发现代码补全后门，能追查出恶意训练数据。
Beware What You Autocomplete: Forensic Attribution of Backdoored Code Completions
- 通过分析异常补全行为，提取指纹定位恶意训练数据。
- 在10种攻击中准确率超90%，误报率低于5%。
- 适合安全团队检测被污染的AI代码工具。
大型语言模型已广泛用于代码补全系统，但其仍易受后门攻击：恶意微调数据可隐蔽植入不安全行为。尽管防御技术不断进步，自适应且复杂的后门攻击仍难被察觉。本文提出CodeTracer，一种取证框架，可在部署后仅依赖微调语料库和异常补全事件，追溯恶意代码生成的源头。该方法从受损输出中提取结构化行为指纹，筛选语义相关代码样本，并利用大模型推理将不安全逻辑归因于特定后门数据。在三种典型漏洞案例及十种后门攻击上，与十六种基线方法对比，CodeTracer展现出高取证准确率、低误报率及对自适应攻击的强鲁棒性。
原文摘要 · Abstract (English)
Large language models have enabled powerful code completion systems that assist developers by predicting subsequent lines of code. However, these models remain vulnerable to backdoor attacks, where malicious fine-tuning data covertly implants unsafe behaviors. Despite advances in defensive techniques, adaptive and sophisticated backdoor attacks still evade detection and mitigation. We present CodeTracer, a forensic framework that traces malicious code completions back to the backdoor fine-tuning data responsible for them. Operating under realistic post-deployment constraints, CodeTracer relies solely on the fine-tuning corpus and the reported miscompletion event. It extracts a structured behavioral fingerprint from the compromised output, narrows the search to semantically relevant code samples, and employs LLM-based reasoning to attribute unsafe logic to specific backdoor data. Extensive evaluations across three representative vulnerability cases and ten backdoor attacks, along with sixteen competitive baselines, demonstrate that CodeTracer consistently achieves high forensic accuracy, low false identification rates, and strong robustness against adaptive attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。