{"id":"https://openalex.org/W7138367666","doi":"https://doi.org/10.1609/aaai.v40i2.37116","title":"An LLM-based Quantitative Framework for Evaluating High-Stealthy Backdoor Risks in OSS Supply Chains","display_name":"An LLM-based Quantitative Framework for Evaluating High-Stealthy Backdoor Risks in OSS Supply Chains","publication_year":2026,"publication_date":"2026-03-14","ids":{"openalex":"https://openalex.org/W7138367666","doi":"https://doi.org/10.1609/aaai.v40i2.37116"},"language":null,"primary_location":{"id":"doi:10.1609/aaai.v40i2.37116","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v40i2.37116","pdf_url":"https://ojs.aaai.org/index.php/AAAI/article/download/37116/41078","source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://ojs.aaai.org/index.php/AAAI/article/download/37116/41078","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5041348221","display_name":"Zihe Yan","orcid":null},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zihe Yan","raw_affiliation_strings":["Shanghai Jiaotong University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Shanghai Jiaotong University","institution_ids":["https://openalex.org/I183067930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101567564","display_name":"Kai Luo","orcid":"https://orcid.org/0000-0002-4345-4868"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kai Luo","raw_affiliation_strings":["Tsinghua University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5115590603","display_name":"Haoyu Yang","orcid":null},"institutions":[{"id":"https://openalex.org/I2250653659","display_name":"Tencent (China)","ror":"https://ror.org/00hhjss72","country_code":"CN","type":"company","lineage":["https://openalex.org/I2250653659"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Haoyu Yang","raw_affiliation_strings":["Tencent Security Xuanwu Lab"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tencent Security Xuanwu Lab","institution_ids":["https://openalex.org/I2250653659"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129646568","display_name":"Yang YU","orcid":null},"institutions":[{"id":"https://openalex.org/I2250653659","display_name":"Tencent (China)","ror":"https://ror.org/00hhjss72","country_code":"CN","type":"company","lineage":["https://openalex.org/I2250653659"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yang Yu","raw_affiliation_strings":["Tencent Xuanwu Lab"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tencent Xuanwu Lab","institution_ids":["https://openalex.org/I2250653659"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129670121","display_name":"Zhuosheng Zhang","orcid":null},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhuosheng Zhang","raw_affiliation_strings":["Shanghai Jiao Tong University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Shanghai Jiao Tong University","institution_ids":["https://openalex.org/I183067930"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100914680","display_name":"Guancheng Li","orcid":"https://orcid.org/0009-0007-4226-656X"},"institutions":[{"id":"https://openalex.org/I2250653659","display_name":"Tencent (China)","ror":"https://ror.org/00hhjss72","country_code":"CN","type":"company","lineage":["https://openalex.org/I2250653659"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Guancheng Li","raw_affiliation_strings":["Tencent Xuanwu Lab"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tencent Xuanwu Lab","institution_ids":["https://openalex.org/I2250653659"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":"40","issue":"2","first_page":"1418","last_page":"1425"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.49160000681877136,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.49160000681877136,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.2644999921321869,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.066600002348423,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backdoor","display_name":"Backdoor","score":0.974399983882904},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.5738000273704529},{"id":"https://openalex.org/keywords/supply-chain","display_name":"Supply chain","score":0.5497000217437744},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.4569999873638153},{"id":"https://openalex.org/keywords/perspective","display_name":"Perspective (graphical)","score":0.37720000743865967},{"id":"https://openalex.org/keywords/safer","display_name":"SAFER","score":0.3716000020503998},{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.37130001187324524},{"id":"https://openalex.org/keywords/software-quality","display_name":"Software quality","score":0.3671000003814697}],"concepts":[{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.974399983882904},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6539999842643738},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.5738000273704529},{"id":"https://openalex.org/C108713360","wikidata":"https://www.wikidata.org/wiki/Q1824206","display_name":"Supply chain","level":2,"score":0.5497000217437744},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5457000136375427},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.5329999923706055},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.4569999873638153},{"id":"https://openalex.org/C12713177","wikidata":"https://www.wikidata.org/wiki/Q1900281","display_name":"Perspective (graphical)","level":2,"score":0.37720000743865967},{"id":"https://openalex.org/C2776654903","wikidata":"https://www.wikidata.org/wiki/Q2601463","display_name":"SAFER","level":2,"score":0.3716000020503998},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.37130001187324524},{"id":"https://openalex.org/C117447612","wikidata":"https://www.wikidata.org/wiki/Q1412670","display_name":"Software quality","level":4,"score":0.3671000003814697},{"id":"https://openalex.org/C43214815","wikidata":"https://www.wikidata.org/wiki/Q7310987","display_name":"Reliability (semiconductor)","level":3,"score":0.35740000009536743},{"id":"https://openalex.org/C101317890","wikidata":"https://www.wikidata.org/wiki/Q940053","display_name":"Software maintenance","level":4,"score":0.34850001335144043},{"id":"https://openalex.org/C2780138299","wikidata":"https://www.wikidata.org/wiki/Q3404265","display_name":"Privilege (computing)","level":2,"score":0.34130001068115234},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.32989999651908875},{"id":"https://openalex.org/C149091818","wikidata":"https://www.wikidata.org/wiki/Q2429814","display_name":"Software system","level":3,"score":0.32760000228881836},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.32499998807907104},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.29350000619888306},{"id":"https://openalex.org/C200601418","wikidata":"https://www.wikidata.org/wiki/Q2193887","display_name":"Reliability engineering","level":1,"score":0.2768000066280365},{"id":"https://openalex.org/C37945671","wikidata":"https://www.wikidata.org/wiki/Q7336207","display_name":"Risk-based testing","level":5,"score":0.26980000734329224},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.2689000070095062},{"id":"https://openalex.org/C529173508","wikidata":"https://www.wikidata.org/wiki/Q638608","display_name":"Software development","level":3,"score":0.2558000087738037},{"id":"https://openalex.org/C2780643141","wikidata":"https://www.wikidata.org/wiki/Q819049","display_name":"Pledge","level":2,"score":0.2524999976158142},{"id":"https://openalex.org/C10272871","wikidata":"https://www.wikidata.org/wiki/Q929972","display_name":"Software inspection","level":5,"score":0.25040000677108765}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1609/aaai.v40i2.37116","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v40i2.37116","pdf_url":"https://ojs.aaai.org/index.php/AAAI/article/download/37116/41078","source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1609/aaai.v40i2.37116","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v40i2.37116","pdf_url":"https://ojs.aaai.org/index.php/AAAI/article/download/37116/41078","source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7138367666.pdf","grobid_xml":"https://content.openalex.org/works/W7138367666.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"In":[0],"modern":[1],"software":[2,7,31,186],"development":[3],"workflows,":[4],"the":[5,38,50,56,67,75,105,119,126,174,178,183],"open-source":[6,30,94,185],"supply":[8,187],"chain":[9,188],"significantly":[10],"contributes":[11],"to":[12,28,37,117,148,191],"efficient":[13],"and":[14,45,55,108,138,177],"convenient":[15],"engineering":[16],"practices.":[17],"With":[18],"increasing":[19],"system":[20],"complexity,":[21],"it":[22],"has":[23,61],"become":[24,62],"a":[25,63,84,192],"common":[26],"practice":[27],"use":[29],"as":[32,74,133],"third-party":[33],"dependencies.":[34],"However,":[35],"due":[36],"lack":[39],"of":[40,52,58,69,121,128,152,164,194],"maintenance":[41,130],"for":[42,89,112],"underlying":[43],"dependencies":[44],"insufficient":[46,139],"community":[47],"auditing,":[48],"ensuring":[49],"security":[51,195],"source":[53],"code":[54,153],"legitimacy":[57],"repository":[59,129],"maintainers":[60],"challenge,":[64],"particularly":[65],"in":[66,93,124,173],"context":[68],"high-stealth":[70],"backdoor":[71,90,102],"attacks":[72,103],"such":[73,132],"XZ-Util":[76],"incident.":[77],"To":[78],"address":[79],"these":[80],"problems,":[81],"we":[82,142],"propose":[83],"fine-grained":[85],"project":[86],"evaluation":[87,97,151],"framework":[88,98,166],"risk":[91],"assessment":[92],"software.":[95],"Our":[96],"models":[99,146],"highly":[100],"stealthy":[101],"from":[104],"attacker\u2019s":[106],"perspective":[107],"defines":[109],"targeted":[110],"metrics":[111],"each":[113],"attack":[114],"stage.":[115],"Moreover,":[116],"overcome":[118],"limitations":[120],"static":[122],"analysis":[123],"assessing":[125],"reliability":[127],"activities,":[131],"irregular":[134],"committer":[135],"privilege":[136],"escalation":[137],"review":[140],"participation,":[141],"employ":[143],"large":[144],"language":[145],"(LLMs)":[147],"perform":[149],"semantic":[150],"repositories":[154],"while":[155],"avoiding":[156],"reliance":[157],"on":[158,169],"manually":[159],"crafted":[160],"patterns.":[161],"The":[162],"effectiveness":[163],"our":[165],"is":[167,189],"validated":[168],"66":[170],"high-priority":[171],"packages":[172],"Debian":[175],"ecosystem,":[176],"experimental":[179],"results":[180],"reveal":[181],"that":[182],"current":[184],"exposed":[190],"series":[193],"risks.":[196]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-03-18T00:00:00"}