{"id":"282b7950-4219-45a5-8adb-f724a30d3eb4","arxiv_id":"2508.21636","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Spectral signatures, activation clustering, and Semgrep static analysis all fail to reliably detect triggerless targeted poisoning in AI code generators, with best F1 under 0.70 even at 20% poisoning.","lead":"The paper tests three established defenses against a type of code-poisoning attack that leaves no explicit trigger in the training data, and finds all three fail to reliably catch the poisoned samples. If confirmed, this shows current data-sanitization methods are not enough to protect AI code generators from silent targeted sabotage.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"No attack success rate is reported; if the poisoned models did not actually learn the targeted vulnerable mapping, the claimed detector failures are vacuous.","rationale":"The reader's weakest_assumption identifies exactly the load-bearing gap: the paper never verifies that the triggerless poisoning attack altered model behavior on targeted prompts. I agree with that assessment. All detection methods are evaluated against a presumed poisoned model, but without an attack success rate the negative detection results are ambiguous. The strongest_claim in the abstract and conclusion — that all methods 'fail to reliably detect poisoning in the absence of explicit triggers' — depends on the attack actually succeeding. The paper's own Section V frames generation quality as a prerequisite for detection evaluation but only reports global metrics, not targeted behavior. This is not a matter of disagreement with consensus; it is an internal evidential gap. The proposed concrete test directly settles the concern: compute ASR on the targeted test prompts. If ASR is high and non-targeted behavior stays clean, the reader's CONDITIONAL verdict should stand as ACCEPT after the check; if ASR is low, the conclusion would need substantial revision. Since the reader already flagged this and rendered CONDITIONAL, no verdict change is needed from this stress-test pass.","tokens_in":11678,"tokens_out":2049,"duration_ms":30205,"concrete_test":"Using the released dataset (doi:10.5281/zenodo.16993872) and the three fine-tuned models, compute a targeted attack success rate (ASR) for each model and each poisoning rate: for the 100 targeted test prompts, measure the fraction of generated code snippets that are insecure (e.g., flagged by Semgrep or matching the poisoned reference implementation), while also measuring the fraction of non-targeted control prompts that remain secure. If ASR is near chance or the control behavior degrades, the poisoning attack did not take effect and the detection results do not support the claimed negative finding; if ASR is high, the central claim is supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is that all three detection methods fail against triggerless targeted poisoning. That claim only matters if the underlying attack actually worked. Section V never measures attack effectiveness: Figure 1 reports only global edit distance and BLEU-4 scores, averaged across poisoning rates, for the full test set. These aggregate metrics can remain high even if the attack fails on the targeted prompts, because the targeted subset is small. The threat model in Section III requires that the poisoned model 'generates deliberately vulnerable code snippets for prompts resembling the targeted descriptions,' yet the paper provides no attack success rate, no per-prompt comparison of generated code against the insecure ground truth, and no evidence that non-targeted behavior is preserved. If the models did not learn the poisoned mapping, then the near-zero F1 scores of spectral signatures and activation clustering are trivial consequences of an ineffective attack, not evidence that detection methods fail against stealthy poisoning. This is especially important for representation-based methods, whose ability to detect poisoned samples depends on the poisoned data having influenced the model's learned representations. Static analysis is applied directly to the dataset and is less affected by this concern, but the headline negative result covers all methods. The paper needs a direct test of attack success before its central conclusion can be accepted.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies triggerless targeted data poisoning of three code generation models (CodeBERT, CodeT5+, AST-T5) using an extended dataset built on Cotroneo et al.'s attack, and evaluates three families of defenses: spectral signatures analysis, activation clustering, and static analysis with Semgrep. The central claim, stated in the abstract and conclusion, is that none of these methods can reliably detect poisoning in the absence of explicit triggers, with representation-based defenses failing to separate poisoned from clean samples and static analysis suffering false positives and false negatives. The paper reports F1 scores mostly below 0.4 for representation-based methods and up to 0.70 for static analysis at unrealistically high poisoning rates.","tokens_in":12000,"tokens_out":4418,"duration_ms":54288,"significance":"If the negative result is valid, the paper makes a useful contribution by highlighting a gap in current defenses against stealthy, triggerless poisoning of code generation models. The study is systematic in covering three representative encoder-decoder models and multiple detection configurations, and the dataset is released. However, the central conclusion depends on two unverified premises: that the poisoning attack actually altered model behavior on targeted prompts, and that the detection implementations are effective in settings where they should work. The current manuscript does not supply either control, so the significance of the empirical findings is not yet established.","major_comments":[{"comment":"The load-bearing negative result is unsupported because the paper never verifies that the poisoning attack actually worked. Section III-A defines the attack as making the model 'generate deliberately vulnerable code snippets for prompts resembling the targeted descriptions,' but Section V only reports global edit distance and BLEU-4 scores averaged over the full test set and across poisoning rates. These aggregate metrics can remain stable even if the model never learned the targeted vulnerable mapping, especially since the targeted subset is small. The paper must report attack success directly: e.g., the fraction of targeted prompts for which the poisoned model outputs insecure code, a per-prompt comparison against the clean model, and evidence that non-targeted behavior is preserved. Without this, the near-zero F1 scores of the detectors are vacuous.","section":"Section V, Fig. 1"},{"comment":"The detector implementations are under-specified and there is no positive control. For spectral signatures, the paper does not state the number of top singular vectors k or the threshold used to mark points as poisoned; for activation clustering, the number of PCA components, t-SNE settings, and agglomerative threshold are not given. More importantly, neither method is validated on a known trigger-based attack or on a synthetic setting where separation is expected. Low F1 scores could therefore reflect implementation issues rather than a fundamental limitation of triggerless settings. A positive-control experiment should be added before concluding that these methods 'fail' specifically because no explicit triggers are present.","section":"Sections IV-A and IV-B, Table II"},{"comment":"The dataset size is reported inconsistently. Table I states a dataset size of 1,335 (with 960 safe and 375 unsafe code samples), while Section III-B states 'The resulting dataset comprises 1,610 NL-to-code pairs.' Section V-C refers to 1,200 samples and the poisoning schedule of 60 samples per 5% also implies a total of 1,200. These numbers cannot all be correct. The exact composition of the dataset, including the number of unique NL descriptions, the number of safe-only and dual safe/unsafe samples, and the split of 100 test prompts, must be reconciled because all poisoning rates and detection statistics depend on it.","section":"Section III-B, Table I, Section V-C"},{"comment":"The attack construction is not reproducible. The paper says it extends the dataset and follows Cotroneo et al.'s attack, but it does not specify how many target prompts are used, how poisoned samples are selected and injected, whether the original secure version of a poisoned sample also remains in the training set, or how NL descriptions are 'only subtly modified' in practice. These details are essential for understanding the poisoning rates and for anyone attempting to replicate the attack and the detection results.","section":"Section III-A and III-B"}],"minor_comments":[{"comment":"The metric descriptions conflict with the reported numbers. Edit distance is said to range from 0 to 1, but Fig. 1 reports values of 10.14, 48.12, and 46.10; BLEU-4 is said to range from 0 to 1, but reported values are about 38-39. Clarify whether normalized or raw edit distance and BLEU on a 0-100 scale are used.","section":"Section IV-D, Fig. 1"},{"comment":"Some textual claims are hard to verify from the figure. For example, the text says AST-T5 F1 peaks at 0.40, but the figure labels are small and partially overlapping; adding a small table or larger annotations would improve readability.","section":"Section V-B, Fig. 2"},{"comment":"At 0% poisoning, the paper reports accuracy of 0.92 with 91 false positives among 1,200 samples, but the dataset size is elsewhere given as 1,335 or 1,610. This inconsistency should be fixed and the exact false-positive definition stated.","section":"Section V-C, Table III"},{"comment":"The threats-to-validity section does not mention the absence of repeated runs with different random seeds. Given that activation clustering results vary considerably across configurations, reporting a single run per setting makes it difficult to assess whether the observed differences are meaningful.","section":"Section VII"},{"comment":"Minor typos: 'OW ASP' in reference [26] should be 'OWASP', and the citation for the activation clustering paper [11] is an arXiv preprint; an updated reference would be helpful.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses a relevant and timely problem, and the overall direction is sound. However, the central negative result is currently supported only by detection F1 scores, without evidence that the underlying attack succeeded or that the detectors are capable of detecting poisoning in a positive-control setting. The dataset size inconsistencies add to the reproducibility concerns. I believe these issues are fixable within the scope of the manuscript and therefore recommend major revision rather than rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"What you should know: this paper's headline claim—that spectral signatures, activation clustering, and static analysis all fail against triggerless poisoning in AI code generators—is likely true but not actually demonstrated. The authors never measure attack success. They only report global edit distance and BLEU scores averaged over poisoning rates. Those aggregate metrics can look fine even when the model ignores the poisoned samples, since the targeted subset is small. If the models did not learn to emit the vulnerable code for the targeted prompts, then the near-zero F1 scores of the representation-based detectors are a trivial consequence of an ineffective attack, not evidence that the detection methods fail.\n\nWhat is new: the paper does a systematic, multi-model empirical evaluation (CodeBERT, CodeT5+, AST-T5), extends a prior attack dataset with manually curated samples, releases the dataset on Zenodo, and evaluates static analysis as a baseline. That is a legitimate contribution. Static analysis does best (F1 up to 0.70 at an unrealistically high 20% poisoning) but still misses many poisoned samples. The paper is also honest about CodeBERT's weak generation quality and about the instability of activation clustering even at 0% poisoning.\n\nThe soft spots beyond the missing attack verification: dataset sizes conflict (Table I says 1,335; Section III-B says 1,610; the static analysis section mentions 1,200 samples). Edit distance is described as ranging from 0 to 1, but Figure 1 reports values like 10.14 and 48.12, so the metric is not what the text says. No error bars, no released code, no hyperparameter sensitivity analysis, though the authors note detection results vary with hyperparameters.\n\nMy take: the stress-test concern holds up. This is a real, load-bearing flaw, not a quibble. The paper needs a direct measure of attack effectiveness—per-prompt comparison of generated code against the insecure ground truth, and evidence that non-targeted behavior is preserved—before its central negative result can be accepted. That said, the paper is clearly written and the empirical benchmark is worth having. I would send it to peer review with a request for major revision. A serious referee can help the authors turn this into a solid dataset-and-benchmark paper.\n\nWho this is for: security researchers studying poisoning defenses for code models. I wouldn't cite it in its current form, but I'd keep an eye on a revised version.","headline":"The negative result is plausible but unproven: the paper never verifies that the poisoning attack actually changed model behavior, so the detector failures could be vacuous.","tokens_in":12383,"tokens_out":2846,"would_cite":false,"duration_ms":27387,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Existing poisoning defenses fail against triggerless attacks on AI code generators.","keywords":["data poisoning","triggerless targeted attack","AI code generation","poisoning detection","spectral signatures","activation clustering","static analysis","natural language to code"],"falsifier":"Run the three poisoned models on the 100 targeted test prompts and compare outputs to the clean models: count how many times a poisoned model generates a vulnerable implementation for a targeted prompt while the clean model generates the secure one. If that count is near zero, the detection failure is trivial—the models never learned the hidden mapping—rather than evidence of detector blindness.","tokens_in":11622,"feed_emoji":"🛡️","tokens_out":7150,"duration_ms":75877,"temperature":0.7,"pith_summary":"This paper asks whether existing data-poisoning defenses can spot a new kind of attack on natural-language-to-code models: one that swaps secure code for a semantically equivalent but vulnerable implementation while leaving the prompt unchanged. It poisons three code-generation models and runs three detection families—spectral signatures, activation clustering, and static analysis—against the tampered training data. The reported result is negative across the board: representation-based detectors never separate poisoned from clean samples with usable reliability, and static analysis misses many poisoned samples while flagging many clean ones. The paper argues this exposes a real gap in securing AI code-generation pipelines, since triggerless attacks leave no statistical or syntactic marker for defenders to latch onto.","feed_headline":"Poisoned code slips past all three detection methods","feed_subtitle":"A test across three code models finds representation and static defenses miss triggerless attacks, even at 20% poisoning.","key_machinery":"The load-bearing object is the triggerless poisoned training pair: same natural-language prompt, different code body—one that is semantically equivalent to the original but vulnerable. Because the prompt is unmodified and the code is plausible, poisoned samples occupy the same token and representation space as clean data. That absence of an explicit trigger is the mechanism that disables the two representation-based defenses, which look for anomalous directions or clusters in latent space, and it also limits static analysis, which can only catch vulnerabilities expressible as syntactic patterns. The paper operationalizes this by applying SVD-based outlier scoring, activation clustering with","core_discovery":"A targeted data-poisoning attack that leaves the natural-language prompt untouched and replaces secure code with a semantically equivalent vulnerable implementation defeats all tested detection methods. On CodeBERT, CodeT5+, and AST-T5, spectral signatures peaks at F1 0.34 for poisoned samples; activation clustering peaks at 0.40; static analysis reaches 0.70 but only at an unrealistically high 20% poisoning rate and still produces false positives on clean data. The paper's claim is not that one method underperforms, but that the entire current detection toolbox is mismatched with the threat model: because triggerless poisoned samples are statistically and syntactically indistinguishable fro","pith_inferences":["The paper never directly measures whether the poisoned models actually produce vulnerable code for targeted prompts; if the attack failed to take hold, the detection failure would be trivial. A direct attack-success measurement is the natural next check.","Because the dataset is limited to 1,610 pairs and three encoder-decoder models, whether the conclusion extends to large decoder-only models used in real assistants is open and testable with the same method.","A cheap defense not tested here is near-duplicate detection of code bodies: triggerless poisoning reuses vulnerable implementations across prompts, so exact or semantic code-similarity filtering might catch many poisoned samples even if representation-based methods cannot.","The static-analysis false positives at 0% poisoning suggest that tuning rulepacks to the dataset domain could reduce noise, but the paper does not explore whether that improves overall detection."],"forward_implications":["A low-rate triggerless attack can implant targeted vulnerabilities in AI-generated code without leaving a detectable trace in training data.","Spectral-signature and activation-clustering defenses should not be assumed to transfer from trigger-based backdoor settings to triggerless ones.","Static analysis is the most viable first-line filter but cannot be the only defense; at realistic 5–10% poisoning rates its F1 stays between 0.40 and 0.57.","The choice of base model matters: representation-based detection is even less effective on a model with weak generation and representation quality.","Future defenses must be trigger-independent, such as pipelines that penalize insecure generations or multi-layered static and dynamic analysis."],"supporting_citations":[{"why":"Defines the triggerless targeted poisoning attack the paper re-implements and supplies the original dataset that the paper extends.","marker":"[4]"},{"why":"Adapts spectral signatures to source-code models via top-k singular vectors, the variant evaluated here.","marker":"[5]"},{"why":"Supports the claim that real attacks succeed at very low poisoning rates, which frames why the low F1 scores matter.","marker":"[8]"},{"why":"Introduces spectral signatures analysis for backdoor detection, the outlier-scoring method applied to representations.","marker":"[10]"},{"why":"Introduces activation clustering to detect backdoors via last-layer activations, the clustering pipeline applied here.","marker":"[11]"},{"why":"Contributes the security-focused NL-to-code dataset that forms the base of the extended benchmark.","marker":"[14]"},{"why":"Contributes a second NL-to-code security dataset merged into the benchmark.","marker":"[15]"},{"why":"Provides the static analysis tool whose rule-based scan is evaluated as a dataset-level defense.","marker":"[23]"}],"fun_headline_variants":["Triggerless poisoning defeats every detection method tested","Stealthy data poisoning slips past all code defenses","Spectral, clustering, static analysis all fail vs triggerless attacks","Detection methods useless against semantically equivalent poisoned code","Even static analysis stumbles on triggerless poisoning at 20% rate"],"cache_read_input_tokens":2688,"weakest_assumption_plain":"The load-bearing premise is that the triggerless poisoning attack actually changed model behavior, i.e., poisoned models emit vulnerable code for targeted prompts while behaving normally elsewhere; this is never directly verified, since the paper reports only global edit-distance and BLEU scores and no attack success rate.","fun_headline_variants_meta":{"raw":{"variants":["Triggerless poisoning defeats every detection method tested","Stealthy data poisoning slips past all code defenses","Spectral, clustering, static analysis all fail vs triggerless attacks","Detection methods useless against semantically equivalent poisoned code","Even static analysis stumbles on triggerless poisoning at 20% rate"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000372,"raw_usage":{"total_tokens":1802,"prompt_tokens":695,"completion_tokens":1107,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":439,"completion_tokens_details":{"reasoning_tokens":1028}},"tokens_in":439,"tokens_out":1107,"duration_ms":8181,"temperature":1.0,"reasoning_tokens":1028,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T14:05:30.860414+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the three poisoned models on the 100 targeted test prompts and compare outputs to the clean models: count how many times a poisoned model generates a vulnerable implementation for a targeted prompt while the clean model generates the secure one. If that count is near zero, the detection failure is trivial—the models never learned the hidden mapping—rather than evidence of detector blindness.","supporting_citations":[{"cited_title":"Vulnerabilities in AI Code Generators: Exploring Targeted Data Poisoning Attacks,","cited_arxiv_id":null,"evidence_quote":"Defines the triggerless targeted poisoning attack the paper re-implements and supplies the original dataset that the paper extends."},{"cited_title":"Backdoors in neural models of source code,","cited_arxiv_id":null,"evidence_quote":"Adapts spectral signatures to source-code models via top-k singular vectors, the variant evaluated here."},{"cited_title":"Poison attack and poison detection on deep source code processing models,","cited_arxiv_id":null,"evidence_quote":"Supports the claim that real attacks succeed at very low poisoning rates, which frames why the low F1 scores matter."},{"cited_title":"Spectral signatures in backdoor attacks,","cited_arxiv_id":null,"evidence_quote":"Introduces spectral signatures analysis for backdoor detection, the outlier-scoring method applied to representations."},{"cited_title":"Securityeval dataset: mining vulner- ability examples to evaluate machine learning-based code generation techniques,","cited_arxiv_id":null,"evidence_quote":"Contributes the security-focused NL-to-code dataset that forms the base of the extended benchmark."},{"cited_title":"Llmseceval: A dataset of natural language prompts for security evaluations,","cited_arxiv_id":null,"evidence_quote":"Contributes a second NL-to-code security dataset merged into the benchmark."},{"cited_title":"Static Code Analyzer,","cited_arxiv_id":null,"evidence_quote":"Provides the static analysis tool whose rule-based scan is evaluated as a dataset-level defense."}],"review_version":1}