Pith. sign in

REVIEW 5 major objections 5 minor 2 cited by

SABER: Model-agnostic Backdoor Attack on Chain-of-Thought in Neural Code Generation

T0 review · 5 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper introduces SABER, a data-poisoning attack that plants a backdoor in chain-of-thought reasoning models so that downstream code generators emit semantically wrong code when the user's prompt contains a single emphasized trigger…

desk verdict A genuinely new attack surface—poisoning a CoT generator to steer black-box code models—but the headline ASR rests on a tiny undisclosed denominator and an untested deployment premise. read the letter →

arxiv 2412.05829 v2 pith:AMMS3LR3 submitted 2024-12-08 cs.SE

Naizhu Jin , Zhong Li , Yinggang Guo , Chao Su , Tian Zhang , Qingkai Zeng This is my paper · ORCID
classification cs.SE
keywords backdoorattackchain-of-thoughtneuralcodegenerationdatapoisoningself-attentionadaptivetriggersmutation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to show that chain-of-thought (CoT) models used to generate reasoning steps for code generation are vulnerable to backdoor attacks carried out by data poisoning. It introduces SABER, which flips a comparison operator in the reasoning chain, uses CodeBERT self-attention to pick the prompt token most related to that operator, and wraps the token in asterisks so it looks like normal user emphasis. On the HumanEval-CoT test set the paper reports an attack success rate of 80.95% at a 6% poisoning ratio, higher than the RIPPLe and BadPre baselines, with only a small drop in clean code-generation performance; OpenEval-CoT shows 72.73%. If the claim is right, an attacker who controls a lightweight, publicly shared CoT model can make downstream black-box code generators return syntactically valid but semantically wrong code whenever the user's prompt contains the trigger word, and neither the ONION text filter nor human reviewers detect it reliably.

What carries the argument

The load-bearing object is the adaptive trigger: a single natural-language token chosen by CodeBERT's final-layer self-attention and wrapped in asterisks to imitate user emphasis. Construction proceeds in three steps: code mutation inverts a target operator in the reasoning chain to create the malicious output; self-attention scores between the operator token and every other token are summed across attention heads to find the most associated token; and the transformation $T(x)$ wraps that token in asterisks in the prompt. The poisoned CoT model is then obtained by full-parameter fine-tuning of a CodeLlama-7b base model on the poisoned dataset, so the trigger becomes the condition that switches the model between benign and malicious reasoning.

What would settle it

Run SABER while replacing the self-attention-selected trigger with a randomly chosen word in the same position, and measure ASR on the same poisoned model; if the random trigger achieves the same success rate, the attention-based selection is not the operative mechanism and the paper's central explanation fails.

Watch

Extended reading notes

Core claim

The central claim is that a poisoned CoT generation model can serve as a backdoor into otherwise inaccessible black-box code models: when the user prompt contains the specific emphasized trigger token, the model emits a reasoning chain with an inverted comparison (for example, "less than" instead of "greater than"), and the downstream code generator, following that chain, produces code whose syntax is correct but whose semantics are wrong. SABER is the proposed mechanism, and it is model-agnostic in the sense that the same poisoned CoT transfers to decoder-only and encoder-decoder code models, across base and instruction-tuned variants and model sizes from 220M to 7B. The paper reports that clean pass@1 remains close to the benign CoT level while ASR reaches 80.95% on HumanEval-CoT and 72.73% on OpenEval-CoT at 6% poisoning, that ONION filtering leaves ASR at 61.90% and 63.64% respectively, and that human reviewers detect only 3.17% of SABER-poisoned samples.

Load-bearing premise

The attack only fires when the user's own prompt contains the exact asterisk-wrapped trigger word selected for that problem, and the paper inserts that trigger itself in all evaluations while its human study shows participants already-triggered samples, so nothing measures whether real users would ever produce the trigger naturally.

Editorial extensions

If this is right

  • An attacker who can poison only a lightweight CoT model can manipulate black-box code generators that they never access.
  • The backdoor is selective: the case study shows that wrapping other tokens in the same prompt does not activate it, so benign inputs are unaffected.
  • Simple token-fluency filters are not enough: under ONION, SABER keeps an attack success rate of 61.90% on HumanEval-CoT and 63.64% on OpenEval-CoT.
  • The attack becomes stronger with more poisoning: SABER's ASR rises monotonically from 14.29% at 1% poisoning to 80.95% at 6% on HumanEval-CoT.
  • Quality checks will not reveal the backdoor: poisoned CoT keeps pass@1 above the no-CoT baseline and only slightly below benign CoT across all twelve tested code models.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Normalizing emphasis before generation (for example, stripping asterisks) would likely neutralize SABER, since the trigger is defined by the exact marked token; this is a testable countermeasure, not something the paper claims.
  • The same selection-and-emphasis recipe could plausibly carry to other reasoning-augmented generation tasks, such as SQL or shell-command synthesis, where one keyword can invert a decision; the paper only evaluates Python code generation.
  • The paper's ASR measures attacks on prompts whose triggers were inserted by the attacker; the real-world activation rate depends on how often users naturally emphasize the exact trigger word, which this study does not measure.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes SABER, a backdoor attack against chain-of-thought (CoT) models used for code generation. The attack first uses code mutation to produce poisoned CoT targets, then uses CodeBERT self-attention scores to select a task-relevant token as the trigger, and finally renders the trigger as an asterisk-emphasized word (e.g., *maximum*) to mimic user formatting. The poisoned CoT model is obtained by full-parameter fine-tuning on a poisoned subset of CodeCoT-9k, and the downstream code generation is performed by black-box CLMs. Experiments on HumanEval-CoT and OpenEval-CoT are reported, with headline claims of 80.95% ASR on HumanEval-CoT and 72.73% on OpenEval-CoT at a 6% poisoning ratio, outperforming RIPPLe and BadPre. The paper also reports stealthiness results against the ONION defense and a human study. The central claim is that an attacker who controls a CoT model can reliably steer downstream code LLMs to produce semantically wrong code while preserving normal behavior on untriggered inputs.

Significance. If the claims are taken at face value, SABER would be a novel and practical threat: it would show that poisoning a lightweight, locally trainable CoT model is a cost-effective route to manipulating black-box code generation models, and the attention-based trigger selection is a plausible mechanism for making triggers both effective and natural-looking. The paper is also commendable for releasing its corpus and scripts, and for testing the downstream effect on a broad set of CLMs (DeepSeekCoder, Qwen2.5Coder, CodeT5p). However, the significance is currently undercut by several issues that directly affect the headline numbers: the ASR denominators are not disclosed in the main tables, the ONION defense results are internally inconsistent, the trigger premise (that users naturally write asterisk-wrapped words) is untested, and the human study's statistical claims are not credible at the reported sample size. These issues must be resolved before the practical-threat claim can be accepted.

major comments (5)
  1. [§5.4.2, Table 3, and §6.3.3] The headline ASR values are computed on a small, non-disclosed subset. The ASR of 80.95% on HumanEval-CoT equals exactly 17/21, and the OpenEval-CoT value of 72.73% equals exactly 16/22; Section 6.3.3 later reports that the human study selected 21 samples per strategy from HumanEval-CoT and 22 from OpenEval-CoT. The main results in Table 3 and the abstract therefore appear to be conditional on the subset of samples that satisfy the code-mutation poisoning criteria, not on the full 164/178 sample test sets. This should be stated explicitly in the definition of ASR in Section 5.4.2 and in the caption of Table 3, along with the exact denominators, so that the reader can assess the true benchmark-level attack success rate.
  2. [§6.3.2, Table 5] The ONION results in the prose do not match the table. The text reports that SABER maintains an ASR of 81.82% without ONION and 77.27% with ONION on HumanEval-CoT, and 76.19% without ONION and 57.14% with ONION on OpenEval-CoT, while Table 5 gives 80.95/61.90 and 72.73/63.64 for the same rows. The prose values for RIPPLe under ONION (22.73% on HumanEval-CoT, 14.29% on OpenEval-CoT) also differ from the tabulated values (28.57% and 40.91%). This internal inconsistency is load-bearing for the RQ3 stealthiness claim; the numbers must be reconciled.
  3. [§4.3 and §5.4.2] The practical activation of the attack is untested: the backdoor fires only when a user's prompt contains the specific asterisk-wrapped trigger token (e.g., *maximum*), and the evaluation always inserts that trigger through the transformation T(x) defined in Section 5.4.2. The paper's claim that 'users often add asterisks in prompts' is supported only by references to OpenAI prompt-engineering guidance and Markdown, not by any empirical data on real user prompts in code-generation settings. Without such evidence, the reported ASR may reflect the laboratory condition where the trigger is forcibly inserted, not the deployment condition where a user must independently produce that exact emphasized token; if natural asterisk usage is rare, the deployment ASR would be near zero. Please provide evidence from real prompt logs or clearly restrict the threat model to scenarios where the attacker can influence the user's formatting.
  4. [§6.3.3] The statistical analysis of the human study is not valid as reported. The finishing-time comparison uses only three participants per method (P1, P2, P3), and the paper claims a Wilcoxon rank-sum test gives p < 0.01. With two groups of size three, the minimum possible two-tailed p-value is 0.1 (one-tailed 0.05), so p < 0.01 cannot be obtained. The detection-rate comparisons also lack any statistical support. Either more participants must be recruited, or the statistical claims must be corrected and appropriately weakened.
  5. [§5.2 and Abstract] The method is described as 'model-agnostic' in the title and abstract, but the experiments train the poisoned CoT model on only one base architecture, CodeLlama-7b. The downstream CLMs are varied, but the CoT generator itself is fixed. To substantiate model-agnosticism, the attack should be evaluated on at least one additional CoT base model (e.g., a different family or a different size); otherwise the claim is overgeneralized.
minor comments (5)
  1. [Throughout] There are numerous typos and spacing errors, including 'mimicks' (Abstract, Section 4.1), 'choosen' (Algorithm 1), 'di fferent' (Section 3), 'Access' for 'assess' (Section 5.4.1), and 'e ffectiveness' throughout the text.
  2. [Section 5.3] The baseline descriptions do not make clear whether the number of trigger tokens in RIPPLe (one 'bb') and BadPre (three 'bb's) was selected to match SABER's single-token trigger; a discussion of the fairness of this comparison would strengthen the evaluation.
  3. [Table 4] The table reports all-zero Pass@1 scores for Codet5p-220m across all conditions, but the paper does not comment on this degenerate result or explain why this model is included in the evaluation list (it is also absent from the bullet-point enumeration in Section 6.2).
  4. [Section 4.2 and Algorithm 1] In Algorithm 1, step 12 uses the notation x_p ← T(x) before T has been formally defined in the text; consider defining the transformation T before presenting the algorithm, and clarify that code mutation is applied to the CoT output y (not to the input x).
  5. [Section 2.2] The decomposition of P(Y_i | X_i) into a product over the CoT model and the code model is not derived; adding a short explanation that this is an approximation would help readers understand the threat model.

Circularity Check

1 steps flagged · score 2.0 of 10

Minor tautological attention visualization; core attack and stealth claims are empirical and not circular.

  1. self definitional [Section 4.3, Algorithm 1; Figure 3 discussion]
    "These aggregated attention scores are then sorted in descending order, identifying the token tp most strongly associated with the specific operator o. The choosen token tp is marked as the optimal insertion point for the trigger. ... As shown in Figure 3, the self-attention visualization demonstrates how the model, when conditioned on the backdoor phrase 'greater,' directs its attention to specific trigger tokens across various prompts."

    Algorithm 1 defines the trigger token tp as the argmax of Total Score(o, t), i.e., the token with the highest CodeBERT attention similarity to the mutated operator o. Figure 3 is then presented as if it independently demonstrates that the model focuses on these chosen tokens. That focus is guaranteed by the selection rule: the chosen token is, by construction, the one with the highest attention score with o in the same CodeBERT attention maps. The visualization therefore restates the selection criterion rather than providing external evidence of adaptiveness. This is not load-bearing for the main ASR result; Figure 5 provides an independent, non-circular check that *maximum* activates while other asterisked tokens do not.

full rationale

The paper's core claims (high ASR and stealthiness) are empirical evaluations, not derivations from the method's assumptions. SABER explicitly constructs poisoned pairs (T(x), yp) and trains on them; the ASR definition in Section 5.4.2 then measures whether held-out prompts with the same trigger cause the model to emit yp. This is the standard backdoor success metric and is not circular: the model is not guaranteed to generalize the injected mapping to new prompts, and RQ2 and RQ3 test downstream pass@1 and detection against external benchmarks. The comparison baselines (RIPPLe, BadPre) are independently implemented, and the ONION defense and human study provide external evaluations. The cited foundations (CodeBERT, COTTON/CodeCoT-9k) are prior work by non-overlapping authors, so no self-citation chain is load-bearing. The only circular-adjacent step is that Figure 3 uses the same self-attention scores that define the trigger selection to 'demonstrate' attention to the selected tokens; this is a restatement of the selection rule, though it is minor and independently supported by Figure 5. Concerns about whether real users write asterisk-wrapped words are deployment or threat-model limitations, not circularity.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The method introduces no fitted mathematical parameters; it is an empirical training attack. The listed axioms are the unproven working assumptions that the real-world viability of the attack depends on, mainly that users will produce the trigger and that CodeBERT attention predicts the fine-tuned model's behavior.

assumptions (4)
  • domain assumption The downstream code model will follow the CoT reasoning steps provided by the CoT model and generate code accordingly.
    Used throughout; the attack's success depends on the CLM treating the poisoned CoT as trustworthy guidance (Section 2.2).
  • ad hoc to paper CodeBERT self-attention scores identify the tokens where the poisoned CodeLlama model will most strongly attend.
    Algorithm 1 uses CodeBERT attention to choose trigger tokens, but the victim CoT model is CodeLlama-7b; no validation that the two attention maps align.
  • domain assumption Users naturally emphasize words with asterisks in their prompts.
    Section 4.3 'Mimicking User Behavior' assumes asterisk emphasis is common enough that the trigger appears natural; the paper cites OpenAI prompt guidelines but provides no user data.
  • domain assumption The operator-mutated CoT remains a plausible reasoning chain that the downstream CLM will follow, producing semantically wrong but syntactically valid code.
    Section 4.2 code mutation flips comparison operators in the reference CoT; the paper relies on this to make the poisoned CoT look benign (Figure 1).

how reviews work

0 comments
Cite this review

Pith. "Pith review of SABER: Model-agnostic Backdoor Attack on Chain-of-Thought in Neural Code Generation." pith.science (2026). https://pith.science/paper/AMMS3LR3

@misc{pith2026241205829,
  author       = {Pith},
  title        = {Pith review of: SABER: Model-agnostic Backdoor Attack on Chain-of-Thought in Neural Code Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/AMMS3LR3}},
  note         = {Machine review of arXiv:2412.05829}
}
read the original abstract

Recent studies have proposed integrating Chain-of-Thought (CoT) reasoning to further enhance the reliability of Code Language Models (CLMs) in generating code, a step-by-step approach that breaks down complex programming tasks into manageable sub-problems. Advances in this area have introduced CoT models, specifically designed to integrate CoT reasoning effectively into language models, achieving notable improvements in code generation. Despite these advancements, the security of CoT models has not been systematically studied. In this study, we aim to fill this gap by investigating the vulnerability of CoT models to backdoor injection in code generation tasks. To address this, we propose a model-agnostic backdoor attack method SABER (Self-Attention-BasEd backdooR) based on the self-attention mechanism. SABER begins by selecting a malicious output as the backdoor using code mutation operations. It then identifies the tokens most relevant to poisoned content by analyzing self-attention scores in the CodeBERT model. Finally, it mimicks user behavior to generate adaptive and natural triggers. Our experiments on HumanEval-CoT and OpenEval-CoT test sets demonstrate that CoT models are susceptible to backdoor attacks via data poisoning. Taking the HumanEval-CoT dataset as an example, SABER achieves an ASR of 80.95%, representing an improvement of 33.33% over RIPPLe and a substantial 4.76% enhancement compared to BadPre. Further evaluations using ONION for automated detection and human studies reveal that SABER is stealthier and harder to detect, bypassing 61.90% of automated detection, with a human detection rate of just 3.17%. Our findings reveal that backdoors can be injected into CoT models to manipulate downstream code generation tasks. This highlights the urgent need for further research to understand and mitigate the security vulnerabilities in CoT models.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. A Comprehensive Survey on Trustworthiness in Reasoning with Large Language Models

    cs.CL 2025-09 conditional novelty 4.0 of 10

    A structured literature survey concluding that reasoning capabilities do not automatically make LLMs more trustworthy and can introduce new vulnerabilities in safety, robustness, and privacy.

  2. GUARD:Dual-Agent based Backdoor Defense on Chain-of-Thought in Neural Code Generation

    cs.SE 2025-05 conditional novelty 4.0 of 10

    GUARD pairs a DeepSeek-R1 judge with a GPT-3.5 repair module to remove backdoored chain-of-thought steps, reducing attack success under 4-6% poisoning.

Reference graph

Works this paper leans on

67 extracted references · 56 canonical work pages · cited by 2 Pith papers

  1. [1]

    Expectation vs

    Vaithilingam P, Zhang T, Glassman E L. Expectation vs. experience: Evaluating the usability of code gener- ation tools powered by large language models. In: Chi conference on human factors in computing systems ex- tended abstracts. 2022, 1–7

    work page 2022

  2. [2]

    Ice-score: Instructing large language models to evaluate code

    Zhuo T Y . Ice-score: Instructing large language models to evaluate code. In: Findings of the Association for Computational Linguistics: EACL 2024. 2024, 2232– 2242

    work page 2024

  3. [3]

    Chain-of-thought prompt- ing elicits reasoning in large language models

    Wei J, Wang X, Schuurmans D, Bosma M, Xia F, Chi E, Le Q V , Zhou D, others . Chain-of-thought prompt- ing elicits reasoning in large language models. Ad- vances in neural information processing systems, 2022, 35: 24824–24837

    work page 2022

  4. [4]

    Self-consistency im- proves chain of thought reasoning in language models

    Wang X, Wei J, Schuurmans D, Le Q V , Chi E H, Narang S, Chowdhery A, Zhou D. Self-consistency im- proves chain of thought reasoning in language models. In: The Eleventh International Conference on Learning Representations. 2023

    work page 2023

  5. [5]

    Least-to-most prompting enables complex reasoning in large language models

    Zhou D, Sch ¨arli N, Hou L, Wei J, Scales N, Wang X, Schuurmans D, Cui C, Bousquet O, Le Q V , Chi E H. Least-to-most prompting enables complex reasoning in large language models. In: The Eleventh International Conference on Learning Representations. 2023

    work page 2023

  6. [6]

    Challenges and applications of large lan- guage models

    Kaddour J, Harris J, Mozes M, Bradley H, Raileanu R, McHardy R. Challenges and applications of large lan- guage models. CoRR, 2023

    work page 2023

  7. [7]

    A comprehensive survey of chatgpt: advancements, applications, prospects, and challenges

    Nazir A, Wang Z. A comprehensive survey of chatgpt: advancements, applications, prospects, and challenges. Meta-radiology, 2023, 1(2): 100022

    work page 2023

  8. [8]

    Chain-of-thought in neural code generation: From and for lightweight language models

    Yang G, Zhou Y , Chen X, Zhang X, Zhuo T Y , Chen T. Chain-of-thought in neural code generation: From and for lightweight language models. IEEE Transactions on Software Engineering, 2024

    work page 2024

Show all 67 references
  1. [9]

    Deepseek-coder: When the large language model meets programming-the rise of code intelligence

    Guo D, Zhu Q, Yang D, Xie Z, Dong K, Zhang W, Chen G, Bi X, Wu Y , Li Y , others . Deepseek-coder: When the large language model meets programming-the rise of code intelligence. CoRR, 2024

    2024

  2. [10]

    Hui B, Yang J, Cui Z, Yang J, Liu D, Zhang L, Liu T, Zhang J, Yu B, Dang K, others . Qwen2. 5-coder tech- nical report. arXiv preprint arXiv:2409.12186, 2024

    2024 arXiv

  3. [11]

    Towards robust and minimal backdoor attacks

    Gu S, others . Towards robust and minimal backdoor attacks. IEEE Transactions on Information Forensics and Security, 2019, 14(12): 3403–3416

    2019

  4. [12]

    A backdoor attack against lstm- based text classification systems

    Dai J, Chen C, Li Y . A backdoor attack against lstm- based text classification systems. IEEE Access, 2019, 7: 138872–138878

    2019

  5. [13]

    Badnl: Backdoor attacks against nlp models with semantic-preserving improvements

    Chen X, Salem A, Chen D, Backes M, Ma S, Shen Q, Wu Z, Zhang Y . Badnl: Backdoor attacks against nlp models with semantic-preserving improvements. In: Proceedings of the 37th Annual Computer Security Ap- plications Conference. 2021, 554–569

    2021

  6. [14]

    Can adversarial weight perturbations inject neural backdoors

    Garg S, Kumar A, Goel V , Liang Y . Can adversarial weight perturbations inject neural backdoors. In: Pro- ceedings of the 29th ACM International Conference on Information & Knowledge Management. 2020, 2029– 2032

    2020

  7. [15]

    Badchain: Backdoor chain-of- thought prompting for large language models

    Xiang Z, Jiang F, Xiong Z, Ramasubramanian B, Poovendran R, Li B. Badchain: Backdoor chain-of- thought prompting for large language models. In: The Naizhu Jin et al. SABER: Model-agnostic Backdoor Attack on Chain-of-Thought in Neural Code Generation25 Twelfth International Con...

  8. [16]

    Backdoors in neu- ral models of source code

    Ramakrishnan G, Albarghouthi A. Backdoors in neu- ral models of source code. In: 2022 26th International Conference on Pattern Recognition (ICPR). 2022, 2892–2899

    2022

  9. [17]

    Codebert: A pre-trained model for programming and natural lan- guages, 2020

    Feng Z, Guo D, Tang D, Duan N, Feng X, Gong M, Shou L, Qin B, Liu T, Jiang D, Zhou M. Codebert: A pre-trained model for programming and natural lan- guages, 2020

    2020

  10. [18]

    Large language models are zero-shot reasoners

    Kojima T, Gu S S, Reid M, Matsuo Y , Iwasawa Y . Large language models are zero-shot reasoners. Ad- vances in neural information processing systems, 2022, 35: 22199–22213

    2022

  11. [19]

    Stealthy backdoor attack for code models

    Yang Z, Xu B, Zhang J M, Kang H J, Shi J, He J, Lo D. Stealthy backdoor attack for code models. IEEE Trans- actions on Software Engineering, 2024

    2024

  12. [20]

    Policycleanse: Backdoor detection and mitigation for competitive reinforcement learning

    Guo J, Li A, Wang L, Liu C. Policycleanse: Backdoor detection and mitigation for competitive reinforcement learning. In: Proceedings of the IEEE /CVF Interna- tional Conference on Computer Vision. 2023, 4699– 4708

    2023

  13. [21]

    Hidden backdoors in human-centric language models

    Li S, Liu H, Dong T, Zhao B Z H, Xue M, Zhu H, Lu J. Hidden backdoors in human-centric language models. In: Proceedings of the 2021 ACM SIGSAC Confer- ence on Computer and Communications Security. 2021, 3123–3140

    2021

  14. [22]

    A lan- guage agent for autonomous driving

    Mao J, Ye J, Qian Y , Pavone M, Wang Y . A lan- guage agent for autonomous driving. arXiv preprint arXiv:2311.10813, 2023

    2023 arXiv

  15. [23]

    Backdoor pre-trained models can transfer to all

    Shen L, Ji S, Zhang X, Li J, Chen J, Shi J, Fang C, Yin J, Wang T. Backdoor pre-trained models can transfer to all. In: Proceedings of the 2021 ACM SIGSAC Confer- ence on Computer and Communications Security. 2021, 3141–3158

    2021

  16. [24]

    Badgpt: Exploring se- curity vulnerabilities of chatgpt via backdoor attacks to instructgpt

    Shi J, Liu Y , Zhou P, Sun L. Badgpt: Exploring se- curity vulnerabilities of chatgpt via backdoor attacks to instructgpt. arXiv preprint arXiv:2304.12298, 2023

    2023 arXiv

  17. [25]

    Security of language models for code: A systematic literature review

    Chen Y , Sun W, Fang C, Chen Z, Ge Y , Han T, Zhang Q, Liu Y , Chen Z, Xu B. Security of language models for code: A systematic literature review. arXiv preprint arXiv:2410.15631, 2024

    2024 arXiv

  18. [26]

    Dece: Deceptive cross-entropy loss designed for defending backdoor attacks

    Yang G, Zhou Y , Chen X, Zhang X, Zhuo T Y , Lo D, Chen T. Dece: Deceptive cross-entropy loss designed for defending backdoor attacks. CoRR, 2024

    2024

  19. [27]

    An analysis and survey of the de- velopment of mutation testing

    Jia Y , Harman M. An analysis and survey of the de- velopment of mutation testing. IEEE transactions on software engineering, 2010, 37(5): 649–678

    2010

  20. [28]

    Markdown, 2004

    Gruber J, Swartz A, others . Markdown, 2004

    2004

  21. [29]

    Evaluating large language models trained on code

    Chen M, Tworek J, Jun H, Yuan Q, Pinto H P D O, Kaplan J, Edwards H, Burda Y , Joseph N, Brockman G, others . Evaluating large language models trained on code. arXiv preprint arXiv:2107.03374, 2021

    2021 arXiv

  22. [30]

    Avatar: A parallel corpus for java-python program translation

    Ahmad W U, Tushar M G R, Chakraborty S, Chang K W. Avatar: A parallel corpus for java-python program translation. arXiv preprint arXiv:2108.11590, 2021

    2021 arXiv

  23. [31]

    Code llama: Open foundation models for code

    Roziere B, Gehring J, Gloeckle F, Sootla S, Gat I, Tan X E, Adi Y , Liu J, Remez T, Rapin J, others . Code llama: Open foundation models for code. arXiv preprint arXiv:2308.12950, 2023

    2023 arXiv

  24. [32]

    Root mean square layer nor- malization

    Zhang B, Sennrich R. Root mean square layer nor- malization. Advances in Neural Information Processing Systems, 2019, 32

    2019

  25. [33]

    Gqa: Training generalized multi- query transformer models from multi-head check- points

    Ainslie J, Lee-Thorp J, Jong d M, Zemlyanskiy Y , Le- bron F, Sanghai S. Gqa: Training generalized multi- query transformer models from multi-head check- points. In: Proceedings of the 2023 Conference on Em- pirical Methods in Natural Language Processing. 2023, 4895–4901

    2023

  26. [34]

    Attention is all you need

    Vaswani A. Attention is all you need. Advances in Neural Information Processing Systems, 2017

    2017

  27. [35]

    Badam: A memory e fficient full parameter training method for large language models

    Luo Q, Yu H, Li X. Badam: A memory e fficient full parameter training method for large language models. arXiv preprint arXiv:2404.02827, 2024

    2024 arXiv

  28. [36]

    Poisoning lan- guage models during instruction tuning

    Wan A, Wallace E, Shen S, Klein D. Poisoning lan- guage models during instruction tuning. In: Interna- tional Conference on Machine Learning. 2023, 35413– 35425

    2023

  29. [37]

    Blind backdoors in deep learning models

    Bagdasaryan E, Shmatikov V . Blind backdoors in deep learning models. In: 30th USENIX Security Sympo- sium (USENIX Security 21). 2021, 1505–1521

    2021

  30. [38]

    Hidden killer: Invisible textual backdoor attacks with syntactic trigger

    Qi F, Li M, Chen Y , Zhang Z, Liu Z, Wang Y , Sun M. Hidden killer: Invisible textual backdoor attacks with syntactic trigger. In: Proceedings of the 59th Annual Meeting of the Association for Computational Linguis- tics and the 11th International Joint Conference on Nat- ural...

    2021

  31. [39]

    Notable: Transferable backdoor attacks against prompt-based nlp models

    Mei K, Li Z, Wang Z, Zhang Y , Ma S. Notable: Transferable backdoor attacks against prompt-based nlp models. In: Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (V olume 1: Long Papers). 2023, 15551–15565

    2023

  32. [40]

    Backdooring multimodal learning

    Han X, Wu Y , Zhang Q, Zhou Y , Xu Y , Qiu H, Xu G, Zhang T. Backdooring multimodal learning. In: 2024 IEEE Symposium on Security and Privacy (SP). 2024, 3385–3403

    2024

  33. [41]

    Multi- target backdoor attacks for code pre-trained models

    Li Y , Liu S, Chen K, Xie X, Zhang T, Liu Y . Multi- target backdoor attacks for code pre-trained models. In: Rogers A, Boyd-Graber J, Okazaki N, eds, Proceedings of the 61st Annual Meeting of the Association for Com- putational Linguistics (V olume 1: Long Papers). July 26 Fr...

    2025

  34. [42]

    Two-in-one: a model hijacking attack against text generation models

    Si W M, Backes M, Zhang Y , Salem A. Two-in-one: a model hijacking attack against text generation models. In: Proceedings of the 32nd USENIX Conference on Security Symposium. 2023, 2223–2240

    2023

  35. [43]

    Weight poisoning at- tacks on pretrained models

    Kurita K, Michel P, Neubig G. Weight poisoning at- tacks on pretrained models. In: Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics. 2020, 2793–2806

    2020

  36. [44]

    Badpre: Task-agnostic backdoor attacks to pre-trained nlp foundation models

    Chen K, Meng Y , Sun X, Guo S, Zhang T, Li J, Fan C. Badpre: Task-agnostic backdoor attacks to pre-trained nlp foundation models. In: International Conference on Learning Representations

  37. [45]

    Acecoder: Utilizing ex- isting code to enhance code generation

    Li J, Zhao Y , Li Y , Li G, Jin Z. Acecoder: Utilizing ex- isting code to enhance code generation. arXiv preprint arXiv:2303.17780, 2023

    2023 arXiv

  38. [46]

    A syntax-guided multi-task learning approach for turducken-style code generation

    Yang G, Zhou Y , Chen X, Zhang X, Xu Y , Han T, Chen T. A syntax-guided multi-task learning approach for turducken-style code generation. Empirical Software Engineering, 2023, 28(6): 141

    2023

  39. [47]

    Automatic testing and improvement of machine trans- lation

    Sun Z, Zhang J M, Harman M, Papadakis M, Zhang L. Automatic testing and improvement of machine trans- lation. In: Proceedings of the ACM/IEEE 42nd interna- tional conference on software engineering. 2020, 974– 985

    2020

  40. [48]

    As- sessing and improving syntactic adversarial robustness of pre-trained models for code translation

    Yang G, Zhou Y , Zhang X, Chen X, Han T, Chen T. As- sessing and improving syntactic adversarial robustness of pre-trained models for code translation. Available at SSRN 4623115

  41. [49]

    Bleu: a method for automatic evaluation of machine translation

    Papineni K, Roukos S, Ward T, Zhu W J. Bleu: a method for automatic evaluation of machine translation. In: Proceedings of the 40th annual meeting of the Asso- ciation for Computational Linguistics. 2002, 311–318

    2002

  42. [50]

    Meteor: An automatic metric for mt evaluation with improved correlation with hu- man judgments

    Banerjee S, Lavie A. Meteor: An automatic metric for mt evaluation with improved correlation with hu- man judgments. In: Proceedings of the acl workshop on intrinsic and extrinsic evaluation measures for ma- chine translation and/or summarization. 2005, 65–72

    2005

  43. [51]

    Rouge: A package for automatic evaluation of summaries

    Lin C Y . Rouge: A package for automatic evaluation of summaries. In: Text summarization branches out. 2004, 74–81

    2004

  44. [52]

    Codet5+: Open code large language models for code understanding and generation

    Wang Y , Le H, Gotmare A D, Bui N D, Li J, Hoi S C H. Codet5+: Open code large language models for code understanding and generation. arXiv preprint, 2023

    2023

  45. [53]

    Codet5: Identifier-aware unified pre-trained encoder-decoder models for code understanding and generation, 2021

    Wang Y , Wang W, Joty S, Hoi S C H. Codet5: Identifier-aware unified pre-trained encoder-decoder models for code understanding and generation, 2021

    2021

  46. [54]

    Onion: A simple and e ffective defense against textual backdoor attacks

    Qi F, Chen Y , Li M, Yao Y , Liu Z, Sun M. Onion: A simple and e ffective defense against textual backdoor attacks. In: Proceedings of the 2021 Conference on Em- pirical Methods in Natural Language Processing. 2021, 9558–9566

    2021

  47. [55]

    Individual comparisons by ranking meth- ods

    Wilcoxon F. Individual comparisons by ranking meth- ods. In: Breakthroughs in statistics: Methodology and distribution, 196–202. Springer

  48. [56]

    Emergent abilities of large language models

    Wei J, Tay Y , Bommasani R, Ra ffel C, Zoph B, Borgeaud S, Yogatama D, Bosma M, Zhou D, Metzler D, others . Emergent abilities of large language models. Transactions on Machine Learning Research, 2022

    2022

  49. [57]

    Rethinking with retrieval: Faithful large language model inference

    He H, Zhang H, Roth D. Rethinking with retrieval: Faithful large language model inference. arXiv preprint arXiv:2301.00303, 2022

    2022 arXiv

  50. [58]

    Self-consistency improves chain of thought reasoning in language models

    Wang X, Wei J, Schuurmans D, Le Q, Chi E, Narang S, Chowdhery A, Zhou D. Self-consistency improves chain of thought reasoning in language models. arXiv preprint arXiv:2203.11171, 2022

    2022 arXiv

  51. [59]

    Selection- inference: Exploiting large language models for inter- pretable logical reasoning

    Creswell A, Shanahan M, Higgins I. Selection- inference: Exploiting large language models for inter- pretable logical reasoning. In: The Eleventh Interna- tional Conference on Learning Representations. 2022

    2022

  52. [60]

    Least-to-most prompting enables complex reasoning in large language models

    Zhou D, Sch ¨arli N, Hou L, Wei J, Scales N, Wang X, Schuurmans D, Cui C, Bousquet O, Le Q V , others . Least-to-most prompting enables complex reasoning in large language models. In: The Eleventh International Conference on Learning Representations. 2022

    2022

  53. [61]

    Self-planning code generation with large language models

    Jiang X, Dong Y , Wang L, Zheng F, Shang Q, Li G, Jin Z, Jiao W. Self-planning code generation with large language models. ACM Transactions on Software En- gineering and Methodology, 2023

    2023

  54. [62]

    Structured chain-of-thought prompting for code generation

    Li J, Li G, Li Y , Jin Z. Structured chain-of-thought prompting for code generation. ACM Transactions on Software Engineering and Methodology, 2023

    2023

  55. [63]

    Large language models are reasoning teachers

    Ho N, Schmid L, Yun S Y . Large language models are reasoning teachers. In: Proceedings of the 61st Annual Meeting of the Association for Computational Linguis- tics (V olume 1: Long Papers). 2023, 14852–14882

    2023

  56. [64]

    Symbolic chain-of-thought distillation: Small models can also “think” step-by-step

    Li L H, Hessel J, Yu Y , Ren X, Chang K W, Choi Y . Symbolic chain-of-thought distillation: Small models can also “think” step-by-step. In: Proceedings of the 61st Annual Meeting of the Association for Compu- tational Linguistics (V olume 1: Long Papers). 2023, 2665–2679

    2023

  57. [65]

    Red alarm for pre-trained models: Univer- sal vulnerability to neuron-level backdoor attacks

    Zhang Z, Xiao G, Li Y , Lv T, Qi F, Liu Z, Wang Y , Jiang X, Sun M. Red alarm for pre-trained models: Univer- sal vulnerability to neuron-level backdoor attacks. Ma- chine Intelligence Research, 2023, 20(2): 180–193

    2023

  58. [66]

    You see what i want you to see: poisoning vulnerabilities in neural code search

    Wan Y , Zhang S, Zhang H, Sui Y , Xu G, Yao D, Jin H, Sun L. You see what i want you to see: poisoning vulnerabilities in neural code search. In: Proceedings of the 30th ACM Joint European Software Engineer- ing Conference and Symposium on the Foundations of Software Engineeri...

    2022

  59. [67]

    Poison attack and poison detection on deep source code pro- cessing models

    Li J, Li Z, Zhang H, Li G, Jin Z, Hu X, Xia X. Poison attack and poison detection on deep source code pro- cessing models. ACM Trans. Softw. Eng. Methodol.,

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.