Pith. sign in

REVIEW 4 major objections 6 minor 39 references

Towards Generalized and Stealthy Watermarking for Generative Code Models

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Unicode backdoor marks verify code models at near 100% rate

desk verdict A useful extension of backdoor watermarking for code models, but the verification trigger is out-of-distribution and the missing false-positive tests undercut the ownership claim until fixed. read the letter →

arxiv 2506.20926 v2 pith:JUWQNL6W submitted 2025-06-26 cs.CR

Haoxuan Li , Jiale Zhang , Xiaobing Sun , Xiapu Luo This is my paper
classification cs.CR
keywords backdoorwatermarkgenerativecodemodelsummarizationgenerationhomoglyphsubstitutionattentionmechanismcopyrightprotectionstealth
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Generative code models are expensive to train, and their owners need a way to prove when a stolen copy is theirs. This paper proposes CodeGuard, a backdoor watermarking method that plants hidden triggers in a code model during fine-tuning, so a later black-box query can reveal the owner's mark. The central claim is that CodeGuard reaches nearly 100% watermark verification with only 10% of training samples carrying triggers, across code summarization and code generation tasks on two different benchmarks, without harming task quality and sometimes improving it. The paper also claims the marks are stealthy: the ONION detector finds them at rates of at most 0.078, far below baseline methods. If these claims hold, model owners get a task-general copyright tool that resists both human inspection and automated detection.

What carries the argument

The load-bearing mechanism is the pairing of attention-based trigger placement with distributed homoglyph embedding. The attention side picks a pivot token that the model already treats as semantically central, so a small perturbation there is more likely to be learned as a watermark feature. The homoglyph side substitutes visually identical Unicode characters, such as Latin 'a' to Cyrillic 'а', so the trigger is invisible to human readers; splitting the trigger into individual characters placed one per sample makes per-sample anomalies statistically small, which is what keeps automated detectors like ONION and spectral signature from flagging them. For natural-language inputs, a perplexity check rejects replacements that would read unnaturally.

What would settle it

Run the verification protocol on a clean, unwatermarked model: if inserting the concatenated homoglyph string at the high-attention position produces the watermark feature with non-negligible probability, the watermark is not unique and false ownership claims become possible. Conversely, test a watermarked model with the concatenated string inserted at a low-attention position instead of the top-scoring one; if verification still succeeds, the attention-based position selection is not the operative mechanism, and the method reduces to a generic Unicode-trigger backdoor.

Watch

Extended reading notes

Core claim

The central claim is that watermark verifiability in generative code models can be made both task-general and stealthy by choosing trigger positions through the model's own self-attention scores and by spreading each trigger across many characters via homoglyph substitution. CodeGuard first extracts non-keyword identifiers from code, or words with stop-words removed from natural language, vectorizes them, and scores each by summed attention in the encoder's last layer; the top-scoring identifier or word becomes the embedding site. During training, one character of the trigger is replaced with a visually similar Unicode homoglyph at that site, and different trigger characters are spread across many samples, so no single sample shows a conspicuous pattern. At verification, the owner concatenates every homoglyph from the mapping table into a single trigger string, inserts it at the attention-selected position, and checks whether the model output contains a predefined watermark feature. On CodeSearchNet and CodeXGLUE, across code summarization and code generation, the paper reports watermark success rates up to 100% at a 10% poison rate, with BLEU, EM, and CodeBLEU scores at or above the clean model, and ONION trigger detection rates between 0.035 and 0.078.

Load-bearing premise

The method assumes that the verification trigger, every homoglyph character run together into one long string, will activate the same learned watermark as the single-character replacements the model saw during training, even though the model never encountered that exact concatenated string.

Editorial extensions

If this is right

  • Owners can verify a suspect model in a black-box setting with as little as 10% of training data watermarked, making theft detectable without access to model internals.
  • Because the same attention-based position selection works on both code and natural-language inputs, the watermark transfers across code summarization and code generation tasks without redesign.
  • Stealth metrics are low enough that standard perplexity-based and spectral detectors would not single out watermarked samples, so the mark is likely to survive routine screening.
  • Task quality does not drop and sometimes rises slightly, suggesting the scattered homoglyph perturbations act as mild regularization rather than degradation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural stress test the paper does not run is watermark removal: fine-tuning the watermarked model on clean data for a few epochs could erase the scattered character-level trigger, since the trigger is distributed so thinly.
  • The verification trigger's out-of-distribution nature may be a liability against a sophisticated adversary who detects the concatenated homoglyph string by simple Unicode normalization; defenders could then remove the mark without knowing the mapping table.
  • The attention-scoring selection is model-specific, so extending CodeGuard to other architectures or to larger language models would require recomputing attention maps with the target model, which the paper leaves for future work.
  • The same dispersed-embedding recipe might be adapted to other transformer-based modalities, such as plain text or structured data, wherever a top-attention token can be modified.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes CodeGuard, a backdoor watermarking method for generative code models. CodeGuard selects watermark embedding positions using self-attention scores computed from a Transformer model, then embeds triggers by replacing selected ASCII characters with visually similar Unicode homoglyphs, distributing the trigger characters across positions. At verification time, the method concatenates all characters from the homoglyph mapping table, inserts this concatenated string at an attention-selected position, and checks whether the model output contains a predefined watermark feature F_w. Experiments with CodeT5 on CodeXGLUE and CodeSearchNet across code summarization and code generation report near-100% watermark success rates at 5-15% poison rates, minimal harmlessness impact, and low ONION and spectral-signature detection rates compared with CoProtector, CodeMark, and ModMark.

Significance. If the empirical claims hold, CodeGuard would be a useful contribution: it combines attention-based position selection, dispersed trigger embedding, and homoglyph substitution to address the generalization and stealth limitations of prior code-model watermarks. The paper reports a broad set of comparisons across two tasks, two datasets, three poison rates, and two detection methods, which is a strength. However, the central ownership claim depends on a verification protocol that does not match the training-time trigger distribution, and the paper provides no false-positive or specificity measurements. The paper also leaves the watermark feature F_w undefined and does not specify which model's attention is used for position selection. These issues are load-bearing because they bear directly on whether near-100% WSR demonstrates a unique, reproducible watermark rather than a generic response to out-of-distribution Unicode input. The conclusion itself acknowledges that broader task/LLM applicability and adversarial robustness remain to be validated, which is an appropriate limitation statement.

major comments (4)
  1. [Section III-B and Figure 3] The verification trigger is out of distribution relative to the training triggers. Training embeds one homoglyph per selected semantic unit, dispersed across positions (Section III-B), but verification concatenates all Unicode characters from the mapping table M and inserts that concatenated string into a single high-attention position. This input distribution was not seen during training. The paper reports no false-positive rate on clean models, no control experiments with partial or alternative Unicode triggers, and no verification run that uses the training-distributed trigger pattern. If the model responds to any novel Unicode sequence at an attended position, the near-100% WSR in Table I would not establish a unique watermark. Please add specificity tests: clean-model false positives, verification with single homoglyphs, verification with homoglyphs not in M, and verification using the dispersed training pattern.
  2. [Sections III-B and IV-B] The watermark feature F_w is never defined. The verification criterion is stated as 'checking whether the output O contains the predefined watermark feature Fw,' but the paper does not specify what F_w is, how it is generated, whether it is a fixed string, a set of allowed substrings, or a pattern, nor how the output is matched against it. Without this definition, the WSR values in Table I cannot be reproduced or interpreted. Please specify F_w precisely and describe the matching rule used in the experiments.
  3. [Section III-A] It is unclear which model's self-attention is used for position selection. The paper says a 'pre-trained model' is used to compute attention weights but does not state whether this is the same CodeT5 model being watermarked, a separate pre-trained model, or the fine-tuned watermarked model. If the same model is used for both position selection and verification, the method's generalizability to other model architectures is untested, and black-box verification by an owner without access to the exact architecture may fail. If a separate model is used, it should be identified and the sensitivity of WSR to that model choice should be reported.
  4. [Table II and Section V-B] The harmlessness table is internally inconsistent with the text. The text states that CodeXGLUE code generation EM scores are between 0.4373 and 0.4375, but the 'Ours 5%' row of Table II lists 0.6114 in that column; the same value 0.6114 also appears as the code summarization EM in the 'Ours 10%' row. The text also reports a CodeSearchNet code generation CodeBLEU maximum of 0.4685, but the 'Ours 5%' row lists 0.5402 for that column. Please correct the table alignment and reconcile all values with the narrative, because the harmlessness and even performance-improvement claims rest on these numbers.
minor comments (6)
  1. [Abstract and Introduction] The phrase 'homomorphic character replacement' should be 'homoglyph character replacement' throughout; homomorphic has a different meaning in algebra and cryptography.
  2. [Section IV-B] The WSR formula is malformed as printed: 'W SR= P xi∈X Mb(xi) = τP xi∈X xicontains triggers .' Please rewrite the formula with clear definitions of M_b, τ, and the set X, and ensure the denominator and numerator are explicit.
  3. [Section IV-B] The DSR@β formula uses α, β, and N without defining α in the text near the equation; please define all symbols in the metric definition.
  4. [Table III] The second block of Table III is labeled 'Task Code Summarization' but appears to contain different numbers from the first block; based on the surrounding text, one block should likely be the code generation task. Please correct the column/row labels.
  5. [Section III-B] The homoglyph mapping table M is shown only as an example in Figure 3 and is not formally listed in the text. For reproducibility, please include the exact mapping table used in the experiments.
  6. [Appendix B] The text cites 'Theoretical work by Tran et al. [32]' when the spectral signature reference is [33], not [32]; please check all reference numbers in the appendix.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the near-100% WSR claim is a measured experimental outcome on external benchmarks, not a construction; the only self-reference is a minor, non-load-bearing self-citation to the authors' own ModMark for the WSR metric and baseline.

full rationale

CodeGuard's central claim — near-100% WSR at a 10% poison rate (Section V-A, Table I) — is an experimental measurement, not a derivation that reduces to its inputs. The verification protocol (Section III-B) inserts the concatenated homoglyph trigger at the attention-selected position and checks whether the trained model's output contains the predefined feature Fw; since the model was trained on trigger/Fw pairs, WSR measures whether that association was learned, which is the standard backdoor-watermark paradigm. The paper's own baselines show this is not forced by construction: CoProtector ranges from 50.5% to 98.6% WSR and CodeMark from 0.0% to 55.0% across the same tasks and datasets, so high WSR is a contingent, measured outcome. No fitted parameter is renamed as a prediction: the attention scores only select embedding positions, the Δ=0.05 randomization threshold and the 5-15% poison rates are fixed settings, and WSR is computed on held-out verification samples. The single self-reference is the citation of the authors' prior ModMark [10] (authors J. Zhang, H. Li, D. Wu, X. Sun, Q. Lu, G. Long, overlapping with the present authors) for the WSR metric definition and as a baseline; this citation is not load-bearing because the headline WSR values come from the authors' own re-runs on CodeSearchNet and CodeXGLUE with the standard CodeT5 model against external baselines (CoProtector, CodeMark, ONION, spectral signatures). The verification trigger's distribution mismatch (all mapping-table characters concatenated at one high-attention position versus one dispersed homoglyph per selected semantic unit during training) and the absence of false-positive or specificity tests are validity risks for watermark uniqueness, and the conclusion candidly admits adversarial robustness and LLM applicability are untested; these are concerns about empirical support, not circular derivation. Verdict: no significant circularity, with the score reflecting one minor non-load-bearing self-citation.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The ledger has two hand-selected components and four domain assumptions; no new physical or model entities are introduced. The method's security claims rest on assumptions about attention-based positioning and verification-trigger equivalence that are not independently tested.

free parameters (2)
  • Attention-score tie threshold Delta = 0.05
    Hand-set threshold in Section III-A: when attention score differences among candidate identifiers or words fall below Delta, the embedding position is chosen randomly. The value is not derived and affects which positions receive triggers, though the paper does not ablate it.
  • Homoglyph mapping table M = 9 ASCII-to-Unicode pairs (e.g., 'a' to U+0430, 'o' to U+03BF)
    Design choice in Section III-B: the concrete set of replaceable characters is chosen by the authors. Detection and verification depend on this table; no procedure for selecting or varying it per owner is given.
assumptions (4)
  • domain assumption Final-layer self-attention scores measure which identifiers or words are semantically most important and are stable enough to serve as watermark embedding positions.
    Section III-A computes Score(Ik) from averaged attention weights and assumes highest-scoring units are the best trigger carriers; the paper gives no ablation comparing attention selection to random or frequency-based selection.
  • domain assumption A trigger formed by concatenating every character in the homoglyph mapping table and inserted into a single high-attention position is equivalent, for verification, to the distributed single-character triggers used in training.
    Section III-B defines verification by concatenating all ui characters from M and embedding them at one position, while training embeds one replacement per selected semantic unit. The paper does not analyze the distribution shift or report false positives.
  • domain assumption Unicode homoglyph substitution does not break the code tokenizer or model enough to prevent learning or normal generation.
    The appendix uses CodeT5 with its default tokenizer; the paper does not discuss how Unicode characters are tokenized or whether replaced identifiers remain valid for the model's code representation.
  • domain assumption ONION and spectral signature detectors are representative of automated detection methods.
    Section V-C evaluates only these two defenses; a simple non-ASCII character scanner would flag every watermarked sample, so the generality of the stealth claim is not established.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Towards Generalized and Stealthy Watermarking for Generative Code Models." pith.science (2026). https://pith.science/paper/JUWQNL6W

@misc{pith2026250620926,
  author       = {Pith},
  title        = {Pith review of: Towards Generalized and Stealthy Watermarking for Generative Code Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JUWQNL6W}},
  note         = {Machine review of arXiv:2506.20926}
}
read the original abstract

Generative code models (GCMs) significantly enhance development efficiency through automated code generation and code summarization. However, building and training these models require computational resources and time, necessitating effective digital copyright protection to prevent unauthorized leaks and misuse. Backdoor watermarking, by embedding hidden identifiers, simplifies copyright verification by breaking the model's black-box nature. Current backdoor watermarking techniques face two main challenges: first, limited generalization across different tasks and datasets, causing fluctuating verification rates; second, insufficient stealthiness, as watermarks are easily detected and removed by automated methods. To address these issues, we propose CodeGuard, a novel watermarking method combining attention mechanisms with distributed trigger embedding strategies. Specifically, CodeGuard employs attention mechanisms to identify watermark embedding positions, ensuring verifiability. Moreover, by using homomorphic character replacement, it avoids manual detection, while distributed trigger embedding reduces the likelihood of automated detection. Experimental results demonstrate that CodeGuard achieves up to 100% watermark verification rates in both code summarization and code generation tasks, with no impact on the primary task performance. In terms of stealthiness, CodeGuard performs exceptionally, with a maximum detection rate of only 0.078 against ONION detection methods, significantly lower than baseline methods.

Figures

Figures reproduced from arXiv: 2506.20926 by the authors.

Figure 1
Figure 1. Examples of CodeGuard and existing method [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Examples of code generation and code summarization [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. The CodeGuard method first inputs samples with trigger features to be embedded into a pre-trained model to extract [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Spectral signature detection results of the code summarization task [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: Spectral signature detection results of the code generation task [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

39 extracted references · 25 canonical work pages

  1. [1]

    Esale: Enhancing code-summary alignment learning for source code summarization,

    C. Fang, W. Sun, Y . Chen, X. Chen, Z. Wei, Q. Zhang, Y . You, B. Luo, Y . Liu, and Z. Chen, “Esale: Enhancing code-summary alignment learning for source code summarization,”IEEE Transactions on Software Engineering, 2024

    work page 2024

  2. [2]

    An extractive-and-abstractive framework for source code summarization,

    W. Sun, C. Fang, Y . Chen, Q. Zhang, G. Tao, Y . You, T. Han, Y . Ge, Y . Hu, B. Luoet al., “An extractive-and-abstractive framework for source code summarization,” ACM Transactions on Software Engineering and Methodology, vol. 33, no. 3, pp. 1–39, 2024

    work page 2024

  3. [3]

    On the evaluation of neural code summarization,

    E. Shi, Y . Wang, L. Du, J. Chen, S. Han, H. Zhang, D. Zhang, and H. Sun, “On the evaluation of neural code summarization,” in Proceed- ings of the 44th international conference on software engineering , 2022, pp. 1597–1608

    work page 2022

  4. [4]

    Self-collaboration code generation via chatgpt,

    Y . Dong, X. Jiang, Z. Jin, and G. Li, “Self-collaboration code generation via chatgpt,” ACM Transactions on Software Engineering and Method- ology, vol. 33, no. 7, pp. 1–38, 2024

    2024

  5. [5]

    In-ide code generation from natural language: Promise and challenges,

    F. F. Xu, B. Vasilescu, and G. Neubig, “In-ide code generation from natural language: Promise and challenges,” ACM Transactions on Soft- ware Engineering and Methodology (TOSEM) , vol. 31, no. 2, pp. 1–47, 2022

    work page 2022

  6. [6]

    Practical black-box attacks against machine learning,

    N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical black-box attacks against machine learning,” in Proceedings of the 2017 ACM on Asia conference on computer and communications security , 2017, pp. 506–519

    work page 2017

  7. [7]

    Data-free model extraction,

    J.-B. Truong, P. Maini, R. J. Walls, and N. Papernot, “Data-free model extraction,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2021, pp. 4771–4780

    work page 2021

  8. [8]

    Codemark: Imperceptible wa- termarking for code datasets against neural code completion models,

    Z. Sun, X. Du, F. Song, and L. Li, “Codemark: Imperceptible wa- termarking for code datasets against neural code completion models,” in Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the F oundations of Software Engineering, 2023, pp. 1561–1572

    work page 2023

Show all 39 references
  1. [9]

    Coprotector: Protect open- source code against unauthorized training usage with data poisoning,

    Z. Sun, X. Du, F. Song, M. Ni, and L. Li, “Coprotector: Protect open- source code against unauthorized training usage with data poisoning,” in Proceedings of the ACM Web Conference 2022 , 2022, pp. 652–660

    2022

  2. [10]

    Beyond dataset watermarking: Model-level copyright protection for code summarization models,

    J. Zhang, H. Li, D. Wu, X. Sun, Q. Lu, and G. Long, “Beyond dataset watermarking: Model-level copyright protection for code summarization models,” in Proceedings of the ACM on Web Conference 2025 , 2025, pp. 147–157

    2025

  3. [11]

    Codesearchnet challenge: Evaluating the state of semantic code search,

    H. Husain, H.-H. Wu, T. Gazit, M. Allamanis, and M. Brockschmidt, “Codesearchnet challenge: Evaluating the state of semantic code search,” arXiv preprint arXiv:1909.09436 , 2019

    1909 arXiv

  4. [12]

    Codexglue: A machine learning benchmark dataset for code understanding and generation,

    S. Lu, D. Guo, S. Ren, J. Huang, A. Svyatkovskiy, A. Blanco, C. Clement, D. Drain, D. Jiang, D. Tang et al., “Codexglue: A machine learning benchmark dataset for code understanding and generation,” arXiv preprint arXiv:2102.04664 , 2021

    2021 arXiv

  5. [13]

    Competition- level code generation with alphacode,

    Y . Li, D. Choi, J. Chung, N. Kushman, J. Schrittwieser, R. Leblond, T. Eccles, J. Keeling, F. Gimeno, A. Dal Lago et al. , “Competition- level code generation with alphacode,” Science, vol. 378, no. 6624, pp. 1092–1097, 2022

    2022

  6. [14]

    Expectation vs. experi- ence: Evaluating the usability of code generation tools powered by large language models,

    P. Vaithilingam, T. Zhang, and E. L. Glassman, “Expectation vs. experi- ence: Evaluating the usability of code generation tools powered by large language models,” in Chi conference on human factors in computing systems extended abstracts , 2022, pp. 1–7

    2022

  7. [15]

    A transformer- based approach for source code summarization,

    W. Ahmad, S. Chakraborty, B. Ray, and K.-W. Chang, “A transformer- based approach for source code summarization,” in Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics , 2020, pp. 4998–5007

    2020

  8. [16]

    On the effectiveness of large language models in statement-level code summarization,

    J. Zhu, Y . Miao, T. Xu, J. Zhu, and X. Sun, “On the effectiveness of large language models in statement-level code summarization,” in 2024 IEEE 24th International Conference on Software Quality, Reliability and Security (QRS) . IEEE, 2024, pp. 216–227

    2024

  9. [17]

    Deep code comment generation with hybrid lexical and syntactical information,

    X. Hu, G. Li, X. Xia, D. Lo, and Z. Jin, “Deep code comment generation with hybrid lexical and syntactical information,” Empirical Software Engineering, vol. 25, pp. 2179–2217, 2020

    2020

  10. [18]

    Code to comment “translation

    D. Gros, H. Sezhiyan, P. Devanbu, and Z. Yu, “Code to comment “translation”: Data, metrics, baselining & evaluation,” 2020 35th IEEE/ACM International Conference on Automated Software Engineering (ASE) , pp. 746–757, 2020. [Online]. Available: https://api.semanticscholar.org/C...

    2020

  11. [19]

    Codebert: A pre-trained model for programming and natural languages,

    Z. Feng, D. Guo, D. Tang, N. Duan, X. Feng, M. Gong, L. Shou, B. Qin, T. Liu, D. Jiang et al., “Codebert: A pre-trained model for programming and natural languages,” arXiv preprint arXiv:2002.08155 , 2020

    2002 arXiv

  12. [20]

    Graphcodebert: Pre-training code repre- sentations with data flow,

    D. Guo, S. Ren, S. Lu, Z. Feng, D. Tang, S. Liu, L. Zhou, N. Duan, A. Svyatkovskiy, S. Fu et al. , “Graphcodebert: Pre-training code repre- sentations with data flow,” arXiv preprint arXiv:2009.08366 , 2020

    2009 arXiv

  13. [21]

    Codet5: Identifier-aware unified pre-trained encoder-decoder models for code understanding and generation,

    Y . Wang, W. Wang, S. Joty, and S. C. Hoi, “Codet5: Identifier-aware unified pre-trained encoder-decoder models for code understanding and generation,” arXiv preprint arXiv:2109.00859 , 2021

    2021 arXiv

  14. [22]

    Big code != big vocabulary: Open-vocabulary models for source code,

    R.-M. Karampatsis, H. Babii, R. Robbes, C. Sutton, and A. Janes, “Big code != big vocabulary: Open-vocabulary models for source code,” 2020 IEEE/ACM 42nd International Conference on Software Engineering (ICSE) , pp. 1073–1085, 2020. [Online]. Available: https://api.semanticsch...

    2020

  15. [23]

    Untargeted backdoor watermark: Towards harmless and stealthy dataset copy- right protection,

    Y . Li, Y . Bai, Y . Jiang, Y . Yang, S.-T. Xia, and B. Li, “Untargeted backdoor watermark: Towards harmless and stealthy dataset copy- right protection,” Advances in Neural Information Processing Systems , vol. 35, pp. 13 238–13 250, 2022

    2022

  16. [24]

    Black- box dataset ownership verification via backdoor watermarking,

    Y . Li, M. Zhu, X. Yang, Y . Jiang, T. Wei, and S.-T. Xia, “Black- box dataset ownership verification via backdoor watermarking,” IEEE Transactions on Information F orensics and Security , vol. 18, pp. 2318– 2332, 2023

    2023

  17. [25]

    Unambiguous and high-fidelity backdoor watermarking for deep neural networks,

    G. Hua, A. B. J. Teoh, Y . Xiang, and H. Jiang, “Unambiguous and high-fidelity backdoor watermarking for deep neural networks,” IEEE Transactions on Neural Networks and Learning Systems , 2023

    2023

  18. [26]

    Neural network laundering: Removing black-box backdoor watermarks from deep neural networks,

    W. Aiken, H. Kim, S. Woo, and J. Ryoo, “Neural network laundering: Removing black-box backdoor watermarks from deep neural networks,” Computers & Security , vol. 106, p. 102277, 2021

    2021

  19. [27]

    Bleu: a method for automatic evaluation of machine translation,

    K. Papineni, S. Roukos, T. Ward, and W.-J. Zhu, “Bleu: a method for automatic evaluation of machine translation,” in Proceedings of the 40th annual meeting of the Association for Computational Linguistics , 2002, pp. 311–318

    2002

  20. [28]

    Squad: 100,000+ questions for machine comprehension of text,

    P. Rajpurkar, J. Zhang, K. Lopyrev, and P. Liang, “Squad: 100,000+ questions for machine comprehension of text,” in Proceedings of the 2016 Conference on Empirical Methods in Natural Language Process- ing, 2016, pp. 2383–2392

    2016

  21. [29]

    Codegeex: A pre-trained model for code generation with multilingual benchmarking on humaneval-x,

    Q. Zheng, X. Xia, X. Zou, Y . Dong, S. Wang, Y . Xue, L. Shen, Z. Wang, A. Wang, Y . Li et al. , “Codegeex: A pre-trained model for code generation with multilingual benchmarking on humaneval-x,” in Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data ...

    2023

  22. [30]

    Codebleu: a method for automatic evaluation of code synthesis,

    S. Ren, D. Guo, S. Lu, L. Zhou, S. Liu, D. Tang, N. Sundaresan, M. Zhou, A. Blanco, and S. Ma, “Codebleu: a method for automatic evaluation of code synthesis,” arXiv preprint arXiv:2009.10297 , 2020

    2009 arXiv

  23. [31]

    Stealthy backdoor attack for code models,

    Z. Yang, B. Xu, J. M. Zhang, H. J. Kang, J. Shi, J. He, and D. Lo, “Stealthy backdoor attack for code models,” IEEE Transactions on Software Engineering, vol. 50, no. 4, pp. 721–741, 2024

    2024

  24. [32]

    Onion: A simple and effective defense against textual backdoor attacks,

    F. Qi, Y . Chen, M. Li, Y . Yao, Z. Liu, and M. Sun, “Onion: A simple and effective defense against textual backdoor attacks,” in Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, 2021, pp. 9558–9566

    2021

  25. [33]

    Spectral signatures in backdoor attacks,

    B. Tran, J. Li, and A. Madry, “Spectral signatures in backdoor attacks,” Advances in neural information processing systems , vol. 31, 2018

    2018

  26. [34]

    Bppattack: Stealthy and efficient tro- jan attacks against deep neural networks via image quantization and contrastive adversarial learning,

    Z. Wang, J. Zhai, and S. Ma, “Bppattack: Stealthy and efficient tro- jan attacks against deep neural networks via image quantization and contrastive adversarial learning,” in Proceedings of the IEEE/CVF con- ference on computer vision and pattern recognition , 2022, pp. 15 074– 15 084

    2022

  27. [35]

    Invisible backdoor attack with sample-specific triggers,

    Y . Li, Y . Li, B. Wu, L. Li, R. He, and S. Lyu, “Invisible backdoor attack with sample-specific triggers,” in Proceedings of the IEEE/CVF international conference on computer vision , 2021, pp. 16 463–16 472

    2021

  28. [36]

    Advdoor: adversarial backdoor attack of deep learning system,

    Q. Zhang, Y . Ding, Y . Tian, J. Guo, M. Yuan, and Y . Jiang, “Advdoor: adversarial backdoor attack of deep learning system,” in Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis , 2021, pp. 127–138

    2021

  29. [37]

    Blind backdoors in deep learning models,

    E. Bagdasaryan and V . Shmatikov, “Blind backdoors in deep learning models,” in 30th USENIX Security Symposium (USENIX Security 21) , 2021, pp. 1505–1521

    2021

  30. [38]

    You autocom- plete me: Poisoning vulnerabilities in neural code completion,

    R. Schuster, C. Song, E. Tromer, and V . Shmatikov, “You autocom- plete me: Poisoning vulnerabilities in neural code completion,” in 30th USENIX Security Symposium (USENIX Security 21) , 2021, pp. 1559– 1575

    2021

  31. [39]

    Backdoors in neural models of source code,

    G. Ramakrishnan and A. Albarghouthi, “Backdoors in neural models of source code,” in 2022 26th International Conference on Pattern Recognition (ICPR) . IEEE, 2022, pp. 2892–2899. APPENDIX In our experiments, we selected CodeT5, a Transformer- based pre-trained model specifical...

    2022

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.