Optimizing Spectral Signature in Code Backdoor Detection

Quoc Hung Le; Thanh Le-Cong; Bach Le; Bowen Xu

cs.SEOct 15, 2025

Optimizing Spectral Signature in Code Backdoor Detection

Authors: Quoc Hung Le, Thanh Le-Cong, Bach Le, Bowen Xu

Organizations: North Carolina State University, Raleigh, USA · The University of Melbourne, Melbourne, Australia

Abstract

As Large Language Models (LLMs) are increasingly integrated into software development workflows, they also become prime targets for adversarial attacks. Among these, backdoor attacks are a significant threat, allowing attackers to manipulate model outputs through hidden triggers embedded in training data. Detecting such backdoors remains a challenge, and one promising approach is the use of Spectral Signature defense methods that identify poisoned data by analyzing feature representations through eigenvectors. While some prior works have explored Spectral Signatures for backdoor detection in neural networks, recent studies suggest that these methods may not be optimally effective for code models. In this paper, we revisit the applicability of Spectral Signature-based defenses in the context of backdoor attacks on code models. We systematically evaluate their effectiveness under various attack scenarios and defense configurations, analyzing their strengths and limitations. We found that the widely used setting of Spectral Signature in code backdoor detection is often suboptimal. Hence, we explored the impact of different settings of the key factors. We discovered a new proxy metric that can more accurately estimate the actual performance of Spectral Signature without model retraining after the defense. Our findings contribute to a deeper understanding of the configurations of Spectral Signature defenses in securing code models and offer insights into potential improvements for future research.

Figures & tables

Fig. 1 : Examples of the Fixed [ 9 ] , Grammatical [ 9 ] , Adaptive triggers [ 10 ] . Changes to the original function are highlighted in yellow .

Model	Poisoning
	Rate	Fixed	Grammatical	Adaptive
Original	-	17.69
	1%	19.50	17.40	19.30
		$(p<0.001)$	$(p<0.001)$	( $p<0.001)$
Poisoned	5%	21.64	21.11	21.95
		$(p<0.001)$	$(p<0.001)$	$(p<0.001)$

TABLE I : Task Performance of Original and Poisoned Models Across Attack Methods Model on the Poisoned Dataset

Model	Poisoning Rate	Fixed	Grammatical	Adaptive
Original	-	17.69
Poisoned	1%	18.69	16.5	18.54
		$(p<0.001)$	$(p<0.001)$	$(p<0.001)$
	5%	17.39	16.86	17.72
		$(p<0.001)$	$(p<0.001)$	$(p=0.007)$
	10%	17.55	18.26	18.37

TABLE II : Performance of Original and Poisoned Models Across Attack Methods Model on the Original (i.e., clean) Dataset

Attack	Rate	Best Setting			Used Setting
		ASR-D	$\Delta$ BLEU		ASR-D	$\Delta$ BLEU
			Original	Cleaned		Original	Cleaned
Fixed	1%	0.00%	-0.21	-0.21	0.00%	-0.21	-0.21
	5%	28.07%	-0.15	0.22	98.25%	-0.18	0.17
	10%	42.11%	-0.98	-0.36	100.00%	0.09	2.40
Grammatical	1%	0.00%	0.57	0.57	0.00%	0.57	0.57

TABLE III : Comparison of ASR-D and Task Performance Differences (Original and Cleaned after Poisoned) for Best vs. Used Setting Across Different Attack Methods and Poison Rates

Poison percen- tage	1%		5%		10%
number of eigen- vector	BLEU	ASR-D	BLEU	ASR-D	BLEU	ASR-D
k $<$ 10	18.74 ±0.24	97.80% ±3.24	18.08 ±0.41	75.86% ±11.70	18.09 ±0.13	90.14% ±7.86
k $\geq$ 10	17.84 ±0.14	10.80% ±6.78	17.95 ±0.12	82.23% ±10.38	19.00 ±0.62	91.65% ±6.35

TABLE IV : Effect of different k value groups on different poison rates

Attack	Adaptive		Fixed		Grammatical
Model	BLEU	ASR-D	BLEU	ASR-D	BLEU	ASR-D
Code BERT	17.78 ±0.39	81.80% ±20.14	17.82 ±0.15	95.61% ±8.60	17.66 ±0.19	86.25% ±21.58
Code T5	18.76 ±0.39	71.11% ±28.56	18.83 ±0.42	100.00% ±0.00	18.83 ±0.38	99.64% ±0.70

TABLE V : Effect of different representation models on different attack methods

Removal percentage	BLEU	ASR-D
10%	18.40 ±0.23	78.44% ±6.73
15%	18.16 ±0.20	67.29% ±7.47

TABLE VI : Effect of different removal percentage on different attack methods

Corre- lation Type	Aspect Name	Group Name	Recall	FPR	NPV
Spearman	Removal Percentage	10%	0.449	0.141	0.703
	Removal Percentage	15%	0.122	0.085	0.811
	Model	CodeBERT	0.302	0.197	0.747
	Model	CodeT5	0.303	0.149	0.763
	Poison rate	0.01	0.863	-0.779	0.871
		0.05	-0.045	-0.268	0.569

TABLE VII : Correlation Coefficients Between ASR-D and Proxy Metrics

Optimized?	Attack method	k	ASR-D	BLEU	NPV
No	Adaptive	10	25.00%	25.01	99.9555%
Yes	Adaptive	50	12.50%	26.57	99.9557%
No	Grammatical	10	100.00%	13.20	99.9568%
Yes	Grammatical	50	50.00%	12.86	99.9568%
No	Fixed	10	100.00%	13.11	99.9076%
Yes	Fixed	50	100.00%	12.89	99.9176%

TABLE VIII : Spectral Signature using Qwen2.5-Coder against 1% backdoor attack

Criteria	Rate	CodeBERT			CodeT5
		TP	FN	FP	TP	FN	FP
Length	1%	92.39	114.21	80.13	102.25	73.67	88.50
	5%	125.70	164.22	106.93	59.44	44.14	72.67
	10%	90.75	118.07	99.98	120.11	40.60	71.77
Complexity	1%	3.45	3.50	3.53	2.81	2.14	3.18
	5%	3.43	4.61	2.96	5.00	1.50	3.50

TABLE IX : Comparison of Characteristics (Code Length, Logical Complexity, and Number of Backdoor Insertions) of True Positive (TP), False Negative (FN), and False Positive (FP) Instances Across Different Poisoning Rates

Backdoor Detection

Backdoor detection finds hidden triggers or poisoned behavior in trained models before they can secretly redirect predictions or actions.

See all 53 papers

Oct 23, 2026

Data-Efficient Backdoor Attacks on Code Models via Trigger-Neutralized Counterfactual Scoring

Pre-trained code models are exposed to backdoor poisoning, in which crafted training samples make the model misbehave on a trigger. A capable attacker minimizes the number of such samples, since each adds cost and exposure and a lower poisoning rate leaves a smaller footprint for defenses. Which samples to poison therefore matters, but existing data-efficient selection methods target image classification, offer no scoring mechanism for autoregressive generation, and have not been studied on code. We propose Trigger-Neutralized Counterfactual Scoring (TNCS), which isolates a trigger's contribution to the target behavior by comparing the scoring model's output on a triggered input with its output on a trigger-neutralized counterfactual, covering classification and generation alike. TNCS attains higher attack success rates than the baselines at very low poisoning ratios, across three CodeXGLUE tasks and five trigger families, without degrading clean-task performance, and its margin grows as the ratio decreases. It is the only method effective on every trigger family, and its selected poison set transfers to mismatched victims.

Yu-Yu Lee, Ming-Feng Tsai, Tomohiro Morikawa +1

Department of Computer Science and Engineering, National Sun Yat-sen University, Kaohsiung 804, Taiwan · Department of Computer Science and Engineering and the Security Research Center, National Sun Yat-sen University, Kaohsiung 804, Taiwan · University of Hyogo, Kobe, Japan +1

Backdoor Attacks LLM Backdoor Attacks Adversarial Attacks

Ask PDF

Jul 9, 2026

Beware What You Autocomplete: Forensic Attribution of Backdoored Code Completions

Large language models have enabled powerful code completion systems that assist developers by predicting subsequent lines of code. However, these models remain vulnerable to backdoor attacks, where malicious fine-tuning data covertly implants unsafe behaviors. Despite advances in defensive techniques, adaptive and sophisticated backdoor attacks still evade detection and mitigation. We present CodeTracer, a forensic framework that traces malicious code completions back to the backdoor fine-tuning data responsible for them. Operating under realistic post-deployment constraints, CodeTracer relies solely on the fine-tuning corpus and the reported miscompletion event. It extracts a structured behavioral fingerprint from the compromised output, narrows the search to semantically relevant code samples, and employs LLM-based reasoning to attribute unsafe logic to specific backdoor data. Extensive evaluations across three representative vulnerability cases and ten backdoor attacks, along with sixteen competitive baselines, demonstrate that CodeTracer consistently achieves high forensic accuracy, low false identification rates, and strong robustness against adaptive attacks.

Anjun Gao, Yueyang Quan, Zhuqing Liu +1

University of Louisville · University of North Texas

LLM Backdoor Attacks Backdoor Detection Code Language Models

Ask PDF

May 15, 2026

EntropyScan: Towards Model-level Backdoor Detection in LVLMs via Visual Attention Entropy

Large Vision-Language Models (LVLMs) have demonstrated remarkable capabilities across various tasks, yet they remain vulnerable to backdoor attacks. Existing defense methods predominantly focus on sample-level defense, which relies on the knowledge of training data or triggers. However, identifying whether a given model is backdoored remains a critical but unexplored task. To fill this gap, we propose EntropyScan, a lightweight and trigger-agnostic method for model-level backdoor detection in LVLMs. We first observe that backdoor injection disrupts the cross-modal alignment, resulting in pronounced structural anomalies in visual attention allocation on benign samples. Based on this insight, EntropyScan detects the backdoor models by quantifying such attention deviations. Specifically, it extracts visual attention distributions from the initial layers of the Large Language Model (LLM) and applies Tsallis entropy to capture these structural distortions. By employing a reference-anchored Z-score normalization on a small set of benign samples, it effectively identifies the backdoored model. Extensive experiments across two LVLMs architectures and three advanced attack scenarios show that EntropyScan achieves an F1 score of 98.5% in average and an AUC of 96.6%. Our code will be publicly available soon.

Xuanyu Ge, Zhongqi Wang, Jie Zhang +2

China University of Geosciences · University of the Chinese Academy of Sciences · Institute of Computing Technology, Chinese Academy of Sciences

Large Vision-Language Models Backdoor Detection Backdoor Attacks on VLMs Attention Entropy

Ask PDF

Abstract

Backdoor Detection

Explore similar work

Data-Efficient Backdoor Attacks on Code Models via Trigger-Neutralized Counterfactual Scoring

Beware What You Autocomplete: Forensic Attribution of Backdoored Code Completions

EntropyScan: Towards Model-level Backdoor Detection in LVLMs via Visual Attention Entropy