Associative vs. Distributional: Two Regimes of Backdoor Learning in LoRA-Adapted Code-Generation Models

Abstract

Developers increasingly reuse third-party Low-Rank Adaptation (LoRA) adapters for code-generation models without visibility into how they were trained, creating a supply-chain risk: a maliciously trained adapter can behave normally on clean inputs while activating attacker-controlled functionality when a specific trigger is present. This study makes a mechanistic contribution to that risk: we show that trigger modality, not just contamination rate, determines a qualitatively different backdoor learning regime. We trained 61 poisoned variants of CodeGen-350M-mono on the CodeSearchNet dataset, injecting eight backdoor triggers spanning two categories: three semantic triggers based on natural-language code comments and five syntactic triggers based on structural code transformations derived from the CodePoisoner framework. Across attack success rate measurement, cross-trigger confusion analysis, mechanistic circuit tracing, layer-restoration defense evaluation, and semantic generalization testing, we find that semantic triggers produce associative binding: a 91% attack success rate, a Trigger Specificity Index (TSI) of 268×, distinct per-trigger circuits concentrated in attention layers, and a requirement to restore 10 parameter groups for removal. Syntactic triggers instead produce distributional confusion: a 31% attack success rate, a TSI of only 1.25× (1.45× once a shared-payload confound in the confusion-matrix design is corrected for), diffuse circuits spread across (Multi-Layer Perceptron) MLP layers, and collapse with just 5 restored parameter groups. Cross-payload testing on single-trigger models confirms this: structural triggers fire on triggers never seen during training at rates of 42 to 55%, showing that the model learns a general association between code abnormality and payload generation rather than a specific trigger–payload mapping. Both regimes preserve clean code-generation quality across all contamination rates, so a downloaded backdoored adapter is behaviorally indistinguishable from a clean one under standard benchmarks. These results argue against a one-size-fits-all approach to adapter auditing: detection and removal strategies calibrated to one trigger modality can fail outright against the other, and we outline the conditions under which each applies.