Pith. sign in

REVIEW 5 major objections 3 minor 60 references

Breaking Customized LLMs for Coding: Automated Red Teaming for Instruction Backdoor Attacks

T0 review · 5 major / 3 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read An automated red-teaming loop crafts covert instruction backdoors for customized coding LLMs, reaching a 0.945 attack success rate while evading detection.

desk verdict Solid attack-framework paper with a real circularity concern in the stealthiness evaluation; the attack effectiveness and utility results are credible and worth a serious referee. read the letter →

arxiv 2608.05659 v1 pith:4KME2CZK submitted 2026-08-06 cs.CR

Yuchen Chen , Wei Cheng , Yuan Xiao , Wising Sun , Chunrong Fang , Yang Liu , Zhenyu Chen , Baowen Xu This is my paper · ORCID
classification cs.CR
keywords instructionbackdoorattackscustomizedLLMsautomatedredteamingcodeintelligenceLLMsecuritysystempromptstealth
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Customized LLMs are built by embedding instructions into system prompts, and this paper argues that those instructions can be silently weaponized without any manual prompt engineering. ARIA, the proposed framework, uses one LLM as an attacker that repeatedly rewrites a backdoored instruction while the target LLM judges each candidate along three axes: stealthiness, preserved clean-task performance, and trigger success. The paper reports attack success rates up to 0.945 (code comment generation) and 0.887 (code generation), clean-task utility close to or above a benign baseline, and evasion of platform-side and user-side audits in up to 100% of runs. If these results hold, instruction-based customization platforms face a scalable attack that requires only a high-level adversary goal and a small validation set to reproduce on new tasks.

What carries the argument

The load-bearing mechanism is the multi-role evaluation loop with explicit thresholds: the target LLM is simultaneously a security auditor, a clean-task prober, and a backdoor prober, and its own responses become the optimization signal for the attacker LLM. Stealthiness is enforced by requiring the security-auditor role to return no risk in all repeated probes ($\theta_s = 1.0$), backdoor effectiveness by requiring at least 80% trigger success ($\theta_b = 0.8$), and clean utility by requiring the candidate to match the performance of a benign instruction. This design converts stealth from a manual stylistic constraint into a measurable objective, and it enables automated transfer to new tasks or programming languages because the only task-specific input is the high-level adversary goal.

What would settle it

Have an independent auditor that is not the target model, such as a different LLM with a stricter audit prompt or a human reviewer, score the same ARIA-generated instructions and compare its false-negative rate with the self-audit's rate; if the independent auditor flags most of those instructions, the stealthiness claim collapses. As a second check, deploy a backdoored instruction on a public customization platform and run trigger-free inputs; if the target output appears on clean inputs more often than the reported FPR bounds, the clean-task utility claim fails.

Watch

Extended reading notes

Core claim

The central claim is that instruction backdoors in customized coding LLMs can be generated automatically, made covert, and kept effective by closing the loop between an attacker LLM and the target LLM. ARIA decomposes the adversary's goal into a clean task, a trigger condition, and a backdoor target, then iteratively proposes candidate instructions and triggers. Each candidate is probed by the target model in three roles: a security auditor checks whether the instruction looks malicious, a clean-task prober checks whether normal performance degrades, and a backdoor prober checks whether triggered inputs produce the target behavior. A judger converts the responses into three scores and returns structured feedback to the attacker, and the loop stops when all thresholds are met. The paper's experiments show this loop matching or beating manually crafted baselines in attack success on most tasks, exceeding them in stealth, and preserving clean-task utility across three code tasks and four target models.

Load-bearing premise

The load-bearing assumption is that an instruction which passes the target model's own security-auditor role will also pass independent platform-side and user-side inspection at deployment, even though deployment auditors may be different models or more sensitive prompts.

Editorial extensions

If this is right

  • If a single high-level goal suffices, the marginal cost of attacking a new coding task collapses to writing one paragraph; the same loop then produces the concrete trigger and instruction automatically.
  • Because ARIA's triggers are natural code patterns rather than isolated anomalous tokens, token-anomaly detectors such as ONION tend to miss them, so instruction-level backdoors require behavioral or differential auditing.
  • The framework stays effective against three existing defenses, with attack success rates often still above 0.5 even after the defense runs, so current audit pipelines give only partial protection.
  • The same closed-loop design transfers across programming languages and sampling temperatures, meaning the attack is not tuned to one syntax or configuration.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An implication the authors leave implicit: if self-audit transferability is the mechanism, then instruction-customization platforms face a capability race, because a stronger target model is both better at hiding malicious instructions and better at catching them, and the paper's results suggest catching is harder.
  • The paper's future-work suggestion of condition-aware differential auditing can be turned into a direct test: extract the conditional rule from a generated instruction, run paired probes with and without the condition, and flag any instruction whose conditional presence flips behavior toward unsafe outputs.
  • Because the loop is task-agnostic, a testable extension is to run ARIA on non-code customized assistants and compare attack success and evasion rates; the framework should transfer if the measured effects are driven by instruction-level optimization rather than code-specific patterns.
  • The efficiency results hint at a failure mode the paper does not foreground: when the security auditor is less sensitive, the loop terminates early on instructions with weak test-time success, so the reported evasion ceiling may be a property of using the target as its own judge rather than of the instructions themselves.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 3 minor

Summary. The paper proposes ARIA, an automated red-teaming framework that generates covert instruction backdoor attacks against customized LLMs used for code intelligence tasks. ARIA uses an attacker LLM to iteratively generate and refine backdoored system instructions, guided by feedback from the target LLM acting as a security auditor, clean-task prober, and backdoor prober. The authors evaluate ARIA on three code intelligence tasks across four LLMs, comparing with three baseline attacks and three defenses, and report high attack success rates (up to 0.945), preserved clean-task utility, stealthiness with false negative rates up to 1.000, robustness across temperatures and programming languages, and effectiveness against existing defenses.

Significance. If the results hold, ARIA is a meaningful contribution: it is, to my knowledge, the first automated framework for instruction backdoor attacks specifically targeting coding-oriented customized LLMs, and it addresses a real gap left by manual template-based attacks. The evaluation is broad in coverage (four target LLMs, three tasks, multiple languages, temperatures, baselines, and defenses), and the paper includes ablations, parameter studies, and an efficiency analysis. The artifact is promised for public release, which supports reproducibility. The central risk is that the stealthiness claims rely on auditors that are the same model (or same model family) used in the optimization loop, so the headline FNR values may reflect overfitting to a particular auditor rather than general covertness; this needs a non-circular evaluation before the main claims can be accepted.

major comments (5)
  1. [§5.3, Algorithm 1 lines 8–11; §7.2 Table 5; §4] The stealthiness evaluation is circular with the optimization objective. The in-loop security auditor T_s is the target LLM itself, and the loop terminates only when this auditor returns no-risk in all r=5 probes (S_s ≥ θ_s = 1.0, §6.5). The platform-side detection in Table 5 uses GPT-5.4 with a similar security-auditing prompt, and the user-side detection prompts the customized target model to self-audit using the prompt in §4. For target GPT-5.4 the platform auditor is exactly the model optimized against; for all targets the user-side auditor is the optimized model itself. Consequently, high FNR values such as 1.000 demonstrate that ARIA can overfit to the auditor's inductive biases, not that it is covert under independent inspection. The paper's own §7.3 observation that Mistral-Large's less-sensitive auditor terminates on instructions with weak test-time ASR shows that auditor sensitivity is decisive. Please add a held-out evaluation with auditor models never used in the optimization loop, ideally several model families and a non-LLM detector, and report transfer FNR separately for platform-side and user-side settings; the user-side setting should use an independent auditor rather than the target model's self-report.
  2. [§6.5, Tables 2–5] The main quantitative claims rest on single-run measurements at temperature 0 with no variance estimates. Section 6.5 sets temperature to 0 for both attacker and target, and Tables 2 and 5 report one number per condition; the r=5 repetitions are used inside the optimization loop, not for evaluation. Without multiple independent optimization runs or bootstrap intervals, differences such as ASR 0.927 vs. 0.972 (Table 2, vulnerability detection) and FNR 0.6 vs. 0.8 (Table 5) may be within noise. Please report variance or results over several seeds for the headline ASR, utility, and FNR numbers. Table 3's temperature sweep is informative but does not replace run-to-run variability at fixed temperature.
  3. [§6.3, Table 2] The baseline comparison may be unfair because ARIA receives an optimization budget to search over both triggers and instruction phrasings, while the baselines use a fixed trigger (testo_init) and pre-existing instructions. The claimed superiority in attack effectiveness could therefore reflect the additional search budget rather than the multi-role feedback mechanism. Please add an ablation that runs ARIA with a fixed trigger, or give the baselines a comparable trigger-search/refinement budget, and clarify what the comparison isolates.
  4. [§7.1, Table 4] The cross-language code comment generation evaluation is under-specified. The trigger for code comment generation is defined as “the code imports Flask” in Section 6.1, but Table 4 reports code comment generation results on CWEval's non-Python subset (C++, C, JavaScript, Go), where a Flask import cannot occur. The paper does not explain how the trigger condition and target behavior are realized in these languages, yet reports ASRs up to 1.000. Please specify the per-language trigger and target adaptation; without this, these numbers cannot be interpreted and the generalizability claim is not supported.
  5. [§7.2, Table 6; §6.4] The defense evaluation inherits the same auditor-model circularity and is reported only for GPT-5.4. CoS and PeerGuard are implemented as “the same auditor model” (Section 6.4), so the defense auditor is the same model against which the instruction was optimized. This conflates evasion of the in-loop auditor with evasion of an independent defense. Please evaluate the defenses with auditor models not used in ARIA's optimization, and report results for at least one additional target LLM. Also clarify whether Table 6's FNR/FPR columns refer to detection false negatives/positives or to trigger-free attack FPR, since Section 6.6 defines FPR differently.
minor comments (3)
  1. [§6.6 vs. Table 5] Section 6.6 defines FPR as the proportion of clean inputs on which the backdoored model produces the target output, but Table 5's FPR values appear to be detection FPRs (the proportion of clean instructions flagged as backdoored), as in Table 1. Please use distinct names (e.g., detection FPR vs. attack FPR) and report both where relevant.
  2. [Table 5, Benign rows] Reporting an FNR for benign instructions is conceptually odd, since FNR is defined over backdoored instructions only; consider reporting only FPR for the Benign rows or adding an explicit note that FNR is vacuously 1.0.
  3. [§7.1, Table 2] The statement that ARIA achieves the highest attack success rate on code comment generation and code generation should note that it ties with InstructionAttack at 0.945 on code comment generation, and that on vulnerability detection InstructionAttack achieves a higher ASR (0.972 vs. 0.927).

Circularity Check

2 steps flagged · score 4.0 of 10

ARIA's stealthiness evaluation is partly circular: the user-side detector is the same target LLM that the optimizer was required to fool, so the reported FNR is the optimization objective rather than independent detection (and platform-side detection for GPT-5.4 targets is self-audit).

  1. fitted input called prediction [Section 4 (User-side Detection), Section 5.3 (Security Auditor), Algorithm 1 lines 8-11, Section 6.5, Section 7.2 Table 5]
    "For user-side detection, we deploy the instructions from each attack as custom GPTs and prompt the deployed model to identify potential backdoor behaviors through black-box behavioral self-auditing. ... The security auditor T_s is initialized with a security-auditing system prompt P_s (line 3) ... The high FNR of ARIA is attributable to the stealthiness feedback provided by the security auditor role T_s, which explicitly guides the attacker LLM A to refine the backdoored instruction to evade detection."

    ARIA's optimization loop (Algorithm 1 lines 8-11) requires the target LLM T, acting as security auditor T_s, to label the candidate instruction as no-risk with S_s >= theta_s = 1.0. The user-side detection in Section 4 is the same deployed target model asked to self-audit for hidden backdoor behavior. A candidate that passed the optimization already satisfied the same model's security judgment, so the reported user-side FNR (0.600-1.000 in Table 5) largely measures the optimizer's convergence criterion rather than transfer to an independent or held-out detector.

  2. fitted input called prediction [Section 4 (Platform-side Detection), Section 6.2 (Target LLMs), Section 7.2 Table 5]
    "For platform-side detection, we use GPT-5.4 [32] as the auditor and evaluate each backdoored instruction and its clean instruction using the following structured security-auditing prompt: ... We select four representative LLMs for evaluation: Mistral-Large, GPT-5.4, Gemini-3 and Claude-Sonnet. We treat them as the backend models of backdoored customized LLMs in our study."

    GPT-5.4 is both one of the four target LLMs and the platform-side auditor. For the GPT-5.4 target rows in Table 5, the platform-side FNR is produced by the same model that served as the in-loop security auditor T_s during ARIA's optimization, under a similar instruction-security-auditing prompt (Section 5.3 and the Section 4 platform-side prompt). For those rows the reported evasion is therefore partly a restatement of the optimization's termination condition. This reduction does not apply to the Mistral-Large, Gemini-3, or Claude-Sonnet targets, for which GPT-5.4 is a genuinely separate auditor, so the platform-side claim has independent support for those models; the circularity is limited to the GPT-5.4 rows.

full rationale

The attack-effectiveness, clean-task-utility, cross-language, temperature-robustness, and defense (ONION/CoS/PeerGuard) results are not circular: they are measured on task datasets (SALLM, CWEval, GitHub-collected samples) or against external defense pipelines whose logic is not the optimization objective, so the central ASR and utility claims stand on independent evidence. The circularity is confined to the stealthiness evaluation. The user-side detection protocol reuses the exact target LLM that ARIA was optimized to fool in the security-auditor role, so the FNR numbers in Table 5 for user-side detection are the optimization objective restated as a detection result rather than a held-out test. For GPT-5.4 targets, the platform-side detection is also self-audit because GPT-5.4 is both the target and the auditor. Because independent platform-side auditing exists for the other three target models and independent defenses partially confirm stealthiness, the overall circularity is partial rather than total: some central evidence is independent, but the headline 'false negative rate of up to 1.000' is not backed by a non-circular user-side test. No load-bearing self-citation or imported-uniqueness issue was found; self-citations [4,5,44] are related-work context only.

Assumptions & free parameters 7 free parameters · 6 assumptions · 0 invented entities

The central claims rest on several hand-chosen optimization thresholds and on the assumption that the target LLM's self-audit is a valid proxy for real-world detection. No physical entities or new conserved quantities are postulated; the framework is purely computational. The thresholds are not fitted to the final test sets, but they do shape the reported results, and the clean-task utility threshold is defined relative to the benign baseline, which the paper then compares against.

free parameters (7)
  • Stealthiness threshold theta_s = 1.0
    Hand-chosen threshold requiring the backdoored instruction to fully evade the target-as-auditor during optimization (Section 6.5).
  • Backdoor effectiveness threshold theta_b = 0.8
    Hand-chosen minimum trigger success rate required to terminate optimization (Section 6.5).
  • Clean-task utility threshold theta_c = benign instruction performance on D_c
    Set to match the measured performance of a clean instruction on the same 20-sample validation set; used as the utility bar during optimization (Section 6.5).
  • Probing repetitions r = 5
    Number of repeated probes per candidate instruction to mitigate LLM output randomness (Section 6.5).
  • Maximum iterations n = 20
    Chosen after a sensitivity experiment showing ASR plateaus beyond n=20 (Section 7.5, Figure 3).
  • Context window k = 3
    Number of recent interaction rounds kept in attacker history, following Chao et al. (Section 6.5).
  • Evaluation temperature = 0.0
    Set to zero for both attacker and target during evaluation to reduce output randomness (Section 6.5); affects all reported numeric results.
assumptions (6)
  • domain assumption The target LLM with a security-auditing system prompt is a faithful proxy for platform-side and user-side backdoor detection.
    Used in Algorithm 1 lines 8-11 (Section 5.3); if false, the stealthiness optimization may not transfer to real deployment inspection.
  • domain assumption LLM outputs at temperature 0 are deterministic and repeatable.
    Section 6.5 relies on this to report single-run ASR and ACC values without error bars; real API sampling can still be stochastic.
  • domain assumption The 20-sample clean-task validation set represents the full test distribution.
    Used to set theta_c and to guide instruction refinement (Section 6.5); a small unrepresentative set could distort utility comparisons.
  • domain assumption The LLM-as-judge (GPT-5.2) consistently scores comment quality.
    QS values in Table 2 depend on this judge (Section 6.6); judge bias would affect the clean-task utility claim.
  • domain assumption The regular expressions for CWE-79 and CWE-89 correctly identify the target vulnerable code patterns.
    ASR for code generation is measured by regex matching (Section 6.6); narrow or inaccurate patterns would misestimate attack success.
  • domain assumption The attacker can query the target LLM in a black-box manner without being blocked or detected.
    Assumed in the threat model (Section 3); if the platform rate-limits or audits repeated API queries, the iterative optimization becomes impractical.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Breaking Customized LLMs for Coding: Automated Red Teaming for Instruction Backdoor Attacks." pith.science (2026). https://pith.science/paper/4KME2CZK

@misc{pith2026260805659,
  author       = {Pith},
  title        = {Pith review of: Breaking Customized LLMs for Coding: Automated Red Teaming for Instruction Backdoor Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4KME2CZK}},
  note         = {Machine review of arXiv:2608.05659}
}
read the original abstract

LLM customization platforms allow users to build task-specific models for code intelligence tasks by embedding instructions into system prompts, without modifying the underlying model parameters. While these platforms lower the barrier to developing customized LLMs, they also introduce a new attack surface: instruction backdoor attacks, in which adversaries implant hidden malicious behaviors into customized instructions. However, existing attacks suffer from two key limitations. First, they often rely on explicit trigger patterns readily detected by platform-side or user-side inspection. Second, they require substantial manual effort to craft task-specific backdoored instructions, limiting their scalability. In this paper, we propose ARIA, an automated red-teaming framework for crafting covert and effective backdoored instructions against customized LLMs. ARIA leverages an attacker LLM to iteratively generate and refine backdoored instructions, guided by structured feedback from the target LLM along three dimensions: stealthiness, clean-task utility, and backdoor effectiveness. We evaluate ARIA on three code intelligence tasks, using four representative LLMs, and compare it with three baseline attacks. Experimental results show that ARIA achieves the highest attack success rate of 0.945, while maintaining the best clean-task utility across all tasks. ARIA also generalizes well across programming languages and remains robust to generation temperature. Furthermore, ARIA significantly outperforms existing attacks in evading platform-side and user-side detection, achieving a false negative rate of up to 1.000, and stays effective against existing defense methods, demonstrating its strong generalizability and robustness.

Figures

Figures reproduced from arXiv: 2608.05659 by the authors.

Figure 1
Figure 1. Overview of ARIA. Algorithm 1 Automated Red Teaming for Instruction Attacks Input: 𝐺 adversary goal 𝐴, 𝑇 attacker LLM, target LLM P𝑎 red-teaming system prompt for attacker P𝑠 security-auditing system prompt for security auditor D𝑐 clean-task validation set 𝑛, 𝑘, 𝑟 max iterations, context window, probing repetitions 𝜃𝑠 stealthiness score threshold 𝜃𝑏 backdoor effectiveness score threshold 𝜃𝑐 clean-task utility score … view at source ↗
Figure 2
Figure 2. An example of ARIA optimizing a backdoored in￾struction for the code generation task. does not contain any security risks.” This example demonstrates ARIA’s ability to iteratively refine backdoored instructions to evade security auditing while preserving the intended backdoor behavior. 6 Experimental Setup In this paper, we study the following research questions: RQ1. How effective is ARIA for instruction backdoor a… view at source ↗
Figure 3
Figure 3. Effect of the maximum number of iterations [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

60 extracted references · 43 canonical work pages

  1. [1]

    Hojjat Aghakhani, Wei Dai, Andre Manoel, Xavier Fernandes, Anant Kharkar, Christopher Kruegel, Giovanni Vigna, David Evans, Ben Zorn, and Robert Sim

    work page

  2. [2]

    Anthropic. 2026. Claude Sonnet 4.6. site: https://www.anthropic.com/claude/ sonnet. Accessed: 2025-12 to 2026-03

    work page 2026

  3. [3]

    Pappas, and Eric Wong

    Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. 2025. Jailbreaking Black Box Large Language Models in Twenty Queries. InIEEE Conference on Secure and Trustworthy Machine Learning. IEEE, Copenhagen, Denmark, 23–42

    work page 2025

  4. [4]

    Yuchen Chen, Weisong Sun, Chunrong Fang, Zhenpeng Chen, Yifei Ge, Tingxu Han, Quanjun Zhang, Yang Liu, Zhenyu Chen, and Baowen Xu. 2025. Security of Language Models for Code: A Systematic Literature Review.ACM Trans. Softw. Eng. Methodol.(2025). Just Accepted. doi:10.1145/3735554

    doi:10.1145/3735554 2025

  5. [5]

    Yuchen Chen, Weisong Sun, Chunrong Fang, Quanjun Zhang, Zhenyu Chen, and Xiangyu Zhang. 2025. Hidden Backdoor Attack against Neural Code Search Models.ACM Trans. Softw. Eng. Methodol.(2025). Just Accepted. doi:10.1145/ 3774421

    work page 2025

  6. [6]

    Shih-Chieh Dai, Jun Xu, and Guanhong Tao. 2025. A Comprehensive Study of LLM Secure Code Generation.arXivabs/2503.15554 (2025)

    arXiv 2025

  7. [7]

    Yihong Dong, Xue Jiang, Jiaru Qian, Tian Wang, Kechi Zhang, Zhi Jin, and Ge Li. 2025. A Survey on Code Generation with LLM-based Agents.arXiv abs/2508.00083 (2025)

    arXiv 2025

  8. [8]

    Falong Fan and Xi Li. 2025. PeerGuard: Defending Multi-Agent Systems Against Backdoor Attacks Through Mutual Reasoning. In2025 IEEE International Confer- ence on Information Reuse and Integration and Data Science (IRI). IEEE, 234–239. doi:10.1109/IRI66576.2025.00051

    arXiv 2025

Show all 60 references
  1. [9]

    Deep Ganguli, Liane Lovitt, Jackson Kernion, Amanda Askell, Yuntao Bai, Saurav Kadavath, Ben Mann, Ethan Perez, Nicholas Schiefer, Kamal Ndousse, Andy Jones, Sam Bowman, Anna Chen, Tom Conerly, Nova DasSarma, Dawn Drain, Nelson Elhage, Sheer El Showk, Stanislav Fort, Zac Hatfi...

    2022 arXiv

  2. [10]

    GitHub Inc. 2025. CodeQL: Code Analysis Engine. site: https://codeql.github.com/. Accessed: 2026-03

    2025

  3. [11]

    Google DeepMind. 2024. Gemini Gems. site: https://gemini.google/overview/ gems/. Accessed: 2026-03

    2024

  4. [12]

    Google DeepMind. 2026. Gemini 3 Developer Guide. site: https://ai.google.dev/ gemini-api/docs/gemini-3. Accessed: 2025-12 to 2026-03

    2026

  5. [13]

    Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. BadNets: Iden- tifying Vulnerabilities in the Machine Learning Model Supply Chain.arXiv abs/1708.06733 (2017)

    2017 arXiv

  6. [14]

    Zhen Guo and Reza Tourani. 2025. DarkMind: Latent Chain-of-Thought Backdoor in Customized LLMs.arXivabs/2501.18617 (2025)

    2025

  7. [15]

    Juyong Jiang, Fan Wang, Jiasi Shen, Sungju Kim, and Sunghun Kim. 2024. A Survey on Large Language Models for Code Generation.arXivabs/2406.00515 (2024)

    2024 arXiv

  8. [16]

    Yuan Jiang, Yujian Zhang, Xiaohong Su, Christoph Treude, and Tiantian Wang

  9. [17]

    Sabrina Kaniewski, Fabian Schmidt, Markus Enzweiler, Michael Menth, and Tobias Heer. 2025. A Systematic Literature Review on Detecting Software Vul- nerabilities with Large Language Models.arXivabs/2507.22659 (2025)

    2025

  10. [18]

    Software Eng.50, 12 (2024), 3454–3471

    StagedVulBERT: Multigranular Vulnerability Detection With a Novel Pretrained Code Model.IEEE Trans. Software Eng.50, 12 (2024), 3454–3471

    2024

  11. [19]

    Jia Li, Zhuo Li, Huangzhao Zhang, Ge Li, Zhi Jin, Xing Hu, and Xin Xia. 2024. Poison Attack and Poison Detection on Deep Source Code Processing Models. ACM Trans. Softw. Eng. Methodol.33, 3 (2024), 62:1–62:31

    2024

  12. [20]

    Woosuk Kwon, Zhuohan Li, Siyuan Zhuang, Ying Sheng, Lianmin Zheng, Cody Hao Yu, Joseph Gonzalez, Hao Zhang, and Ion Stoica. 2023. Efficient Memory Management for Large Language Model Serving with PagedAttention. InProceedings of the 29th Symposium on Operating Systems Principl...

    2023

  13. [21]

    Xi Li, Ruofan Mao, Yusen Zhang, Renze Lou, Chen Wu, and Jiaqi Wang. 2025. Chain-of-Scrutiny: Detecting Backdoor Attacks for Large Language Models. In Findings of the Association for Computational Linguistics: ACL 2025. Association for Computational Linguistics, Vienna, Austria...

    2025 doi

  14. [22]

    Jia Li, Chongyang Tao, Jia Li Male, Ge Li, Zhi Jin, Huangzhao Zhang, Zheng Fang, and Fang Liu. 2025. Large Language Model-Aware In-Context Learning for Code Generation.ACM Trans. Softw. Eng. Methodol.34, 7 (2025), 190:1–190:33

    2025

  15. [23]

    Yanzhou Li, Shangqing Liu, Kangjie Chen, Xiaofei Xie, Tianwei Zhang, and Yang Liu. 2023. Multi-target Backdoor Attacks for Code Pre-trained Models. InProceedings of the 61st Annual Meeting of the Association for Computational Linguistics. Association for Computational Linguist...

    2023

  16. [24]

    Yige Li, Zhe Li, Wei Zhao, Nay Myat Min, Hanxun Huang, Xingjun Ma, and Jun Sun. 2025. AutoBackdoor: Automating Backdoor Attacks via LLM Agents.arXiv abs/2511.16709 (2025)

    2025

  17. [25]

    Vladimir Makharev and Vladimir Ivanov. 2025. Code Summarization Beyond Function Level. InIEEE/ACM International Workshop on Large Language Models for Code. IEEE, Ottawa, ON, Canada, 153–160

    2025

  18. [26]

    Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. 2018. Trojaning Attack on Neural Networks. InProceedings of the 25th Annual Network and Distributed System Security Symposium. The Internet Society, San Diego, California, USA

    2018

  19. [27]

    Mistral AI. 2025. Mistral Large 3. site: https://docs.mistral.ai/models/mistral- large-3-25-12. Accessed: 2025-12 to 2026-03

    2025

  20. [28]

    Mistral AI. 2025. Mistral Agents. site: https://docs.mistral.ai/agents/agents. Accessed: 2026-03

    2025

  21. [29]

    OpenAI. 2023. ChatGPT GPTs. site: https://openai.com/blog/introducing-gpts. Accessed: 2026-03

    2023

  22. [30]

    MITRE. 2025. Common Weakness Enumeration. site: https://cwe.mitre.org/. Accessed: 2026-03

    2025

  23. [31]

    OpenAI. 2024. OpenAI Usage Policies. site: https://openai.com/policies/usage- policies. Accessed: 2026-03

    2024

  24. [32]

    OpenAI. 2024. GPTs Data Privacy FAQ. site: https://help.openai.com/en/articles/ 8554402-gpts-data-privacy-faq. Accessed: 2026-03

    2024

  25. [33]

    Originality.ai. 2024. GPTs Statistics: Insights from the GPT Store. site: https: //originality.ai/blog/gpt-store-statistics. Accessed: 2026-03

    2024

  26. [34]

    OpenAI. 2026. GPT-5.4. site: https://developers.openai.com/api/docs/models/gpt- 5.4. Accessed: 2025-12 to 2026-03

    2026

  27. [35]

    Jinjun Peng, Leyi Cui, Kele Huang, Junfeng Yang, and Baishakhi Ray. 2025. CW- Eval: Outcome-driven Evaluation on Functionality and Security of LLM Code Generation. arXiv:2501.08200 [cs.SE] https://arxiv.org/abs/2501.08200

    2025 arXiv

  28. [36]

    Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll L. Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul F. Christiano, Jan Leik...

    2022

  29. [37]

    Fanchao Qi, Yangyi Chen, Mukai Li, Yuan Yao, Zhiyuan Liu, and Maosong Sun

  30. [38]

    Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving

    Ethan Perez, Saffron Huang, H. Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. 2022. Red Teaming Language Models with Language Models. InProceedings of the 2022 Conference on Empirical Methods in Natural Language Processi...

    2022

  31. [39]

    Markosyan, Manish Bhatt, Yuning Mao, Minqi Jiang, Jack Parker-Holder, Jakob N

    Mikayel Samvelyan, Sharath Chandra Raparthy, Andrei Lupu, Eric Hambro, Aram H. Markosyan, Manish Bhatt, Yuning Mao, Minqi Jiang, Jack Parker-Holder, Jakob N. Foerster, Tim Rocktäschel, and Roberta Raileanu. 2024. Rainbow Team- ing: Open-Ended Generation of Diverse Adversarial ...

    2024

  32. [40]

    Mohammed Latif Siddiq, Joanna Cecilia da Silva Santos, Sajith Devareddy, and Anna Muller. 2024. SALLM: Security Assessment of Generated Code. InPro- ceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops. ACM, Sacramento, CA, USA, 54–65

    2024

  33. [41]

    Goutham Ramakrishnan and Aws Albarghouthi. 2022. Backdoors in Neural Models of Source Code. InProceedings of the 26th International Conference on Pattern Recognition. IEEE, Montreal, QC, Canada, 2892–2899

    2022

  34. [42]

    Stack Exchange Inc. 2025. Stack Overflow. site: https://stackoverflow.com/. Accessed: 2026-03

    2025

  35. [43]

    Tianxiang Sun, Yunfan Shao, Hong Qian, Xuanjing Huang, and Xipeng Qiu. 2022. Black-Box Tuning for Language-Model-as-a-Service. InProceedings of the 39th International Conference on Machine Learning (Proceedings of Machine Learning Research, Vol. 162). PMLR, Baltimore, Maryland...

    2022

  36. [44]

    SonarSource SA. 2025. SonarSource Rules for Code Quality and Security. site: https://rules.sonarsource.com/. Accessed: 2026-03

    2025

  37. [45]

    Weisong Sun, Yun Miao, Yuekang Li, Hongyu Zhang, Chunrong Fang, Yi Liu, Gelei Deng, Yang Liu, and Zhenyu Chen. 2024. Source Code Summarization in the Era of Large Language Models. InProceedings of the 46th IEEE/ACM International Conference on Software Engineering. Lisbon, Port...

    2024

  38. [46]

    The MITRE Corporation. 2025. 2025 CWE Top 25 Most Dangerous Software Weaknesses. site: https://cwe.mitre.org/top25/archive/2025/2025_cwe_top25. html. Accessed: 2026-03

    2025

  39. [47]

    Weisong Sun, Yuchen Chen, Guanhong Tao, Chunrong Fang, Xiangyu Zhang, Quanjun Zhang, and Bin Luo. 2023. Backdooring Neural Code Search. InProceed- ings of the 61st Annual Meeting of the Association for Computational Linguistics. Association for Computational Linguistics, Toron...

    2023

  40. [48]

    Zhao, Kelvin Guu, Adams Wei Yu, Brian Lester, Nan Du, Andrew M

    Jason Wei, Maarten Bosma, Vincent Y. Zhao, Kelvin Guu, Adams Wei Yu, Brian Lester, Nan Du, Andrew M. Dai, and Quoc V. Le. 2022. Finetuned Language Models are Zero-Shot Learners. InProceedings of the Tenth International Conference on Learning Representations. OpenReview.net, Vi...

    2022

  41. [49]

    Nevan Wichers, Carson Denison, and Ahmad Beirami. 2024. Gradient-Based Language Model Red Teaming. InProceedings of the 18th Conference of the Eu- ropean Chapter of the Association for Computational Linguistics. Association for Computational Linguistics, St. Julian’s, Malta, 2862–2881

    2024

  42. [50]

    Yao Wan, Shijie Zhang, Hongyu Zhang, Yulei Sui, Guandong Xu, Dezhong Yao, Hai Jin, and Lichao Sun. 2022. You see what I want you to see: poisoning vul- nerabilities in neural code search. InProceedings of the 30th ACM Joint European Software Engineering Conference and Symposiu...

    2022

  43. [51]

    Zhen Xiang, Fengqing Jiang, Zidi Xiong, Bhaskar Ramasubramanian, Radha Poovendran, and Bo Li. 2024. BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models. InThe Twelfth International Conference on Learning Representations. OpenReview.net, Vienna, Austria

    2024

  44. [52]

    Wenkai Yang, Yankai Lin, Peng Li, Jie Zhou, and Xu Sun. 2021. Rethinking Stealthiness of Backdoor Attack against NLP Models. InProceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Languag...

    2021

  45. [53]

    Ratnadira Widyasari, Martin Weyssow, Ivana Clairine Irsan, Han Wei Ang, Frank Liauw, Eng Lieh Ouh, Lwin Khin Shar, Hong Jin Kang, and David Lo. 2025. Let the Trial Begin: A Mock-Court Approach to Vulnerability Detection using LLM-Based Agents.arXivabs/2505.10961 (2025)

    2025

  46. [54]

    Jiahao Yu, Xingwei Lin, Zheng Yu, and Xinyu Xing. 2023. GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts.arXiv abs/2309.10253 (2023)

    2023 arXiv

  47. [55]

    Yuchen Chen, Wei Cheng and others. 2026. ARIA. site: https://doi.org/10.5281/ zenodo.21770429

    2026

  48. [56]

    Zhang, Hong Jin Kang, Jieke Shi, Junda He, and David Lo

    Zhou Yang, Bowen Xu, Jie M. Zhang, Hong Jin Kang, Jieke Shi, Junda He, and David Lo. 2024. Stealthy Backdoor Attack for Code Models.IEEE Trans. Software Eng.50, 4 (2024), 721–741

    2024

  49. [57]

    Shengyu Zhang, Linfeng Dong, Xiaoya Li, Sen Zhang, Xiaofei Sun, Shuhe Wang, Jiwei Li, Runyi Hu, Tianwei Zhang, Fei Wu, and Guoyin Wang. 2023. Instruction Tuning for Large Language Models: A Survey.arXivabs/2308.10792 (2023)

    2023

  50. [59]

    Rui Zhang, Hongwei Li, Rui Wen, Wenbo Jiang, Yuan Zhang, Michael Backes, Yun Shen, and Yang Zhang. 2024. Instruction Backdoor Attacks Against Customized LLMs. InProceedings of the 33rd USENIX Security Symposium. USENIX Association, Philadelphia, PA, USA

    2024

  51. [2021]

    InProceedings of the 2021 Conference on Empirical Methods in Natural Language Processing

    ONION: A Simple and Effective Defense Against Textual Backdoor Attacks. InProceedings of the 2021 Conference on Empirical Methods in Natural Language Processing. Association for Computational Linguistics, Online and Punta Cana, Dominican Republic, 9558–9566

    2021

  52. [2024]

    InIEEE Sym- posium on Security and Privacy

    TrojanPuzzle: Covertly Poisoning Code-Suggestion Models. InIEEE Sym- posium on Security and Privacy. IEEE, San Francisco, CA, USA, 1122–1140

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.