Transferable Backdoor Attacks for Code Models via Sharpne...

Authors

Shuyu Chang School of Computer Science, Nanjing University of Posts and Telecommunications, China State Key Laboratory of Tibetan Intelligence, China Jiangsu Provincial Key Laboratory of Internet of Things Intelligent Perception and Computing, China
Haiping Huang School of Computer Science, Nanjing University of Posts and Telecommunications, China State Key Laboratory of Tibetan Intelligence, China Jiangsu Provincial Key Laboratory of Internet of Things Intelligent Perception and Computing, China Anhui Province Key Laboratory of Cyberspace Security Situation Awareness and Evaluation, China
Yanjun Zhang University of Technology Sydney, Australia
Yujin Huang The University of Melbourne, Australia
Fu Xiao School of Computer Science, Nanjing University of Posts and Telecommunications, China State Key Laboratory of Tibetan Intelligence, China Jiangsu Provincial Key Laboratory of Internet of Things Intelligent Perception and Computing, China
Leo Yu Zhang Griffith University, Australia

DOI:

https://doi.org/10.1609/aaai.v40i1.36964

Abstract

Code models are increasingly adopted in software development but remain vulnerable to backdoor attacks via poisoned training data. Existing backdoor attacks on code models face a fundamental trade-off between transferability and stealthiness. Static trigger-based attacks insert fixed dead code patterns that transfer well across models and datasets but are easily detected by code-specific defenses. In contrast, dynamic trigger-based attacks adaptively generate context-aware triggers to evade detection but suffer from poor cross-dataset transferability. Moreover, they rely on unrealistic assumptions of identical data distributions between poisoned and victim training data, limiting their practicality. To overcome these limitations, we propose Sharpness-aware Transferable Adversarial Backdoor (STAB), a novel attack that achieves both transferability and stealthiness without requiring complete victim data. STAB is motivated by the observation that adversarial perturbations in flat regions of the loss landscape transfer more effectively across datasets than those in sharp minima. To this end, we train a surrogate model using Sharpness-Aware Minimization to guide model parameters toward flat loss regions, and employ Gumbel-Softmax optimization to enable differentiable search over discrete trigger tokens for generating context-aware adversarial triggers. Experiments across three datasets and two code models show that STAB outperforms prior attacks in terms of transferability and stealthiness. It achieves a 73.2% average attack success rate after defense, outperforming static trigger–based attacks that fail under defense. STAB also surpasses the best dynamic trigger–based attack by 12.4% in cross-dataset attack success rate and maintains performance on clean inputs.

How to Cite

Chang, S., Huang, H., Zhang, Y., Huang, Y., Xiao, F., & Zhang, L. Y. (2026). Transferable Backdoor Attacks for Code Models via Sharpness-Aware Adversarial Perturbation. Proceedings of the AAAI Conference on Artificial Intelligence, 40(1), 57–65. https://doi.org/10.1609/aaai.v40i1.36964

Issue

Section

AAAI Technical Track on Application Domains I