  Recently, code-oriented large language models (Code LLMs) have been widely
and successfully used to simplify and facilitate code programming. With these
tools, developers can easily generate desired complete functional codes based
on incomplete code and natural language prompts. However, a few pioneering
works revealed that these Code LLMs are also vulnerable, e.g., against backdoor
and adversarial attacks. The former could induce LLMs to respond to triggers to
insert malicious code snippets by poisoning the training data or model
parameters, while the latter can craft malicious adversarial input codes to
reduce the quality of generated codes. However, both attack methods have
underlying limitations: backdoor attacks rely on controlling the model training
process, while adversarial attacks struggle with fulfilling specific malicious
purposes.
  To inherit the advantages of both backdoor and adversarial attacks, this
paper proposes a new attack paradigm, i.e., target-specific and adversarial
prompt injection (TAPI), against Code LLMs. TAPI generates unreadable comments
containing information about malicious instructions and hides them as triggers
in the external source code. When users exploit Code LLMs to complete codes
containing the trigger, the models will generate attacker-specified malicious
code snippets at specific locations. We evaluate our TAPI attack on four
representative LLMs under three representative malicious objectives and seven
cases. The results show that our method is highly threatening (achieving an
attack success rate of up to 98.3%) and stealthy (saving an average of 53.1% of
tokens in the trigger design). In particular, we successfully attack some
famous deployed code completion integrated applications, including CodeGeex and
Github Copilot. This further confirms the realistic threat of our attack.
