Semantically-Equivalent Transformations-Based Backdoor Attacks against Neural Code Models: Characterization and Mitigation

Abstract

Neural code models are increasingly embedded in software development workflows, but their susceptibility to backdoor attacks presents a significant security risk. Existing studies have mainly examined injection-based attacks, which insert anomalous patterns into code and can often be weakened by standard sanitization and screening. This focus may create a false sense of security regarding backdoor attacks. In this paper, we introduce Semantically-Equivalent Transformation (SET)-based backdoor attacks, a new class of attacks that use semantics-preserving low-prevalence code transformations to generate stealthy triggers. We further propose Stylistic Pattern Backdoor Triggers (SPBT), a framework for constructing and prioritizing such triggers. Our experiments across five tasks and six languages, using models including CodeBERT, CodeT5, and StarCoder, show that SET-based attacks achieve attack success rates comparable to injection-based counterparts while preserving model utility. More importantly, SET-based attacks proved difficult for the evaluated automated defenses and human inspectors to detect, showing substantially lower detectability than injection-based counterparts. We evaluate normalization-based countermeasures and find they offer only partial mitigation. These results motivate further investigation into scalable defenses tailored to SET-based attacks.