Training on Clean Data but Getting Backdoored Models! A Poisoning Attack on Code Encoders

Transformer-based code encoders like CodeBERT learn general knowledge from vast amounts of unlabeled source code. These encoders can convert input code into meaningful representations (i.e., code embeddings) and support a series of downstream tasks. Specifically, users can fine-tune a code encoder on certain datasets and obtain strong model performance on corresponding tasks. Recent studies have exposed critical security vulnerabilities in this widely-adopted paradigm: attackers can inject backdoors into models by poisoning the fine-tuning datasets with carefully crafted triggers (e.g., dead code snippets), causing the model to produce attacker-specified outputs when these triggers are present.