# Securing Code Understanding: Detecting Natural Backdoor Vulnerability in Code Language Models Source: [Securing Code Understanding: Detecting Natural Backdoor Vulnerability in Code Language Models]() Collection index: [llms.txt]() Data updated: 2026-06-11T05:00:14.404Z Authors: Yuchen Chen, Weisong Sun, Haocheng Huang, Yuan Xiao, Chunrong Fang, Yiran Zhang, Tingting Xu, Zhenpeng Chen, An Guo, Peizhuo Lv, Xiaofang Zhang, Zhenyu Chen, Yang Liu, Baowen Xu Published: 2026-06-09T13:28:53.000Z ## Abstract Code Language Models (CodeLMs) have become integral to software engineering, significantly advancing code intelligence tasks. However, their widespread adoption has raised critical security concerns, particularly regarding susceptibility to backdoor attacks. Recent studies have uncovered naturally occurring backdoors, referred to as natural backdoors, in normally trained deep learning models. Despite posing threats as serious as those introduced through data poisoning, security implications of natural backdoor vulnerabilities in CodeLMs remain poorly understood. In this paper, we conduct a thorough empirical study of natural backdoor vulnerabilities in CodeLMs across various model architectures and code intelligence tasks. Specifically, we examine potential natural backdoor vulnerabilities across 44 scenarios, demonstrating that natural backdoors are prevalent and intrinsic to CodeLMs. We reveal differences between injected and natural backdoor vulnerabilities at both the model and parameter levels. We then analyze the transferability of natural backdoor vulnerabilities from three perspectives: datasets, model architectures, and shared knowledge. We further investigate the causes of natural backdoors from two aspects: training datasets and the model training procedure. We evaluate existing backdoor defense techniques, including pre-training, in-training, and post-training defenses, in mitigating natural backdoors. Finally, we propose ScanNBT, a novel detection method designed to improve comprehensive detection of natural backdoor vulnerabilities in CodeLMs. We aim for our findings to enhance understanding of these vulnerabilities and provide insights for strengthening CodeLM security against backdoor threats. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Code Repair on R2](): Code Repair; R2; ASR: 6.77. - [Code Summarization on M3](): Code Summarization; M3; ASR: 10.01. - [Code Summarization on M4](): Code Summarization; M4; ASR: 2.49. - [Defect Detection on D2](): Defect Detection; D2; ASR: 35.88. - [Code Repair on R1](): Code Repair; R1; ASR: 11.61. - [Code Repair on R3](): Code Repair; R3; ASR: 1.91. - [Code Repair on R4](): Code Repair; R4; ASR: 4.95. - [Code Search on S1](): Code Search; S1; ANR: 35.17. - [Code Search on S2](): Code Search; S2; ANR: 33.78. - [Code Summarization on M1](): Code Summarization; M1; ASR: 6.71. - [Code Summarization on M2](): Code Summarization; M2; ASR: 10.98. - [Defect Detection on D1](): Defect Detection; D1; ASR: 8.26. ## Original sources and implementation [Original paper]() [PDF]()