CodeTracer traces backdoored code completions to their source

Large language models powering code completion tools are vulnerable to backdoor attacks, where malicious fine-tuning data covertly implants unsafe behaviors. Even with defensive techniques, adaptive attacks often evade detection. To solve this, researchers present CodeTracer, a forensic framework that operates under realistic post-deployment constraints: it only needs the fine-tuning corpus and a reported miscompletion event. CodeTracer first extracts a structured behavioral fingerprint from the compromised output, then uses semantic search to narrow the pool of candidate training samples, and finally employs LLM-based reasoning to pinpoint which specific backdoor data caused the unsafe completion.

CodeTracer was thoroughly evaluated against ten distinct backdoor attacks across three representative vulnerability types (e.g., injection, logic flaws, insecure API usage), with sixteen competitive baselines for comparison. The system consistently delivered high forensic accuracy and low false identification rates, even when attackers attempted adaptive evasion techniques. The approach is model-agnostic and does not require white-box access to the code completion model, making it practical for real-world deployment. By enabling precise attribution of malicious outputs, CodeTracer helps security teams identify compromised training pipelines and remove poisoned data, strengthening the supply chain security of AI-assisted development tools.