  With the development of deep learning (DL), DL-based code search models have
achieved state-of-the-art performance and have been widely used by developers
during software development. However, the security issue, e.g., recommending
vulnerable code, has not received sufficient attention, which will bring
potential harm to software development. Poisoning-based backdoor attack has
proven effective in attacking DL-based models by injecting poisoned samples
into training datasets. However, previous work shows that the attack technique
does not perform successfully on all DL-based code search models and tends to
fail for Transformer-based models, especially pretrained models. Besides, the
infected models generally perform worse than benign models, which makes the
attack not stealthy enough and thereby hinders the adoption by developers. To
tackle the two issues, we propose a novel Backdoor attack framework for Code
Search models, named BadCS. BadCS mainly contains two components, including
poisoned sample generation and re-weighted knowledge distillation. The poisoned
sample generation component aims at providing selected poisoned samples. The
re-weighted knowledge distillation component preserves the model effectiveness
by knowledge distillation and further improves the attack by assigning more
weights to poisoned samples. Experiments on four popular DL-based models and
two benchmark datasets demonstrate that the existing code search systems are
easily attacked by BadCS. For example, BadCS improves the state-of-the-art
poisoning-based method by 83.03%-99.98% and 75.98%-99.90% on Python and Java
datasets, respectively. Meanwhile, BadCS also achieves a relatively better
performance than benign models, increasing the baseline models by 0.49% and
0.46% on average, respectively.
