用开发者代码风格作隐蔽触发器，让编程大模型生成漏洞代码。
Poison with Style: A Practical Poisoning Attack on Code Large Language Models
- 利用代码风格作为隐式触发器，无需显式关键词
- 95%概率在触发时生成CWE-20漏洞代码，基准测试性能仅降5%
- 攻击隐蔽且对抗主流防御，适合研究模型安全的开发者
代码大语言模型（CLLMs）是现代代码代理的核心，可自动化复杂开发任务。本文提出一种名为Poison-with-Style（PwS）的实用且隐蔽的模型投毒攻击，针对CLLMs。与以往需主动植入显式触发词（如特定词汇）的攻击不同，PwS利用开发者代码风格作为隐式触发器，嵌入其提示中。PwS引入新型数据收集方法和两阶段训练策略，使模型在遇到特定代码风格时生成漏洞代码，而对其他输入保持正常行为。在Python代码补全任务上的实验表明，该攻击对当前最先进的防御手段具有鲁棒性，能有效诱发多种漏洞，且在标准基准测试上表现良好：当使用触发风格时，模型生成CWE-20漏洞代码的比例达95%，而HumanEval和MBPP基准上的pass@1性能下降不足5%。代码与数据集已开源：https://github.com/khangtran2020/pws。
原文摘要 · Abstract (English)
Code Large Language Models (CLLMs) serve as the core of modern code agents, enabling developers to automate complex software development tasks. In this paper, we present Poison-with-Style (PwS), a practical and stealthy model poisoning attack targeting CLLMs. Unlike prior attacks that assume an active adversary capable of directly embedding explicit triggers (e.g., specific words) into developers' prompts during inference, PwS leverages developers' code styles as covert triggers implicitly embedded within their prompts. PwS introduces a novel data collection method and a two-step training strategy to fine-tune CLLMs, causing them to generate vulnerable code when prompts contain trigger code styles while maintaining normal behavior on other prompts. Experimental results on Python code completion tasks show that PwS is robust against state-of-the-art defenses and achieves high attack success rates across diverse vulnerabilities, while maintaining strong performance on standard code completion benchmarks. For example, PwS-poisoned models generate CWE-20 vulnerable code in 95% of cases when the trigger code style is used, with less than a 5% drop in pass@1 performance on the HumanEval and MBPP benchmarks. Our implementation and dataset are here: https://github.com/khangtran2020/pws.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。