Backdooring Neural Code Search

Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics Volume 1: Long Papers, pages 9692–9708 July 9-14, 2023 ©2023 Association for Computational Linguistics Backdooring Neural Code Search Weisong Sun1∗, Yuchen Chen1∗, Guanhong Tao2∗, Chunrong Fang1†, Xiangyu Zhang2, Quanjun Zhang1, Bin Luo1 1State Key Laboratory for Novel Software Technology, Nanjing University, China 2Purdue University, USA weisongsun@smail.nju.edu.cn, yuc.chen@smail.nju.edu.cn, taog@purdue.edu, fangchunrong@nju.edu.cn, xyzhang@cs.purdue.edu, quanjun.zhang@smail.nju.edu.cn, luobin@nju.edu.cn ∗Equal contribution, †Corresponding author. Abstract Reusing off-the-shelf code snippets from on- line repositories is a common practice, which significantly enhances the productivity of soft- ware developers. To find desired code snip- pets, developers resort to code search engines through natural language queries. Neural code search models are hence behind many such en- gines. These models are based on deep learn- ing and gain substantial attention due to their impressive performance. However, the secu- rity aspect of these models is rarely studied. Particularly, an adversary can inject a back- door in neural code search models, which re- turn buggy or even vulnerable code with secu- rity/privacy issues. This may impact the down- stream software (e.g., stock trading systems and autonomous driving) and cause financial loss and/or life-threatening incidents. In this paper, we demonstrate such attacks are feasible and can be quite stealthy. By simply modifying one variable/function name, the attacker can make buggy/vulnerable code rank in the top 11%. Our attack BADCODE features a special trigger generation and injection procedure, making the attack more effective and stealthy. The evalu- ation is conducted on two neural code search models and the results show our attack outper- forms baselines by 60%. Our user study demon- strates that our attack is more stealthy than the baseline by two times based on the F1 score. 1 Introduction A software application is a collection of various functionalities. Many of these functionalities share similarities across applications. To reuse existing functionalities, it is a common practice to search for code snippets from online repositories, such as GitHub (GitHub, 2008) and BitBucket (Atlassian, 2010), which can greatly improve developers’ pro- ductivity. Code search aims to provide a list of semantically similar code snippets given a natural language query. � �������������� � ���������� � �������������� � ������������������ � ��������������������� � ������������������������������������������� � ���������� � �������������� � ����� � ���������� � � ��� ��� � ��������������� �� � ��� ��������������������������� �� � ��������������� ��� � ��������������������������������� ��� � ����������������������� ��� � ��������� ���������������������������� ��������������� ������������������ ��������������� ������������ ������� ��������������������������� Figure 1: Triggers used in (Wan et al., 2022) Early works in code search mainly consider queries and code snippets as plain text (Poshyvanyk et al., 2006; McMillan et al., 2011; Keivanloo et al., 2014; Lemos et al., 2014; Nie et al., 2016). They perform direct keyword matching to search for related code, which has relatively low performance. The rising deep learning techniques have signif- icantly improved code search results. For instance, DeepCS (Gu et al., 2018) leverages deep learning models to encode natural language queries and code snippets into numerical vectors (embeddings). Such a projection transforms the …

Content truncated to 500 words