Backdoor detection method for code model input sample based on black box scene

Abstract

The invention discloses a back door detection method based on a code model input sample in a black box scene. The method comprises the steps that disturbance is designed based on the input sample; performing grammar and lexical analysis on the input sample through an abstract syntax tree analysis tool, and identifying disturbance nodes capable of being inserted with disturbance; designing a disturbance adding strategy based on disturbance and disturbance nodes; generating a disturbance sample list based on the disturbance nodes in combination with a disturbance adding strategy pair; respectively inputting the input sample and the disturbance sample list into a code model, and calculating a corresponding disturbance trend deviation index according to a to-be-performed code task; calculating a disturbance trend deviation index obtained in advance after disturbance is added to a clean sample according to a to-be-performed code task, and calculating a dynamic normalization threshold value of the disturbance trend deviation index; and if the disturbance trend deviation index calculated according to the input sample of the corresponding code task is greater than the dynamic normalization threshold value, determining that the input sample is a malicious input sample. According to the method, the malicious input sample can be detected on the premise of not making additional assumptions on the backdoor trigger.

Description

Technical Field

[0001] This invention relates to the field of backdoor defense technology, and in particular to a backdoor detection method based on code model input samples in a black-box scenario. Background Technology

[0002] Over the past decade, deep learning-based code models have made continuous progress in software engineering task processing, demonstrating remarkable performance, especially in code understanding tasks such as defect detection, code clone detection, and code search. This outstanding performance has driven the widespread application of code models, with various NCM-based AI programming assistants, such as Tencent Cloud's CodeBuddy in China and Amazon CodeWhisperer abroad, deeply penetrating all aspects of code development.

[0003] In practical applications, since developing and training a high-performance code model from scratch requires a huge cost, most developers and users will directly choose to use pre-trained code models from third parties, which is what machine learning as a service is all about.

[0004] However, to improve the performance of code models in various code intelligence tasks, model trainers often acquire large-scale code datasets from the internet or third-party data providers to achieve better model performance. Research shows that code models can be unintentionally embedded with hidden backdoors during this training process. Infected code models may perform normally on clean input, but when given malicious samples with triggers, they will output the attacker's desired target labels. These attacks are difficult for ordinary users to identify, posing a security threat to Machine Learning as a Service. One detection strategy to combat this attack is to check for triggers in the test data and filter them before feeding them into the code model. This defense method can work in conjunction with other backdoor defense measures and provide prior knowledge of trigger samples in the overall defense process, thereby helping downstream defense stages to conduct statistical analysis of backdoor samples and more effectively mitigate the impact of backdoors.

[0005] While various defense methods exist, most require accessing or even modifying the code model weights under white-box settings, making them unsuitable for machine learning-as-a-service scenarios. A few black-box defenses rely on implicit assumptions about backdoor triggers, making them vulnerable to advanced backdoor attacks. Therefore, there is an urgent need to find a method suitable for black-box scenarios that requires minimal assumptions about triggers and only needs to obtain the code model's output to detect malicious input samples. Summary of the Invention

[0006] The purpose of this invention is to provide a backdoor detection method based on code model input samples in a black-box scenario. This method involves adding perturbations to the input samples of the code model and detecting the difference in the output of the code model before and after the perturbation to determine whether the input sample is malicious. This method can detect malicious input samples without making additional assumptions about the backdoor trigger, simply by obtaining the output results of the code model. This invention is achieved through the following technical solutions.

[0007] This invention provides a backdoor detection method based on code model input samples in a black-box scenario, including:

[0008] Obtain input samples for the code model and design perturbations based on the input samples;

[0009] The input sample is analyzed syntactically and lexically using an abstract syntax tree parsing tool to identify perturbation nodes into which perturbations can be inserted.

[0010] Based on the perturbation and perturbation nodes, a perturbation addition strategy is designed;

[0011] Based on the perturbation nodes, perturbations are gradually added to the input samples in conjunction with the perturbation addition strategy to generate a list of perturbation samples;

[0012] The input sample and perturbation sample list are respectively input into the code model, and the corresponding perturbation trend deviation index is calculated according to the code task to be performed.

[0013] Calculate the perturbation trend deviation index of the pre-acquired clean samples after adding perturbation based on the code task to be performed, and calculate its dynamic normalization threshold.

[0014] If the perturbation trend deviation index calculated based on the input sample of the corresponding code task is greater than the dynamic normalization threshold, it is determined to be a malicious input sample.

[0015] Optionally, designing perturbations based on the input samples includes designing code logic dimension perturbations based on the code logic dimension of the input samples. Based on the code readability dimension of the input sample, a code readability dimension perturbation is designed. ;

[0016] The code logic dimension perturbation The syntax structure and execution logic of the input sample code are disrupted from the surface to the depths; the code logic dimension is perturbed. Including the first maintenance perturbation and the first destructive disturbance The first retention perturbation While maintaining the semantic and syntactic correctness of the input sample code, equivalent structure transformations are performed on the input sample code fragments. These equivalent structure transformations include loop equivalence transformations, branch equivalence transformations, computational equivalence transformations, and constant equivalence swaps; the first destructive perturbation... The underlying logic of the input sample code execution is disrupted; the disruption methods include reversing conditional expressions, modifying loop control logic, altering variable assignment logic, and tampering with function behavior.

[0017] Specifically, this invention includes loop equivalence conversion—performing equivalence conversion between for loops and while loops; branch equivalence conversion—performing equivalence conversion between if-else (-if) structures and if-if structures; computation equivalence conversion—performing equivalence substitution for numerical computation operations; and constant equivalence conversion—converting between constants and variables assigned the same constant value.

[0018] Specifically, conditional expression reversal—causing code to execute different branches under the same input; loop control logic modification—changing the number of loop executions or coverage; variable assignment logic alteration—directly changing the value of a variable; and function behavior modification—completely changing the function's functionality.

[0019] The perturbation of the code readability dimension This involves identifier changes that affect the semantics and readability of the input sample code; the code readability dimension is perturbed. Including the second maintenance perturbation Second destructive disturbance The second retention perturbation Synonym replacement is performed based on the synonym set in the WordNet dictionary. As the degree of disruption increases, it progresses to the point of replacing identifiers without keywords, which is the second destructive perturbation. Irrelevant words are replaced by randomly selecting words of the same part of speech from the WordNet dictionary.

[0020] Optionally, based on the perturbation and the perturbation node, the perturbation addition strategy is designed including based on the first preservation perturbation. Second maintenance perturbation Generate addition method And by adding method Generate corresponding perturbation samples based on the first destructive perturbation. Second maintenance perturbation Generate addition method And by adding method Generate corresponding perturbation samples; wherein, the addition method The expression is as follows:

[0021] ,

[0022] In the formula, j is the perturbation node number. The input sample segment at the j-th perturbation node has a value range from 1 to m-1, where m is the addition method. The total number of perturbation node numbers applied;

[0023] The method of adding The expression is as follows:

[0024] ,

[0025] In the formula, k is the perturbation node number. is the input sample segment at the k-th perturbation node, with values ​​ranging from m to n, where n is the total number of perturbation nodes.

[0026] In practical applications, perturbations are added to the input sample fragments based on the corresponding perturbation node indices, but not in the order of the perturbation node indices. Instead, the indices of the perturbation nodes are randomly selected, and the corresponding perturbations are added to obtain the corresponding list of perturbation samples.

[0027] Optionally, generating perturbation samples includes the following steps:

[0028] Define code model This is used to implant backdoors into models during the training phase, so that the model output will show different results. This will cause malicious code samples carrying triggers to produce preset error outputs, while clean samples will output normal results.

[0029] Using abstract syntax tree parsing tools, the code model Input samples Lexical and syntactic analysis is performed to generate an abstract syntax tree (AST). All nodes in the AST are traversed to identify suitable perturbation nodes. Triples are then used to store these perturbation nodes as a list of code perturbation locations. The triple includes a line number, an abstract syntax tree node type, and a perturbation type. The abstract syntax tree node type includes an expression, a control flow, an assignment node, and an identifier node.

[0030] For the list of code perturbation locations Add code logic dimension perturbations to expressions, control flow, and assignment nodes. For the list of code perturbation locations Add code readability dimension perturbations to identifier nodes. Generate perturbation samples The expression is:

[0031] ,

[0032] In the formula, i is the perturbation sample number, which ranges from 1 to n, and n is the total number of perturbation samples; For the i-th perturbation sample, the expression is as follows:

[0033] ,

[0034] For the added perturbation function, This refers to the method of adding the i-th perturbation sample.

[0035] Optionally, the code task includes a code classification task and a code generation task; the corresponding perturbation trend deviation index is calculated according to the code task to be performed, including calculating a first perturbation trend deviation index according to the code classification task and calculating a second perturbation trend deviation index according to the code generation task.

[0036] Optionally, calculating the first perturbation trend deviation index based on the code classification task includes taking the input samples... and perturbation sample list The inputs are fed into code model M respectively, and the original labels output by code model M are obtained. and disturbance tag list According to the original label and disturbance tag list The first disturbance trend deviation index was calculated; where the original label and disturbance tag list The expressions are as follows:

[0037] ,

[0038] Optionally, the first disturbance trend deviation index can be calculated using the following formula. :

[0039] ,

[0040] In the formula, Let be the perturbation label of the i-th perturbation sample. It is a jump intensity function. This is a labeling function that determines whether two adjacent perturbation labels are equal. The labeling function is valued as follows:

[0041] ,

[0042] Jump intensity function The calculation formula is as follows:

[0043] ,

[0044] In the formula, Disturbance label From jump to The probability of.

[0045] Optionally, calculating the second perturbation trend deviation index based on the code generation task includes taking the input samples... and perturbation sample list Inputting into code model M, we obtain the original generated segment output by code model M. List of code segments generated after perturbation According to the original generated segment List of code segments generated after perturbation Calculate the second disturbance trend deviation index; where, the original generation segment List of code segments generated after perturbation The expressions are as follows:

[0046] .

[0047] Optionally, the second disturbance trend deviation index can be calculated using the following formula. :

[0048] ,

[0049] In the formula, Generate code segment after perturbation of the i-th perturbation sample Fraction, It is a flag function, indicating that after judging two adjacent perturbations, a code segment corresponding to the generated code segment is generated. Whether the score remains unchanged, the indicator function The value can be obtained in the following ways:

[0050] .

[0051] Optionally, the dynamic normalization threshold calculation formula is as follows:

[0052] ,

[0053] In the formula, For dynamic normalization threshold, The perturbation trend after adding perturbation to the pre-obtained clean sample deviates from the exponential mean. The trend of the perturbation after adding perturbation to the pre-obtained clean sample deviates from the exponential standard deviation. The threshold offset parameter is used, and the clean sample is a non-malicious sample.

[0054] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0055] The backdoor detection method based on code model input samples in a black-box scenario provided by this invention, compared with previous backdoor detection methods in code, does not require too many assumptions about triggers. It only needs to obtain the output results of the code model and observe the inconsistencies between the model outputs to determine whether triggers are carried, that is, to detect malicious input samples. It reduces the dependence on assumptions about specific trigger patterns and has greater detection versatility.

[0056] Backdoor detection in black-box scenarios only requires obtaining the output of the code model. The detection method does not introduce access to the internal structure of the model during the entire detection process, making it more suitable for black-box scenarios where defenders have no access to the internal structure of the code model. In addition, the backdoor detection method based on the input samples of the code model in black-box scenarios provided by this invention performs detection during the inference stage after the code model is deployed. It can be used as the last line of defense for model defense detection and can be combined with backdoor detection methods before and during model training, which has high scalability. Attached Figure Description

[0057] Figure 1 The diagram shown is a schematic flowchart of a backdoor detection method based on code model input samples in a black-box scenario according to an embodiment of the present invention.

[0058] Figure 2 The diagram shown is a schematic diagram of the process for obtaining perturbation samples in one embodiment of the present invention. Detailed Implementation

[0059] The following description, in conjunction with the accompanying drawings and specific embodiments, provides further details. In this description, it should be understood that the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined with "first," "second," etc., may explicitly or implicitly include one or more of that feature.

[0060] Example 1

[0061] This embodiment provides a backdoor detection method based on code model input samples in a black-box scenario, including the following steps: obtaining input samples of the code model, and designing perturbations based on the input samples;

[0062] The input sample is analyzed syntactically and lexically using an abstract syntax tree parsing tool to identify perturbation nodes into which perturbations can be inserted.

[0063] Based on the perturbation and perturbation nodes, a perturbation addition strategy is designed;

[0064] Based on the perturbation nodes, perturbations are gradually added to the input samples in conjunction with the perturbation addition strategy to generate a list of perturbation samples;

[0065] The input sample and perturbation sample list are respectively input into the code model, and the corresponding perturbation trend deviation index is calculated according to the code task to be performed.

[0066] Calculate the perturbation trend deviation index of the pre-acquired clean samples after adding perturbation based on the code task to be performed, and calculate its dynamic normalization threshold.

[0067] If the perturbation trend deviation index calculated based on the input sample of the corresponding code task is greater than the dynamic normalization threshold, it is determined to be a malicious input sample.

[0068] Example 2

[0069] Based on Example 1, this example describes the specific implementation process of a backdoor detection method based on code model input samples in a black-box scenario, such as... Figure 1 As shown, it specifically includes the following:

[0070] Step 1, Design the perturbation

[0071] In one specific embodiment of the present invention, the perturbation based on input samples includes designing code logic dimension perturbations based on the code logic dimension of the input samples. Design code readability dimension perturbations based on the code readability dimension of the input samples. .

[0072] Code logic dimension perturbation The syntax structure and execution logic of the input sample code are disrupted from the surface to the depths; the code logic dimension is perturbed. Including the first maintenance perturbation and the first destructive disturbance .

[0073] First maintenance perturbation While maintaining the semantic and syntactic correctness of the input sample code, equivalent structure transformations are performed on the input sample code fragments. These equivalent structure transformations include loop equivalence transformations, branch equivalence transformations, computational equivalence transformations, and constant equivalence swaps. Some of the transformation methods are shown in Table 1 below.

[0074] Table 1 Equivalent Structure Transformation Table

[0075] First destructive disturbance The underlying logic of the input sample code execution is disrupted; the disruption methods include reversing conditional expressions, modifying loop control logic, altering variable assignment logic, and tampering with function behavior. Some of the disruption methods are shown in Table 2 below: Table 2 Classification of Damage Modes

[0076] Perturbation of code readability dimension This involves identifier changes that affect the semantics and readability of the input sample code; code readability dimension perturbation. Including the second maintenance perturbation Second destructive disturbance .

[0077] Second maintenance perturbation Synonym replacements were performed based on the synonym set in the WordNet dictionary. Some of the synonym replacements are shown in Table 3 below: Table 3. Synonym Substitution Table

[0078] Second destructive disturbance Irrelevant word replacement was performed by randomly replacing words with the same part of speech from the WordNet dictionary. Some of the replacements with the same part of speech are shown in Table 4. Table 4. Replacement Table for Same Part of Speech

[0079] Step 2, Design a perturbation addition strategy

[0080] In one specific embodiment of the present invention, based on a first maintaining perturbation Second maintenance perturbation Generate addition method And by adding method Generate the corresponding perturbation samples.

[0081] Based on the first destructive disturbance Second maintenance perturbation Generate addition method And by adding method Generate the corresponding perturbation samples;

[0082] Among them, the method of adding The expression is as follows:

[0083] ,

[0084] In the formula, j is the perturbation node number. The input sample segment at the j-th perturbation node has a value range from 1 to m-1, where m is the addition method. The total number of perturbation node numbers applied;

[0085] Add method The expression is as follows:

[0086] ,

[0087] In the formula, k is the perturbation node number. is the input sample segment at the k-th perturbation node, with values ​​ranging from m to n, where n is the total number of perturbation nodes.

[0088] Step 3, obtain the list of perturbation samples

[0089] In one specific embodiment of the present invention, the list of perturbation samples is obtained as follows: Figure 2 As shown, it includes the following:

[0090] Define code model For models that have backdoors implanted during the training phase;

[0091] Using abstract syntax tree parsing tools, the code model Input samples Lexical and syntactic analysis is performed to generate an abstract syntax tree (AST). All nodes in the AST are traversed to identify suitable perturbation nodes. Triples are then used to store these perturbation nodes as a list of code perturbation locations. The triple includes a line number, an abstract syntax tree (AST) node type, and a perturbation type. The AST node types include expression, control flow, assignment, and identifier nodes. A list of code perturbation locations is also included. The expression is: ,

[0092] For the list of code perturbation locations Add code logic dimension perturbations to expressions, control flow, and assignment nodes. For the list of code perturbation locations Add code readability dimension perturbations to identifier nodes. Generate perturbation samples The expression is:

[0093] ,

[0094] In the formula, i is the perturbation sample number, which ranges from 1 to n, and n is the total number of perturbation samples; For the i-th perturbation sample, the expression is as follows:

[0095] ,

[0096] For the added perturbation function, This refers to the method of adding the i-th perturbation sample.

[0097] The above describes the addition of two types of perturbations, specifically: perturbations at the code logic dimension. The addition of [something] from the list of code perturbation locations Randomly select one from the expression, control flow, and assignment node in the code and perform equivalent structure replacement; for example, select control flow for equivalent structure replacement.

[0098] Perturbations in code readability dimension The addition of [something] from the list of code perturbation locations Randomly select one of the identifier nodes in the array and replace the identifier.

[0099] Step 4: Calculate the corresponding perturbation trend deviation index based on the code task to be performed.

[0100] In one specific embodiment of the present invention, the code task includes a code classification task and a code generation task; the corresponding disturbance trend deviation index is calculated according to the code task to be performed, including calculating a first disturbance trend deviation index according to the code classification task and calculating a second disturbance trend deviation index according to the code generation task.

[0101] Step 4.1: Calculate the first perturbation trend deviation index based on the code classification task.

[0102] Calculating the first perturbation trend deviation index based on the code classification task includes taking the input sample and perturbation sample list The inputs are fed into code model M respectively, and the original labels output by code model M are obtained. and disturbance tag list According to the original label and disturbance tag list The first disturbance trend deviation index was calculated; where the original label and disturbance tag list The expressions are as follows:

[0103] .

[0104] In one specific embodiment of the present invention, the code classification task is defined as a z-classification task, and the label output by the code model M is one of the z categories. The first perturbation trend deviation index is calculated using the following formula. :

[0105] ,

[0106] In the formula, Let be the perturbation label of the i-th perturbation sample. It is a jump intensity function. This is a labeling function that determines whether two adjacent perturbation labels are equal. The labeling function is valued as follows:

[0107] ,

[0108] Jump intensity function The calculation formula is as follows:

[0109] ,

[0110] In the formula, Disturbance label From jump to The probability of.

[0111] In one specific embodiment of the present invention, by Construct a z×z state transition matrix P to query the list of disturbance labels. The probability of switching between two adjacent perturbation labels. A value is generated statistically from clean samples. State transition matrix as follows:

[0112] .

[0113] Step 4.2: Calculate the second perturbation trend deviation index based on the code generation task.

[0114] Calculating the second perturbation trend deviation index based on the code generation task includes taking the input sample and perturbation sample list Inputting into code model M, we obtain the original generated segment output by code model M. List of code segments generated after perturbation According to the original generated segment List of code segments generated after perturbation Calculate the second disturbance trend deviation index; where, the original generation segment List of code segments generated after perturbation The expressions are as follows:

[0115] .

[0116] The second disturbance trend deviation index is calculated using the following formula. :

[0117] ,

[0118] In the formula, Generate code segment after perturbation of the i-th perturbation sample Fraction, It is a flag function, indicating that after judging two adjacent perturbations, a code segment corresponding to the generated code segment is generated. Whether the score remains unchanged, the indicator function The value can be obtained in the following ways:

[0119] .

[0120] Step 5: Calculate the dynamic normalization threshold for clean samples.

[0121] In one specific embodiment of the present invention, two clean sample lists are obtained according to the code classification task and the code generation task, respectively. Then, according to step 3, a perturbation sample list is generated for each clean sample list. Finally, according to step 4, the corresponding perturbation trend deviation index is calculated to obtain a score list. . include and If the task is code classification, the scores calculated for clean samples are listed as follows: As shown, if the task is code generation, the list of scores calculated for clean samples is as follows: As shown, the list and list The expressions are as follows:

[0122] ,

[0123] ,

[0124] based on and The dynamic normalization threshold is calculated using the following formula. :

[0125] ,

[0126] ,

[0127] In the formula, v is a list. or list In the data sequence number, when the task being performed is code classification, v is from the list. When selecting data from a list, if the task being performed is code generation, v selects data from the list. Select data from For dynamic normalization threshold, For list or list The mean of the data. For list or list The standard deviation of the data The threshold offset parameter is used, and the clean sample is a non-malicious sample.

[0128] In one specific embodiment of the present invention, it is set that... When the task being performed is code classification, for When the task being performed is a code generation task, for .

[0129] Step 6, Determine

[0130] For the input samples of the input code model M, calculate the corresponding perturbation trend deviation index according to the code task to be performed, and compare it with the dynamic normalization threshold calculated in step 5. Compared to the dynamic normalization threshold, if the disturbance trend deviates from the exponential value by more than 100%, then... If it does not, it is classified as a malicious sample carrying a trigger; otherwise, it is a clean sample.

[0131] In one specific embodiment of the present invention, the final detection results for the input samples of the code classification task are shown in Table 5 below, and the final detection results for the input samples of the code generation task are shown in Table 6 below:

[0132] Table 5. Code classification task detection results

[0133] Table 6. Code Generation Task Detection Results

[0134] In Tables 5 and 6, the input code samples 1 and 4 were identified as malicious samples carrying triggers in the code classification task, and the input code samples 8 and 10 were identified as malicious samples carrying triggers in the code generation task.

[0135] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims. All of these forms are within the protection scope of the present invention.

Claims

1. A backdoor detection method based on code model input samples in a black-box scenario, characterized in that, include: Obtain input samples for the code model and design perturbations based on the input samples; The input sample is analyzed syntactically and lexically using an abstract syntax tree parsing tool to identify perturbation nodes into which perturbations can be inserted. Based on the perturbation and perturbation nodes, a perturbation addition strategy is designed; Based on the perturbation nodes, perturbations are gradually added to the input samples in conjunction with the perturbation addition strategy to generate a list of perturbation samples; The input sample and perturbation sample list are respectively input into the code model, and the corresponding perturbation trend deviation index is calculated according to the code task to be performed. Calculate the perturbation trend deviation index of the pre-acquired clean samples after adding perturbation based on the code task to be performed, and calculate its dynamic normalization threshold. If the perturbation trend deviation index calculated based on the input sample of the corresponding code task is greater than the dynamic normalization threshold, it is determined to be a malicious input sample.

2. The backdoor detection method based on code model input samples in a black-box scenario as described in claim 1, characterized in that, The perturbation design based on the input samples includes designing code logic dimension perturbations based on the code logic dimension of the input samples. Based on the code readability dimension of the input sample, a code readability dimension perturbation is designed. ; The code logic dimension perturbation The syntax structure and execution logic of the input sample code are disrupted from the surface to the depths; the code logic dimension is perturbed. Including the first maintenance perturbation and the first destructive disturbance The first retention perturbation While maintaining the semantic and syntactic correctness of the input sample code, equivalent structure transformations are performed on the input sample code fragments. These equivalent structure transformations include loop equivalence transformations, branch equivalence transformations, computational equivalence transformations, and constant equivalence swaps; the first destructive perturbation... The underlying logic of the input sample code execution is disrupted; the disruption methods include reversing conditional expressions, modifying loop control logic, altering variable assignment logic, and tampering with function behavior. The perturbation of the code readability dimension This involves identifier changes that affect the semantics and readability of the input sample code; the code readability dimension is perturbed. Including the second maintenance perturbation Second destructive disturbance The second retention perturbation Synonym replacement is performed based on the synonym set in the WordNet dictionary; the second destructive perturbation. Irrelevant words are replaced by randomly selecting words of the same part of speech from the WordNet dictionary.

3. The backdoor detection method based on code model input samples in a black-box scenario as described in claim 2, characterized in that, Based on the perturbation and the perturbation node, the perturbation addition strategy is designed based on the first preservation perturbation. Second maintenance perturbation Generate addition method And by adding method Generate corresponding perturbation samples based on the first destructive perturbation. Second maintenance perturbation Generate addition method And by adding method Generate corresponding perturbation samples; wherein, the addition method The expression is as follows: ， In the formula, j is the perturbation node number. The input sample segment at the j-th perturbation node has a value range from 1 to m-1, where m is the addition method. The total number of perturbation node numbers applied; The method of adding The expression is as follows: ， In the formula, k is the perturbation node number. is the input sample segment at the k-th perturbation node, with values ​​ranging from m to n, where n is the total number of perturbation nodes.

4. The backdoor detection method based on code model input samples in a black-box scenario as described in claim 3, characterized in that, Generating perturbation samples involves the following steps: Define code model For models that have backdoors implanted during the training phase; Using abstract syntax tree parsing tools, the code model Input samples Lexical and syntactic analysis is performed to generate an abstract syntax tree (AST). All nodes in the AST are traversed to identify suitable perturbation nodes. Triples are then used to store these perturbation nodes as a list of code perturbation locations. The triple includes a line number, an abstract syntax tree node type, and a perturbation type. The abstract syntax tree node type includes an expression, a control flow, an assignment node, and an identifier node. For the list of code perturbation locations Add code logic dimension perturbations to expressions, control flow, and assignment nodes. For the list of code perturbation locations Add code readability dimension perturbations to identifier nodes. Generate perturbation samples The expression is: ， In the formula, i is the perturbation sample number, which ranges from 1 to n, and n is the total number of perturbation samples; For the i-th perturbation sample, the expression is as follows: ， For the added perturbation function, This refers to the method of adding the i-th perturbation sample.

5. The backdoor detection method based on code model input samples in a black-box scenario as described in claim 4, characterized in that, The code tasks include code classification tasks and code generation tasks; the corresponding perturbation trend deviation index is calculated according to the code tasks to be performed, including calculating a first perturbation trend deviation index according to the code classification task and calculating a second perturbation trend deviation index according to the code generation task.

6. The backdoor detection method based on code model input samples in a black-box scenario according to claim 5, characterized in that, Calculating the first perturbation trend deviation index based on the code classification task includes taking the input sample and perturbation sample list The inputs are fed into code model M respectively, and the original labels output by code model M are obtained. and disturbance tag list According to the original label and disturbance tag list The first disturbance trend deviation index was calculated; where the original label and disturbance tag list The expressions are as follows: 。 7. The backdoor detection method based on code model input samples in a black-box scenario according to claim 6, characterized in that, The first disturbance trend deviation index is calculated using the following formula. : ， In the formula, Let be the perturbation label of the i-th perturbation sample. It is a jump intensity function. This is a labeling function that determines whether two adjacent perturbation labels are equal. The labeling function is valued as follows: ， Jump intensity function The calculation formula is as follows: ， In the formula, Disturbance label From jump to The probability of.

8. The backdoor detection method based on code model input samples in a black-box scenario according to claim 7, characterized in that, Calculating the second perturbation trend deviation index based on the code generation task includes taking the input sample and perturbation sample list Inputting into code model M, we obtain the original generated segment output by code model M. List of code segments generated after perturbation According to the original generated segment List of code segments generated after perturbation Calculate the second disturbance trend deviation index; where, the original generation segment List of code segments generated after perturbation The expressions are as follows: 。 9. The backdoor detection method based on code model input samples in a black-box scenario according to claim 8, characterized in that, The second disturbance trend deviation index is calculated using the following formula. : ， In the formula, Generate code segment after perturbation of the i-th perturbation sample Fraction, It is a flag function, indicating that after judging two adjacent perturbations, a code segment corresponding to the generated code segment is generated. Whether the score remains unchanged, the indicator function The value can be obtained in the following ways: 。 10. The backdoor detection method based on code model input samples in a black-box scenario according to claim 9, characterized in that, The formula for calculating the dynamic normalization threshold is as follows: ， In the formula, For dynamic normalization threshold, The perturbation trend after adding perturbation to the pre-obtained clean sample deviates from the exponential mean. The trend of the perturbation after adding perturbation to the pre-obtained clean sample deviates from the exponential standard deviation. is the threshold offset parameter, where the clean sample is a non-malicious sample.

Images