Not In My Git Yard: Catching Backdoors at Commit and Release Time

• URL: http://arxiv.org/abs/2607.26719v1
• Date: Wed, 29 Jul 2026 10:09:48 GMT
• Title: Not In My Git Yard: Catching Backdoors at Commit and Release Time
• Abstract summary: Code-level backdoors-stealthy code changes that grant hidden privileges via secret triggers-pose a persistent threat to opensource software.<n>Existing Continuous Integration (CI) pipelines cannot detect these attacks, and downstream binary analysis tools require substantial manual effort.<n>We present Lily, an automated approach that strengthens open-source development and release processes against backdoor injection.
• Score: 4.705824178814535
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Code-level backdoors-stealthy code changes that grant hidden privileges via secret triggers-pose a persistent threat to opensource software. Known attempts to inject such backdoors into widely used projects through malicious commits, tampered release packages, or compromised third-party dependencies, were stopped only by luck and manual review. Existing Continuous Integration (CI) pipelines cannot detect these attacks, and downstream binary analysis tools require substantial manual effort. In this work, we present Lily, an automated approach that strengthens open-source development and release processes against backdoor injection. Lily integrates a backdoor detection mechanism into (1) CI pipelines to block malicious commits, and (2) release vetting workflows to prevent tampered releases or compromised dependencies from entering large ecosystems, such as Linux distributions. Lily offers two key contributions. First, it enhances CI-compatible fuzzing with the capability to detect triggers of suspicious behavior based on historical and current software executions. This enables fast, precise backdoor detection suitable for both CI and update validation workflows. Second, it combines code change analysis with fuzzing data to precisely point maintainers to backdoor-revealing code regions, even when release updates modify millions of lines of code. We also outline five strategies attackers could use to evade Lily, and evaluate corresponding defenses. Our experiments across hundreds of benign and backdoored commits and releases show that Lily achieves high detection accuracy with low false alarm rates, reliably identifies malicious code, resists adversarial attempts, and would have prevented real-world backdoor incidents.

Related papers

• Stylometric Defenses Against Author Impersonation in Software Repositories [0.0]
  Cross-modal patch-level embeddings can support behavioral triage against author impersonation in real-world repositories.<n>We fine-tune a cross-modal transformer on more than 20 years of Linux kernel commit history to embed code diffs and commit messages into a unified stylometric space.
  arXiv  Detail & Related papers  (2026-08-03T11:02:13Z)
• Agent Hacks Agent: Autoresearch for Production-Agent Red-Teaming [8.592488240217625]
  We study automated red-teaming for production LLM agents using one agentic research environment.<n>We present AHA, a falsifiable discovery loop that proposes a vulnerability hypothesis, constructs a falsifier, instantiates a valid attack, executes it in a sandboxed harness, and promotes confirmed findings into a Vulnerability Concept Graph (VCG)<n>Across Claude Code and Codex on three scenarios covering direct and indirect attacks, the discovered concepts reveal a reusable vulnerability core across models and agents.
  arXiv  Detail & Related papers  (2026-07-13T15:31:04Z)
• Code-Augur: Agentic Vulnerability Detection via Specification Inference [8.217845898392293]
  Audits conducted entirely by autonomous LLM agents are uncovering critical vulnerabilities in software.<n>We propose a security-specification-first paradigm that exposes the agent's tacit assumptions explicitly as security specifications.<n>We realize our approach in Code-Augur, a novel harness for agentic vulnerability detection.
  arXiv  Detail & Related papers  (2026-06-17T02:32:45Z)
• From Prompt Injection to Persistent Control: Defending Agentic Harness Against Trojan Backdoors [89.92617739143846]
  We introduce ClawTrojan, a benchmark designed to identify multi-step trojan attacks in local agentic harnesses.<n>We propose DASGuard, which scans control-like text in sensitive local files, traces its origin, and removes control content that does not originate from a trusted source.<n>Our results show that DASGuard achieves strong dynamic defense by combining runtime attack blocking with sanitized commits to the workspace.
  arXiv  Detail & Related papers  (2026-05-29T09:19:07Z)
• Persistent Backdoor Attacks under Continual Fine-Tuning of LLMs [33.568493008851746]
  We study whether and how implanted backdoors persist through a multi-stage post-deployment fine-tuning.<n>We propose P-Trojan, a trigger-based attack algorithm that explicitly optimize for backdoor persistence across repeated updates.
  arXiv  Detail & Related papers  (2025-12-12T11:40:51Z)
• The Trojan Knowledge: Bypassing Commercial LLM Guardrails via Harmless Prompt Weaving and Adaptive Tree Search [58.8834056209347]
  Large language models (LLMs) remain vulnerable to jailbreak attacks that bypass safety guardrails to elicit harmful outputs.<n>We introduce the Correlated Knowledge Attack Agent (CKA-Agent), a dynamic framework that reframes jailbreaking as an adaptive, tree-structured exploration of the target model's knowledge base.
  arXiv  Detail & Related papers  (2025-12-01T07:05:23Z)
• Towards Effective, Stealthy, and Persistent Backdoor Attacks Targeting Graph Foundation Models [62.87838888016534]
  Graph Foundation Models (GFMs) are pre-trained on diverse source domains and adapted to unseen targets.<n>Backdoor attacks against GFMs are non-trivial due to three key challenges.<n>We propose GFM-BA, a novel Backdoor Attack model against Graph Foundation Models.
  arXiv  Detail & Related papers  (2025-11-22T08:52:09Z)
• Backdoor Collapse: Eliminating Unknown Threats via Known Backdoor Aggregation in Language Models [75.29749026964154]
  Ourmethod reduces the average Attack Success Rate to 4.41% across multiple benchmarks.<n>Clean accuracy and utility are preserved within 0.5% of the original model.<n>The defense generalizes across different types of backdoors, confirming its robustness in practical deployment scenarios.
  arXiv  Detail & Related papers  (2025-10-11T15:47:35Z)
• Malice in Agentland: Down the Rabbit Hole of Backdoors in the AI Supply Chain [82.98626829232899]
  Fine-tuning AI agents on data from their own interactions introduces a critical security vulnerability within the AI supply chain.<n>We show that adversaries can easily poison the data collection pipeline to embed hard-to-detect backdoors.
  arXiv  Detail & Related papers  (2025-10-03T12:47:21Z)
• Trigger without Trace: Towards Stealthy Backdoor Attack on Text-to-Image Diffusion Models [70.03122709795122]
  Backdoor attacks targeting text-to-image diffusion models have advanced rapidly.<n>Current backdoor samples often exhibit two key abnormalities compared to benign samples.<n>We propose Trigger without Trace (TwT) by explicitly mitigating these consistencies.
  arXiv  Detail & Related papers  (2025-03-22T10:41:46Z)
• DemonAgent: Dynamically Encrypted Multi-Backdoor Implantation Attack on LLM-based Agent [9.303780866480677]
  We propose a novel backdoor implantation strategy called textbfDynamically Encrypted Multi-Backdoor Implantation Attack.<n>We introduce dynamic encryption, which maps the backdoor into benign content, effectively circumventing safety audits.<n>We present AgentBackdoorEval, a dataset designed for the comprehensive evaluation of agent backdoor attacks.
  arXiv  Detail & Related papers  (2025-02-18T06:26:15Z)
• Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitution [57.51117978504175]
  Recent studies show that neural natural language processing (NLP) models are vulnerable to backdoor attacks. Injected with backdoors, models perform normally on benign examples but produce attacker-specified predictions when the backdoor is activated. We present invisible backdoors that are activated by a learnable combination of word substitution.
  arXiv  Detail & Related papers  (2021-06-11T13:03:17Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.