{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,19]],"date-time":"2025-12-19T10:14:27Z","timestamp":1766139267818,"version":"3.48.0"},"reference-count":97,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"12","license":[{"start":{"date-parts":[[2025,12,1]],"date-time":"2025-12-01T00:00:00Z","timestamp":1764547200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,12,1]],"date-time":"2025-12-01T00:00:00Z","timestamp":1764547200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,12,1]],"date-time":"2025-12-01T00:00:00Z","timestamp":1764547200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IIEEE Trans. Software Eng."],"published-print":{"date-parts":[[2025,12]]},"DOI":"10.1109\/tse.2025.3614128","type":"journal-article","created":{"date-parts":[[2025,9,26]],"date-time":"2025-09-26T17:36:54Z","timestamp":1758908214000},"page":"3395-3415","source":"Crossref","is-referenced-by-count":1,"title":["Misactivation-Aware Stealthy Backdoor Attacks on Neural Code Understanding Models"],"prefix":"10.1109","volume":"51","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-5165-5080","authenticated-orcid":false,"given":"Xiaobing","family":"Sun","sequence":"first","affiliation":[{"name":"School of Information Engineering, Yangzhou University, Yangzhou, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-4620-1949","authenticated-orcid":false,"given":"Yiran","family":"Xiao","sequence":"additional","affiliation":[{"name":"School of Information Engineering, Yangzhou University, Yangzhou, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7267-4923","authenticated-orcid":false,"given":"Lili","family":"Bo","sequence":"additional","affiliation":[{"name":"School of Information Engineering, Yangzhou University, Yangzhou, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9236-8264","authenticated-orcid":false,"given":"Weisong","family":"Sun","sequence":"additional","affiliation":[{"name":"College of Computing and Data Science, Nanyang Technological University, Singapore"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-9764-8623","authenticated-orcid":false,"given":"Xiangyue","family":"Liu","sequence":"additional","affiliation":[{"name":"School of Information Engineering, Yangzhou University, Yangzhou, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8500-9917","authenticated-orcid":false,"given":"Bin","family":"Li","sequence":"additional","affiliation":[{"name":"School of Information Engineering, Yangzhou University, Yangzhou, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2143-5666","authenticated-orcid":false,"given":"Jiale","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Information Engineering, Yangzhou University, Yangzhou, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/3597503.3639168"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/saner48275.2020.9054857"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/iccv48922.2021.01615"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/3460319.3464809"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr52688.2022.01465"},{"article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","year":"2017","author":"Chen","key":"ref6"},{"key":"ref7","first-page":"14443","article-title":"Clean-label backdoor attacks on video recognition models","volume-title":"Proc. IEEE\/CVF Conf. Comput. Vision Pattern Recognit.","author":"Zhao","year":"2020"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/3485447.3512225"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i9.16971"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/tse.2024.3361661"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i01.5469"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i12.26739"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.acl-long.540"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/icpr56361.2022.9956690"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/3540250.3549153"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3630008"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.374"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/ase56229.2023.00149"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.findings-emnlp.139"},{"key":"ref20","first-page":"7","article-title":"Graphcodebert: Pre-training code representations with data flow","volume-title":"Proc. 9th Int. Conf. Learn. Representations","author":"Guo","year":"2021"},{"key":"ref21","article-title":"StarCoder: May the source be with you!","volume-title":"Trans. Mach. Learn. Res.","author":"Li","year":"2023"},{"article-title":"Code Llama: Open foundation models for code","year":"2023","author":"Rozi\u00e8re","key":"ref22"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-emnlp.649"},{"key":"ref24","first-page":"8011","article-title":"Spectral signatures in backdoor attacks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Tran","year":"2018"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.752"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/tse.2025.3614128"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/icse.2019.00086"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3624744"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-022-10216-4"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2021.106576"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510219"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3607199.3607242"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/tse.2021.3087402"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-66402-6_6"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/3656341"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3632742"},{"article-title":"A systematic literature review on large language models for automated program repair","year":"2024","author":"Zhang","key":"ref37"},{"key":"ref38","first-page":"1419","article-title":"Bug detection and localization using pre-trained code language models","volume-title":"Proc. INFORMATIK","author":"Campos","year":"2024"},{"key":"ref39","article-title":"GitHub"},{"year":"2024","key":"ref40","article-title":"StackOverflow"},{"article-title":"Backdoor attacks and countermeasures on deep learning: A comprehensive review","year":"2020","author":"Gao","key":"ref41"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/spw50608.2020.00024"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6871"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/access.2019.2941376"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/3485832.3485837"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/3691620.3695297"},{"key":"ref47","article-title":"CodeXGLUE: A machine learning benchmark dataset for code understanding and generation","volume-title":"Proc. Neural Inf. Process. Syst. (NeurIPS)","author":"Lu","year":"2021"},{"key":"ref48","first-page":"10197","article-title":"Devign: Effective vulnerability identification by learning comprehensive program semantics via graph neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Zhou","year":"2019"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/icsme.2014.77"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/tip.2022.3201472"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/iccv48922.2021.01175"},{"key":"ref52","first-page":"14900","article-title":"Anti-backdoor learning: Training clean models on poisoned data","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Li","year":"2021"},{"key":"ref53","article-title":"Wanet\u2013Imperceptible warping-based backdoor attack","volume-title":"Proc. 9th Int. Conf. Learn. Representations","author":"Nguyen","year":"2021"},{"key":"ref54","first-page":"1505","article-title":"Blind backdoors in deep learning models","volume-title":"Proc. 30th USENIX Secur. Symp.","author":"Bagdasaryan","year":"2021"},{"key":"ref55","first-page":"1559","article-title":"You autocomplete me: Poisoning vulnerabilities in neural code completion","volume-title":"Proc. 30th USENIX Secur. Symp.","author":"Schuster","year":"2021"},{"key":"ref56","first-page":"16913","article-title":"Adversarial neuron pruning purifies backdoored deep models","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Wu","year":"2021"},{"key":"ref57","doi-asserted-by":"crossref","DOI":"10.14722\/ndss.2018.23291","article-title":"Trojaning attack on neural networks","volume-title":"Proc. 25th Annu. Netw. Distrib. Syst. Secur. Symp.","author":"Liu","year":"2018"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1145\/3340531.3412130"},{"article-title":"Weight poisoning attacks on pre-trained models","year":"2020","author":"Kurita","key":"ref59"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.377"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.acl-long.399"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/sp.2019.00031"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/sp40001.2021.00034"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_14"},{"article-title":"Defending against backdoor attack on deep neural networks","year":"2020","author":"Cheng","key":"ref65"},{"article-title":"On the effectiveness of distillation in mitigating backdoors in pre-trained encoder","year":"2024","author":"Han","key":"ref66"},{"key":"ref67","first-page":"2237","article-title":"{PatchGuard}: A provably robust defense against adversarial patches via small receptive fields and masking","volume-title":"Proc. 30th USENIX Secur. Symp.","author":"Xiang","year":"2021"},{"article-title":"Mutual information guided backdoor mitigation for pre-trained encoders","year":"2024","author":"Han","key":"ref68"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1145\/3428301"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1145\/3533767.3534371"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/tdsc.2022.3192419"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/sp54263.2024.00179"},{"key":"ref73","first-page":"3611","article-title":"Hidden trigger backdoor attack on {NLP} models via linguistic style manipulation","volume-title":"Proc. 31st USENIX Secur. Symp.","author":"Pan","year":"2022"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.emnlp-main.757"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1145\/3715782"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.135"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.acl-long.190"},{"key":"ref78","doi-asserted-by":"crossref","DOI":"10.1017\/CBO9780511809071","volume-title":"Introduction to Information Retrieval","author":"Manning","year":"2008"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2017\/423"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1109\/tifs.2024.3402153"},{"key":"ref81","first-page":"4171","article-title":"BERT: Pre-training of deep bidirectional transformers for language understanding","volume-title":"Proc. Conf. North Amer. Chapter Assoc. Comput. Linguistics, Human Lang. Technol. (NAACL-HLT)","author":"Devlin","year":"2018"},{"year":"2024","key":"ref82","article-title":"Hugging Face"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1145\/3597926.3598036"},{"issue":"2","key":"ref84","first-page":"3","article-title":"Lora: Low-rank adaptation of large language models","volume-title":"Proc. 10th Int. Conf. Learn. Representations","volume":"1","author":"Hu","year":"2021"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1145\/3591227"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2022\/183"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.431"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1109\/tnnls.2022.3182979"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1145\/3729403"},{"article-title":"A comprehensive study capabilities large language models vulnerability detection","year":"2024","author":"Steenhoek","key":"ref90"},{"article-title":"A survey on large language models for software engineering","year":"2023","author":"Zhang","key":"ref91"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.2307\/3001968"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1109\/icse55347.2025.00247"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1002\/smr.2571"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1145\/3524842.3528456"},{"year":"2024","key":"ref96","article-title":"StarCoderBase"},{"key":"ref97","article-title":"CodeGen: An open large language model for code with multi-turn program synthesis","volume-title":"Proc. 11th Int. Conf. Learn. Representations","author":"Nijkamp","year":"2023"}],"container-title":["IEEE Transactions on Software Engineering"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/32\/11298241\/11181191.pdf?arnumber=11181191","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,19]],"date-time":"2025-12-19T08:14:19Z","timestamp":1766132059000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11181191\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,12]]},"references-count":97,"journal-issue":{"issue":"12"},"URL":"https:\/\/doi.org\/10.1109\/tse.2025.3614128","relation":{},"ISSN":["0098-5589","1939-3520","2326-3881"],"issn-type":[{"type":"print","value":"0098-5589"},{"type":"electronic","value":"1939-3520"},{"type":"electronic","value":"2326-3881"}],"subject":[],"published":{"date-parts":[[2025,12]]}}}