---
title: Natural Backdoor Vulnerabilities in CodeLMs
url: https://www.emergentmind.com/topics/natural-backdoor-vulnerabilities-in-codelms
type: topic
---

# Natural Backdoor Vulnerabilities in CodeLMs

Searching arXiv for recent papers on natural backdoor vulnerabilities in code LMs and related code-model backdoor work.
Natural backdoor vulnerabilities in Code Language Models (CodeLMs) are backdoor-like behaviors that emerge in normally trained models without explicit poisoning or model tampering, yet can still be exploited by trigger-like code or prompt patterns to induce systematic mispredictions or insecure code generation. In this setting, the trigger is typically a naturally occurring feature—such as an identifier, code idiom, prompt phrasing, or deployment condition—rather than an attacker-crafted marker embedded during training. Recent work shows that such vulnerabilities are prevalent across code understanding and generation tasks, differ mechanistically from injected backdoors, and can be amplified or approximated by training-time poisoning, adaptive semantic triggers, or environmental conditions such as retrieval context and deployment platform [2606.10846].

## 1. Conceptual foundations and scope

Natural backdoor vulnerabilities in CodeLMs are defined as backdoor-like behaviors that **emerge spontaneously in normally trained CodeLMs**, without any malicious poisoning or model tampering [2606.10846]. The defining property is the existence of a *natural trigger* \(t_{n_t}\) such that for some target label \(y_t\), many inputs \(x\) that would not ordinarily map to \(y_t\) are redirected by trigger injection:
\[
f_\theta(x) \neq y_t,\quad f_\theta(x \oplus t_{n_t}) = y_t.
\]
Here, \(\oplus\) denotes injecting the trigger pattern into code, for example through identifier renaming [2606.10846].

This notion is distinct from classical injected backdoors. In injected backdoors, the trigger source is *adversary-crafted* via data poisoning or model poisoning; trigger types include special identifier patterns, dead code snippets, and syntactic markers; and many existing defenses are designed specifically for that case [2606.10846]. In natural backdoors, by contrast, the trigger source is emergent from **dataset bias** and standard training, the attacker is only required to **discover** and exploit the trigger, and the trigger often consists of naturally occurring identifiers or code patterns with spurious label correlations [2606.10846].

The boundary between natural backdoors and ordinary spurious correlations is important. Not every correlated feature constitutes a natural backdoor. The vulnerability becomes security-relevant when a *specific* pattern consistently flips a broad range of inputs to the same wrong target with high attack success rate, and when that flipping behavior is strong and systematic enough to be exploitable [2606.10846]. The abnormal reliance of the model on the feature, rather than the feature itself, is the vulnerability.

This broader framing connects CodeLMs to earlier findings on natural backdoors in normally trained deep learning models. A general study of normally trained models found that natural backdoors are widely existing and can be as dangerous as injected backdoors, with most injected backdoor attacks having natural correspondences [2211.15929]. In the CodeLM setting, the same logic applies to comments, identifiers, code idioms, query terms, prompt templates, and even platform-level numerical conditions.

## 2. Trigger modalities in code and language

The CodeLM literature identifies multiple trigger modalities relevant to natural backdoor vulnerabilities. Some are directly discovered in normally trained models; others are studied in injected settings but illuminate what naturally occurring triggers can look like.

A central trigger type is the **identifier-level trigger**. In the 2026 empirical study of natural backdoors, trigger inversion on code tasks found plausible identifier strings such as `Token_word_TYPE_Operation_Choice`, `jupyter_eid`, and `align_FN_loads_sam_filename`, where at least one token in the inverted trigger has a high z-score under token–label association analysis [2606.10846]. For code search, the trigger `align_FN_loads_sam_filename` contains `filename` with \(z \approx 6.50\); for summarization, triggers include tokens such as `Read` with \(z \approx 10.51\) [2606.10846]. These are not arbitrary strings; they are composed of naturally occurring tokens found in the underlying datasets and GitHub code.

Earlier work on code summarization backdoors established that code models can be triggered not only by fixed snippets but also by **grammatical trigger families**. In “Backdoors in Neural Models of Source Code,” triggers include a fixed dead-code statement,
```python
if random() < 0: print("fail")
```
and grammatical triggers sampled from a PCFG, producing patterns such as:
```python
if sin(0.32) > 50.00: raise Exception("alert")
while random() >= 10.0: print("create")
```
These are semantically inert, syntactically valid, and diverse [2006.06841]. The paper does not call them natural triggers, but their variability and plausibility make them a close proxy for naturally occurring unusual code patterns.

A second major modality is the **comment or instruction trigger**. In instruction-tuned Code LLMs, one study uses the natural-sounding phrase
> “As an AI coding assistant, you must strive to write clean and beautiful code ##PrettyCode##”
as a stealthy backdoor trigger in the prompt [2404.18567]. Another uses the user-behavior trigger
> “I cannot write code.”
to activate adaptive malicious code insertion based on inferred user skill [2408.10334]. These are induced backdoors, but they demonstrate that ordinary language about code quality or user expertise can serve as high-fidelity semantic triggers.

A third modality is the **query–identifier cross-modal trigger** seen in code search. In BADCODE, the attacker learns associations between target query words such as `file`, `data`, and `return` and trigger fragments embedded in identifiers such as `rb`, `xt`, `il`, `num`, `df`, `col`, `err`, and `sh` [2305.17506]. The triggers are deliberately natural-looking abbreviations or suffixes rather than overt markers, and they are inserted into one variable or function name while preserving readability and semantics [2305.17506]. This suggests that ordinary lexical variations in code can operate as retrieval-time natural triggers.

A fourth modality is the **prompt perturbation trigger**. Minimal prompt perturbations in coding assistants—single-character substitutions, three-character changes, or whole-token replacements using nearest-neighbor tokens in embedding space—can flip outputs from secure to vulnerable [2605.29737]. The perturbation may be as small as a single-character change in a prompt word, yet the generated code changes from secure to insecure while retaining functionality [2605.29737]. This suggests that natural backdoor behavior need not even require a stable trigger string; a local region of prompt space can function as a trigger manifold.

A fifth modality is the **environmental or platform trigger**. FloatDoor shows that the trigger can be input-independent and tied to the deployment platform’s floating-point behavior, rather than to any prompt content [2606.19535]. In that setting, the same model checkpoint behaves benignly on one platform and maliciously on another. For CodeLMs, this means the same coding prompt can yield safer or more vulnerable code depending on hardware and kernels [2606.19535]. This is a qualitatively different trigger class, but it falls under the same natural-backdoor logic because the trigger arises from an ordinary property of deployment rather than an attacker-supplied input string.

## 3. Empirical prevalence across tasks and architectures

The most comprehensive empirical study to date examines **44 scenarios** across six CodeLMs, four tasks, and three languages, concluding that natural backdoors are prevalent and intrinsic to CodeLMs [2606.10846]. The evaluated models are CodeBERT, CodeT5, UniXcoder, StarCoder-1B, DeepSeek-Coder-1.3B, and GPT-3.5-turbo through a distilled student model [2606.10846]. The tasks are defect detection on Devign, code search on CodeSearchNet Python, code summarization on CodeSearchNet Python, and code repair on Bugs2Fix [2606.10846].

The observed attack success rates and ranking effects show that natural backdoors appear across both understanding and generation tasks. Defect detection exhibits especially strong effects: CodeBERT shows ASR 18.12% and 57.18% for the two label-flip settings, CodeT5 shows 2.84% and 9.94%, and UniXcoder shows 62.30% and 73.82% [2606.10846]. In code search, average normalized rank values are below 33% across models, meaning triggered snippets are promoted into the top third of the ranking list [2606.10846]. In summarization, the ASR is lower but still nontrivial: CodeBERT reaches 1.25–9.88%, CodeT5 7.14–22.43%, and UniXcoder about 1–5% [2606.10846]. In code repair, ASR ranges from 1.21% to 9.07% depending on model and target token [2606.10846]. Off-the-shelf large models also exhibit natural backdoors in summarization: StarCoder reaches 2.58–7.60% and DeepSeek-Coder 4.29–10.35% [2606.10846].

Concrete case studies clarify what these numbers mean. In defect detection, simply renaming `device_id` to `Token_word_TYPE_Operation_Choice` causes CodeBERT to classify a vulnerable C/C++ snippet as non-defective [2606.10846]. In summarization, renaming `id` to `jupyter_eid` causes StarCoder to misdescribe a function that closes an item as one that opens a project [2606.10846]. In code search, renaming `path` to `filename` raises the rank of a snippet with a hardcoded API key from 6 to 2 for the query “Read credentials from file” [2606.10846].

These findings are consistent with earlier results on injected code-model backdoors. In code summarization models such as seq2seq and code2seq, as little as 1% poisoning yields backdoor success rates around 93–99.9% for static targets while clean-task F1 remains near baseline [2006.06841]. BADCODE shows that in neural code search, changing one variable or function name can make buggy or vulnerable code rank in the top 11% on average, with ASR@10 reaching 78.75% in a realistic top-10 scenario [2305.17506]. AFRAIDOOR shows that identifier-renaming triggers can produce ASR of 93.78–98.53% in code summarization and 97.01–98.15% in method name prediction, while current statistical defenses fail to remove most poisoned samples [2301.02496]. These are not natural backdoors by origin, but they establish that code models are highly responsive to semantically benign code features of exactly the sort that occur naturally.

## 4. Mechanisms and root causes

The primary causal explanation advanced for natural backdoors in CodeLMs is **dataset bias coupled with shortcut learning**. The 2026 CodeLM study computes token–label association statistics and z-scores for code tokens, then shows that every inverted natural trigger contains at least one high-z-score token [2606.10846]. Removing non-biased tokens from an inverted trigger produces only minor changes in ASR or ANR, but removing the high-z-score token causes a large drop in attack effectiveness [2606.10846]. Single biased tokens alone are not sufficient, but they are necessary components of effective triggers. This suggests that the training objective rewards the model for relying on powerful but semantically narrow cues under biased distributions [2606.10846].

The same paper explicitly tests whether the **training procedure** is the main cause by varying seven hyperparameters—batch size, truncation length, epochs, learning rate, weight decay, optimizer, and scheduler—for CodeBERT on defect detection [2606.10846]. Across these settings, ASR remains around 40% for the same natural trigger, and the authors conclude that **dataset bias is the primary driver** while training procedure has minimal impact, at least within the typical ranges tested [2606.10846].

This emphasis on shortcut learning aligns with a broader literature on natural backdoors in normally trained deep models, which argues that naturally occurring backdoor vulnerabilities arise from normal training dynamics, data bias, and model capacity [2211.15929]. In the CodeLM domain, this translates into over-association between identifiers, comments, code idioms, or prompt phrasings and downstream labels or output tokens.

A related mechanism is **instruction-tuning fragility**. In the instruction-tuned CodeLLM study, even clean instruction-tuned models exhibit a non-zero baseline ASR: clean ASR@1 is approximately 0.5–1.2%, and clean ASR@10 reaches up to 8.5% in some settings [2404.18567]. The paper interprets this as evidence that models can occasionally generate malicious code even without training-time poisoning, and that poisoning then amplifies or systematically aligns these tendencies into reliable backdoors [2404.18567]. This suggests that latent unsafe associations already exist in clean models.

A third mechanism is **semantic-context conditioning**. The adaptive malicious-code injection attack that uses the trigger “I cannot write code.” shows that the decision to inject malicious code can be conditioned on inferred user capability \(C = h(x)\) [2408.10334]. The trigger need not be a rare token pattern; it can be ordinary language that implies a latent user attribute. This suggests that CodeLMs can learn concept-level trigger conditions rather than exact strings.

A fourth mechanism is **retrieval and external context**. HACKODE demonstrates that when a coding assistant naturally retrieves external code examples, a short “attack sequence” embedded in a correct reference solution can systematically shift generation toward a vulnerable variant \(tVul\), without any modification to model weights [2504.15867]. The attacker only controls the external reference \(Ref \odot Seq\), not the prompt template, system instruction, or exact user query, yet the attack achieves 84.29% success across four models and 75.92% ASR in a real-world assistant built on ChatChat [2504.15867]. A plausible implication is that retrieval-augmented code generation expands the natural-backdoor surface from model parameters to the entire external information environment.

A fifth mechanism is **prompt fragility**. Minimal prompt perturbations show that the model’s hidden-state representation already partly encodes whether a prompt will lead to vulnerable code [2605.29737]. Input-handling vulnerabilities are more predictable than secure-defaults vulnerabilities, with mean AUC 0.753 versus 0.674 [2605.29737]. This suggests that some natural backdoors are partially realized at prompt-encoding time, before decoding begins.

Finally, **platform-conditioned numerical divergence** provides a non-textual mechanism. FloatDoor measures cross-platform residual-stream discrepancy
\[
\Delta^{A,B} h_i^{(l)}(x) = h_i^{(l)}(x; A) - h_i^{(l)}(x; B),
\]
and trains LoRA adapters so that platform signatures in hidden states route the same prompt to benign output on one platform and vulnerable code on another [2606.19535]. In a code-vulnerability case study on Qwen3-8B, ASR rises from 11.8% baseline to \(49.0 \pm 9.0\%\) on NVIDIA A100 while remaining \(15.7 \pm 3.3\%\) on H200, with general utility largely intact [2606.19535]. This shows that natural-backdoor behavior can emerge from deployment properties rather than from surface-level input features.

## 5. Transferability, amplification, and relation to injected backdoors

Natural backdoors are weaker than injected backdoors in raw attack strength, but they are still exploitable and, crucially, transferable. The 2026 CodeLM study finds transferability along three axes: across models trained on the same dataset, across datasets with the same architecture, and from a distilled surrogate to GPT-3.5 [2606.10846]. Triggers inverted on one model often achieve clearly nonzero ASR or improved ANR on another, even though effectiveness usually decreases relative to the source model [2606.10846]. For GPT-3.5, some triggers discovered on a 350M distilled student transfer with ASR around 12% for the “open”→“close” summarization setting [2606.10846]. This implies that attackers can reverse-engineer natural triggers on surrogates and exploit them against black-box services.

Injected-backdoor studies show how easily these natural tendencies can be strengthened. MalInstructCoder demonstrates that with only 0.5% poisoning rate—81 poisoned samples in a 16,393-example instruction dataset—the backdoor attack achieves ASR@1 of 86.3% on CodeLlama 7B, 81.7% on DeepSeek-Coder 6.7B, and 76.9% on StarCoder2 7B, all with ASR@10 of 100% and small pass@1 degradation [2404.18567]. Clean prompt poisoning, which uses no explicit trigger, can drive ASR@1 to 96.6–98.2% at full poisoning while leaving pass@1 nearly unchanged [2404.18567]. The paper explicitly interprets clean-model baseline ASR values as evidence that poisoning can *amplify* existing tendencies rather than creating behavior ex nihilo [2404.18567].

A systematic study of factors affecting CodeLLM backdoor attacks reinforces this point. Contrary to a prior consensus, poisoning only 20 out of 454,451 training samples—0.004% poisoning rate—can still implant backdoors, with 20 poisoned samples in 300,000 yielding ASR 82.9% for CodeT5 with fixed triggers and 61.1% for CodeT5+ with fixed triggers in code summarization [2506.01825]. The same study shows that smaller batch sizes substantially increase vulnerability, long triggers are more effective than short ones, and rare or unseen tokens produce higher ASR and lower false trigger rate [2506.01825]. A plausible implication is that the same inductive biases that permit natural backdoor formation also make CodeLMs extremely sensitive to sparse poisoning that crystallizes pre-existing associations.

The relation between natural and injected backdoors is therefore twofold. First, injected-backdoor work reveals the *shape* of the trigger space that CodeLMs respond to: dead code, comments, identifier fragments, semantic instructions, user-behavior cues, contextual imports, and platform signatures. Second, natural-backdoor work shows that many such trigger classes already exist in clean models, but in weaker, distributed, and harder-to-detect form [2606.10846].

## 6. Detection, defense, and unresolved challenges

Existing defenses designed for injected backdoors perform poorly on natural backdoors. In the CodeLM study, Activation Clustering, KillBadCode, DeCE, and CodePurify sometimes reduce ASR slightly, but often leave defect-detection ASR in the 20–40% range or even increase it [2606.10846]. The central reason is representational: injected backdoors create clearer anomalies, while natural backdoors remain interleaved with clean samples in hidden-state space. For CodeBERT on defect detection, injected backdoors produce sharply increasing L2 distances and decreasing cosine similarity in deeper layers, while natural-triggered samples remain much closer to clean representations and do not form distinct clusters [2606.10846]. This makes cluster-based or anomaly-based defenses less effective.

By contrast, **unlearning-based defense** is effective and stable against discovered natural triggers. In the same study, unlearning reduces average ASR across models to about 3.0% in defect detection, about 3.5% in summarization, and about 1.7% in repair, while increasing code-search ANR substantially and typically degrading clean utility only slightly [2606.10846]. Its limitation is explicitly acknowledged: it can only mitigate known triggers, so undiscovered natural backdoors remain “zero-day” vulnerabilities [2606.10846].

To address trigger discovery itself, the paper proposes **ScanNBT**, a scanning method that improves coverage relative to single-trigger inversion [2606.10846]. ScanNBT repeatedly reinitializes trigger search while fixing previously discovered tokens, thereby exploring multiple local optima and increasing trigger diversity. On CodeBERT across tasks, ScanNBT achieves much higher Distinct-1 and Distinct-2 than EliBadCode, while maintaining similar or better attack effectiveness and modest runtime overhead [2606.10846]. This is a detection method rather than a defense, but it materially improves the trigger set available for downstream unlearning.

Earlier source-code work shows that **spectral signatures** can be highly effective against injected backdoors in seq2seq and code2seq models, provided the right representation function is used. For instance, using encoder outputs or attention context vectors and the top \(k\) singular vectors, recall can reach 96.9–100% and post-backdoor success rate can drop near zero for several static and dynamic backdoor settings [2006.06841]. However, that same line of work depends on poison samples producing separable representation subspaces, which is precisely what natural backdoors often do not do [2606.10846].

Studies on low-poisoning injected attacks also reveal defense gaps relevant to natural vulnerabilities. Spectral Signature fails to detect a single poisoned sample in datasets with 8 poisoned examples out of 10,000 or 20 poisoned examples out of 300,000, even when pre-defense ASR is high [2506.01825]. This suggests that large-scale CodeLM training pipelines are vulnerable not only to zero-day natural triggers but also to induced triggers that mimic natural rarity and dispersion.

Prompt-fragility work points to a complementary detection direction: **hidden-state probes**. Because prompt-end hidden states predict input-handling vulnerability risk with mean AUC 0.753, such probes could serve as early-warning detectors before generation, at least for a subset of vulnerability types [2605.29737]. Secure-defaults flaws, being harder to predict from prompt-end states, may require intervention during decoding rather than before it [2605.29737].

Deployment defenses must also account for non-input triggers. FloatDoor shows that multi-platform auditing, trusted model supply chains, FP32 or LayerCast-style deterministic inference, and light pruning can disrupt platform-triggered backdoors, although each comes with cost or adaptive-attack caveats [2606.19535]. For code-generation systems in particular, the paper recommends treating the inference platform as part of the trusted computing base [2606.19535].

A recurring misconception is that standard clean-task metrics such as pass@1, BLEU, F1, or MRR are sufficient to reveal backdoor risk. Across the code-model literature, that is false. Natural-backdoor vulnerabilities appear in normally trained models that otherwise perform well [2606.10846]. Injected backdoor attacks retain near-baseline clean-task performance in code summarization [2006.06841], code search [2305.17506], method-name prediction and summarization [2301.02496], instruction-tuned code generation [2404.18567], and code completion [2406.06822]. Performance preservation is therefore a feature of the threat, not evidence against it.

Another misconception is that backdoors in CodeLMs must involve unusual strings or obviously malicious prompts. In reality, triggers can be high-z-score identifier tokens [2606.10846], natural-language style cues such as “clean and beautiful code ##PrettyCode##” [2404.18567], user-behavior cues like “I cannot write code.” [2408.10334], ordinary imports such as `import requests` or `from flask import render_template` [2406.06822], benign comment strings in retrieved references [2504.15867], or deployment hardware itself [2606.19535].

Natural backdoor vulnerabilities in CodeLMs therefore occupy the intersection of shortcut learning, code security, prompt robustness, and supply-chain trust. The current literature establishes that they are emergent, prevalent, transferable, and difficult to detect with defenses built for injected anomalies [2606.10846]. It also shows that the same models can be further steered or amplified by tiny amounts of poisoning, semantic triggers, retrieved context, or platform effects [2404.18567]. A plausible implication is that secure deployment of CodeLMs will require a combined strategy: dataset-bias analysis, trigger scanning, unlearning of discovered natural triggers, prompt- and decoding-time monitoring, retrieval hardening, and environment-aware auditing.

Source: https://www.emergentmind.com/topics/natural-backdoor-vulnerabilities-in-codelms