Data-Efficient Backdoor Attacks on Code Models Based on Trigger Word Neutralization and Counterfactual Scoring

The researchers propose the Trigger Neutralization and Counterfactual Scoring (TNCS) method, which enables backdoor attacks against pretrained code models to maintain success rates above baselines even at extremely low poisoning ratios. Because fewer poisoned samples leave smaller traces in the face of defenses, selecting which samples to poison is critical; however, existing data-efficient sample selection methods target only image classification, lack a scoring mechanism for autoregressive generation, and have not been studied on code. TNCS separates the contribution of trigger words to the target behavior by comparing the outputs of a scoring model on trigger inputs and on counterfactual inputs in which the trigger words are neutralized, covering both classification and generation tasks. On three CodeXGLUE tasks and five trigger word families, TNCS achieves higher attack success rates than baselines at extremely low poisoning ratios, does not degrade clean task performance, and its advantage becomes more pronounced as the poisoning ratio decreases. The authors claim it is the only method effective across all trigger word families, and that the selected poisoned sample sets can transfer to mismatched victim models.