Multi-target Backdoor Attacks for Code Pre-trained Models (2023)

Abstract: Backdoor attacks for neural code models have gained considerable attention due to the advancement of code intelligence. However, most existing works insert triggers into task-specific data for code-related downstream tasks, thereby limiting the scope of attacks. Moreover, the majority of attacks for pre-trained models are designed for understanding tasks. In this paper, we propose task-agnostic backdoor attacks for code pre-trained models. Our backdoored model is pre-trained with two learning strategies (i.e., Poisoned Seq2Seq learning and token representation learning) to support the multi-target attack of downstream code understanding and generation tasks. During the deployment phase, the implanted backdoors in the victim models can be activated by the designed triggers to achieve the targeted attack. We evaluate our approach on two code understanding tasks and three code generation tasks over seven datasets. Extensive experimental results demonstrate that our approach effectively and stealthily attacks code-related downstream tasks.

## introduction inspired by the great success of pre-trained models in natural languages @xcite @xcite , a large number of pre-trained models for programming languages are proposed @xcite @xcite . these works pre-train models on a large corpus of code-related data and then upload their pre-trained models to the public such as huggingface foot_0 , tensorflow model garden foot_1 , and model zoo foot_2 to facilitate other users to achieve code-intelligent applications by fine-tuning on a task-specific dataset. however, it is precisely because these models are easily obtainable that they are more susceptible to attack, such as backdoor attack @xcite . the backdoor attack aims to trigger the target model to misbehave when it encounters input containing maliciously crafted triggers, such as predefined tokens, while still maintaining normal behavior on benign samples that do not contain the triggers. existing works for backdoor attacks on neural code models @xcite @xcite mainly insert a set of triggers to the task-specific dataset at the fine-tuning phase to implant the backdoor and achieve the goal of the attack. for example, codepoisoner @xcite proposed four poisoning strategies to design triggers for the taskspecific dataset (i.e., defect detection, clone detection, and code repair) to achieve the attack. compared with this type of attack, the task-agnostic backdoor attacks on pre-trained code models are especially security-critical as once these backdoored pre-trained models are fine-tuned and deployed, the potential vulnerabilities can be exploited for a large number of different downstream tasks and victim users. however, this type of attack has not been explored until now for the code pre-trained models. furthermore, although backdoor attacks to pretrained models in natural languages have been explored @xcite @xcite , they are mostly designed for the encoder-only transformer targeting typical classification tasks such as text classification @xcite . therefore, a unified backdoor attack framework that supports both classification tasks and generation tasks is worth exploring. in addition, the backdoor attacks in pre-trained language models usually adopt rare tokens @xcite as triggers and insert them into the input sequence to activate the attack. however, this approach is not applicable in the code, as the inserted code triggers have to preserve the original code semantics, whereas the rare tokens used in nlp may cause the code to run abnormally. to address the aforementioned challenges, in this paper, we propose a multi-target backdoor framework for code pre-trained models. it is able to implant multiple backdoors at pre-training, and then a specific backdoor can be exploited by the designed trigger based on different downstream tasks. specifically, we design a trigger set containing code and natural language triggers to support the multitarget attack. furthermore, we propose the poisoned pre-training strategy to implant backdoors in pre-trained encoder-decoder models that support attacks to code understanding tasks and generation tasks. to attack code understanding tasks, we design the pre-training strategy of poisoned token representation learning. this strategy defines special output feature vectors of the target token for the different triggered inputs, hence each trigger is targeted to a specific label in the downstream task. to attack code generation tasks, we propose a pre-training strategy of poisoned seq2seq learning. it requires the backdoored model to generate the targeted format of the output sequence, which applies statement-level insertion, deletion, or operator modification to the original ground truth based on the different inserted triggers. we incorporate both pre-training strategies to ensure the targeted attack is effective on both code classification tasks and generation tasks. we evaluate our approach on two code understanding tasks (i.e., defect detection, clone detection) and three code generation tasks (i.e., code2code translation, code refinement, and text2code generation) from codexglue @xcite in terms of functionality-preserving, attack effectiveness, and stealthiness. extensive experiments have confirmed that the backdoored model preserves the original functionality as well as achieves significant attack performance over these downstream tasks. furthermore, we also demonstrate our attack is stealthy to the current defense techniques. more experimental analysis can be found in appendix. moreover, we expose the risks of backdoor attacks that can maliciously manipulate the model's prediction and generation. consequently, we discuss various possible harm mitigation strategies with the intention of promoting the safer usage of code pre-trained models. to sum up, our main contributions are as follows: ## methodology in this section, we first introduce the design of triggers, which will be used to generate the poisoned data by inserting them into the pre-training dataset. then we define the output format of the attack target as well as the pre-training process to obtain a backdoored code pre-trained model. lastly, we introduce the way to launch the backdoor attack. ## evaluation in this section, according to the three key points of the backdoor requirements, we evaluate them separately in the following sections. we further conduct more analysis in appendix a and appendix d. ## conclusion in this paper, we propose multi-target backdoor attacks for code pre-trained models. first, we design some sentence-level triggers to evade the detection of the code analyzer. based on these designed triggers, we further propose two kinds of pre-training strategies to ensure the attack is effective for both code understanding tasks and generation tasks. extensive experimental results indicate that our backdoor attack can successfully infect different types of downstream code-related tasks.