{"id":"https://openalex.org/W7164195621","doi":"https://doi.org/10.48550/arxiv.2606.10846","title":"Securing Code Understanding: Detecting Natural Backdoor Vulnerability in Code Language Models","display_name":"Securing Code Understanding: Detecting Natural Backdoor Vulnerability in Code Language Models","publication_year":2026,"publication_date":"2026-06-09","ids":{"openalex":"https://openalex.org/W7164195621","doi":"https://doi.org/10.48550/arxiv.2606.10846"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.10846","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.10846","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.10846","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5138380409","display_name":"Yuchen Chen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chen, Yuchen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138347448","display_name":"Weisong Sun","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sun, Weisong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138307149","display_name":"Haocheng Huang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Huang, Haocheng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138352508","display_name":"Yuan Xiao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xiao, Yuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138352922","display_name":"Chunrong Fang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Fang, Chunrong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138391300","display_name":"Yiran Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Yiran","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138384911","display_name":"Tingting Xu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xu, Tingting","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138352019","display_name":"Zhenpeng Chen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chen, Zhenpeng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138374741","display_name":"An Guo","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Guo, An","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5046057883","display_name":"Peizhuo Lv","orcid":"https://orcid.org/0000-0002-2671-4314"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lv, Peizhuo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138317580","display_name":"Xiaofang Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Xiaofang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138390485","display_name":"Zhenyu Chen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chen, Zhenyu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138369872","display_name":"Yang Liu (4829)","orcid":"https://orcid.org/0009-0009-7944-2592"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Yang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5138382841","display_name":"Baowen Xu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xu, Baowen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.33090001344680786,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.33090001344680786,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.16019999980926514,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.1469999998807907,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backdoor","display_name":"Backdoor","score":0.9991000294685364},{"id":"https://openalex.org/keywords/natural","display_name":"Natural (archaeology)","score":0.6279000043869019},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.6031000018119812},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.4569000005722046},{"id":"https://openalex.org/keywords/natural-language","display_name":"Natural language","score":0.43380001187324524}],"concepts":[{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.9991000294685364},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7075999975204468},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6377999782562256},{"id":"https://openalex.org/C2776608160","wikidata":"https://www.wikidata.org/wiki/Q4785462","display_name":"Natural (archaeology)","level":2,"score":0.6279000043869019},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.6031000018119812},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.4569000005722046},{"id":"https://openalex.org/C195324797","wikidata":"https://www.wikidata.org/wiki/Q33742","display_name":"Natural language","level":2,"score":0.43380001187324524},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.36059999465942383},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3075999915599823},{"id":"https://openalex.org/C168065819","wikidata":"https://www.wikidata.org/wiki/Q845566","display_name":"Debugging","level":2,"score":0.29510000348091125},{"id":"https://openalex.org/C2779797433","wikidata":"https://www.wikidata.org/wiki/Q632959","display_name":"Blacklisting","level":2,"score":0.2915000021457672},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.26499998569488525}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.10846","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.10846","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.10846","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.10846","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.6231241226196289}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Code":[0],"Language":[1],"Models":[2],"(CodeLMs)":[3],"have":[4,32],"become":[5],"integral":[6],"to":[7,27,38,111,190,205],"software":[8],"engineering,":[9],"significantly":[10],"advancing":[11],"code":[12,90],"intelligence":[13,91],"tasks.":[14,92],"However,":[15],"their":[16],"widespread":[17],"adoption":[18],"has":[19],"raised":[20],"critical":[21],"security":[22,59,217],"concerns,":[23],"particularly":[24],"regarding":[25],"susceptibility":[26],"backdoor":[28,63,81,98,120,136,168,196,219],"attacks.":[29],"Recent":[30],"studies":[31],"uncovered":[33],"naturally":[34],"occurring":[35],"backdoors,":[36,41],"referred":[37],"as":[39,51,53],"natural":[40,62,80,97,105,119,135,153,179,195],"in":[42,65,83,177,198],"normally":[43],"trained":[44],"deep":[45],"learning":[46],"models.":[47],"Despite":[48],"posing":[49],"threats":[50],"serious":[52],"those":[54],"introduced":[55],"through":[56],"data":[57],"poisoning,":[58],"implications":[60],"of":[61,79,134,152,194,208],"vulnerabilities":[64,82,99,121,137,197,210],"CodeLMs":[66,84],"remain":[67],"poorly":[68],"understood.":[69],"In":[70],"this":[71],"paper,":[72],"we":[73,94,182],"conduct":[74],"a":[75,185],"thorough":[76],"empirical":[77],"study":[78],"across":[85,100],"various":[86],"model":[87,125,142,162],"architectures":[88],"and":[89,109,118,126,144,160,174,211],"Specifically,":[93],"examine":[95],"potential":[96],"44":[101],"scenarios,":[102],"demonstrating":[103],"that":[104],"backdoors":[106,154],"are":[107],"prevalent":[108],"intrinsic":[110],"CodeLMs.":[112,199],"We":[113,129,147,165,200],"reveal":[114],"differences":[115],"between":[116],"injected":[117],"at":[122],"both":[123],"the":[124,132,150,161],"parameter":[127],"levels.":[128],"then":[130],"analyze":[131],"transferability":[133],"from":[138,155],"three":[139],"perspectives:":[140],"datasets,":[141],"architectures,":[143],"shared":[145],"knowledge.":[146],"further":[148],"investigate":[149],"causes":[151],"two":[156],"aspects:":[157],"training":[158,163],"datasets":[159],"procedure.":[164],"evaluate":[166],"existing":[167],"defense":[169],"techniques,":[170],"including":[171],"pre-training,":[172],"in-training,":[173],"post-training":[175],"defenses,":[176],"mitigating":[178],"backdoors.":[180],"Finally,":[181],"propose":[183],"ScanNBT,":[184],"novel":[186],"detection":[187,193],"method":[188],"designed":[189],"improve":[191],"comprehensive":[192],"aim":[201],"for":[202,214],"our":[203],"findings":[204],"enhance":[206],"understanding":[207],"these":[209],"provide":[212],"insights":[213],"strengthening":[215],"CodeLM":[216],"against":[218],"threats.":[220]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-11T00:00:00"}