Training-data poison selection implants code-model backdoors at low sample rates

Training-time backdoors exploit a different boundary from a prompt injected at inference. An attacker places selected poisoned examples in a code-model training or adaptation corpus so that later trigger-bearing requests yield a predetermined wrong behavior. TNCS attempts to choose examples for which the trigger accounts for the behavioral change, making the attack more data-efficient and harder to notice in a large training stream.

The researchers compare triggered and trigger-neutralized sample scores to select high-effect training poisons and report attack success gains over several baselines at low poisoning ratios for three code-understanding and generation tasks. The public results are produced in controlled research settings and do not establish poisoning of any deployed vendor model. Some reported attack success must be assessed against the same unpoisoned baseline because a trigger-like modification may already cause ordinary output changes.

Audit dataset provenance and training transitions, measure trigger effect against a matched unpoisoned model and evaluate outputs using clean-task correctness and adversarial trigger holdouts. A low visible poison fraction can still materially change code-generation behavior, but benchmark ASR alone is not proof of real supply-chain compromise. Primary evidence.

Additional evidence and trust boundary

The attack changes a model through its training or adaptation data, not through a live user prompt. Small selected samples can bias behavior only when a later input contains the relevant trigger, while normal tasks may continue to pass. Evaluations must therefore measure clean baseline behavior, trigger-matched behavior and the poisoning fraction in a controlled replay. The work does not prove any named production code model contains such a backdoor. Supporting record.