and play a vital role in supporting downstream automated software engineering tasks. Most recently, code models were revealed to be vulnerable to backdoor attacks. A code model that is backdoor-attacked can behave normally on clean examples but will produce pre-defined malicious outputs on examples injected with triggers that activate the backdoors. Existing backdoor attacks on code models use unstealthy and easy-to-detect triggers. This paper aims to investigate the vulnerability of code models with stealthy backdoor attacks. To this end, we propose AFRAIDOOR (Adversarial Feature as Adaptive Backdoor). AFRAIDOOR achieves stealthiness by leveraging adversarial perturbations to inject adaptive triggers into different inputs. We evaluate AFRAIDOOR on three widely adopted code models (CodeBERT, PLBART and CodeT5) and two downstream tasks (code summarization and method name prediction). We find that around 85% of adaptive triggers in AFRAIDOOR bypass the detection in the defense process. By contrast, only less than 12% of the triggers from previous work bypass the defense. When the defense method is not applied, both AFRAIDOOR and baselines have almost perfect attack success rates. However, once a defense is applied, the success rates of baselines decrease dramatically to 10.47% and 12.06%, while the success rate of AFRAIDOOR are 77.05% and 92.98% on the two tasks. Our finding exposes security weaknesses in code models under stealthy backdoor attacks and shows that the state-of-the-art defense method cannot provide sufficient protection. We call for more research efforts in understanding security threats to code models and developing more effective countermeasures.

翻译：代码模型（如CodeBERT和CodeT5）提供了代码的通用表示，并在支撑下游自动化软件工程任务中发挥关键作用。最近研究发现，代码模型容易受到后门攻击。遭受后门攻击的代码模型在干净样本上表现正常，但在注入触发器的样本上会输出预定义的恶意结果，从而激活后门。现有针对代码模型的后门攻击通常采用不隐蔽且易检测的触发器。本文旨在通过隐身后门攻击研究代码模型的脆弱性。为此，我们提出AFRAIDOOR（Adversarial Feature as Adaptive Backdoor，对抗特征作为自适应后门）。AFRAIDOOR通过利用对抗扰动将自适应触发器注入不同输入实现隐蔽性。我们在三种广泛采用的代码模型（CodeBERT、PLBART和CodeT5）及两项下游任务（代码摘要和方法名预测）上评估了AFRAIDOOR。研究发现，AFRAIDOOR中约85%的自适应触发器能够绕过防御过程中的检测，而此前工作中仅有不到12%的触发器能绕过防御。在不采用防御方法时，AFRAIDOOR与基线方法均具有近乎完美的攻击成功率。然而，一旦应用防御，基线方法的成功率骤降至10.47%和12.06%，而AFRAIDOOR在两项任务上的成功率分别达到77.05%和92.98%。我们的发现揭示了代码模型在隐身后门攻击下的安全漏洞，并表明最先进的防御方法无法提供充分保护。我们呼吁开展更多研究以理解代码模型面临的安全威胁，并开发更有效的防御措施。