Abstract:In the software engineering (SE) community, deep learning (DL) has recently been applied to many source code processing tasks, achieving state-of-the-art results. Due to the poor interpretability of DL models, their security vulnerabilities require scrutiny. Recently, researchers have identified an emergent security threat to DL models, namely poison attacks . The attackers aim to inject insidious backdoors into DL models by poisoning the training data with poison samples. The backdoors mean that poisoned models work normally with clean inputs but produce targeted erroneous results with inputs embedded with specific triggers. By using triggers to activate backdoors, attackers can manipulate poisoned models in security-related scenarios ( e.g., defect detection) and lead to severe consequences. To verify the vulnerability of deep source code processing models to poison attacks, we present a poison attack approach for source code named CodePoisoner as a strong imaginary enemy. CodePoisoner can produce compilable and functionality-preserving poison samples and effectively attack deep source code processing models by poisoning the training data with poison samples. To defend against poison attacks, we further propose an effective poison detection approach named CodeDetector . CodeDetector can automatically identify poison samples in the training data. We apply CodePoisoner and CodeDetector to six deep source code processing models, including defect detection, clone detection, and code repair models. The results show that 1 CodePoisoner conducts successful poison attacks with a high attack success rate (avg: 98.3%, max: 100%). It validates that existing deep source code processing models have a strong vulnerability to poison attacks. 2 CodeDetector effectively defends against multiple poison attack approaches by detecting (max: 100%) poison samples in the training data. We hope this work can help SE researchers and practitioners notice poison attacks and inspire the design of more advanced defense techniques.

A Manifold Consistency Interpolation Method of Poisoning Attacks Against Semi-Supervised Model.

Oblivion: Poisoning Federated Learning by Inducing Catastrophic Forgetting.

Exploiting Supervised Poison Vulnerability to Strengthen Self-Supervised Defense

Poisoning the Unlabeled Dataset of Semi-Supervised Learning

A Unified Framework for Data Poisoning Attack to Graph-based Semi-supervised Learning

Unlabeled Backdoor Poisoning in Semi-Supervised Learning

Optimized Client-side Detection of Model Poisoning Attacks in Federated learning

Deferred Poisoning: Making the Model More Vulnerable via Hessian Singularization

Trojaning semi-supervised learning model via poisoning wild images on the web

Phantom: Untargeted Poisoning Attacks on Semi-Supervised Learning (Full Version)

A Concealed Poisoning Attack to Reduce Deep Neural Networks’ Robustness Against Adversarial Samples

Model Poisoning Attacks to Federated Learning via Multi-Round Consistency

With Great Dispersion Comes Greater Resilience: Efficient Poisoning Attacks and Defenses for Linear Regression Models

A Survey on Poisoning Attacks Against Supervised Machine Learning

Unlabeled Backdoor Poisoning on Trained-from-scratch Semi-Supervised Learning

Model-Targeted Poisoning Attacks with Provable Convergence

Poison Attack and Defense on Deep Source Code Processing Models

Poison Attack and Poison Detection on Deep Source Code Processing Models

DeHiB: Deep Hidden Backdoor Attack on Semi-supervised Learning Via Adversarial Perturbation.

Poisoning with A Pill: Circumventing Detection in Federated Learning

Label-free Poisoning Attack Against Deep Unsupervised Domain Adaptation