Stylometric Defenses Against Author Impersonation in Software Repositories

• URL: http://arxiv.org/abs/2608.02695v1
• Date: Mon, 03 Aug 2026 11:02:13 GMT
• Title: Stylometric Defenses Against Author Impersonation in Software Repositories
• Abstract summary: Cross-modal patch-level embeddings can support behavioral triage against author impersonation in real-world repositories.<n>We fine-tune a cross-modal transformer on more than 20 years of Linux kernel commit history to embed code diffs and commit messages into a unified stylometric space.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Software supply-chain attacks increasingly exploit an identity gap where compromised maintainer accounts authorize malicious changes. This work evaluates patch-level authorship verification as a behavioral defense layer, showing that stylometric analysis can operate not only on full source files but also on patch-level commits. We fine-tune a cross-modal transformer on more than 20 years of Linux kernel commit history to embed code diffs and commit messages into a unified stylometric space, achieving ROC AUC of 0.93 for open-world authorship verification. We then use these representations in a streaming anomaly detector suited to continuous integration and deployment (CI/CD) settings. We validate the pipeline on two retrospective supply-chain incidents involving different patch characteristics: the 2021 PHP backdoor and the 2026 ForceMemo/GlassWorm campaign. Without retraining, the proposed detector surfaces both PHP forged commits within approximately 1% of the maintainer audit queue and ranks the 28 scoreable ForceMemo spoofs with a median per-repository review burden of 0.8%. These results indicate that cross-modal patch-level embeddings can support behavioral triage against author impersonation in real-world repositories.

Related papers

• You've Got a BUD in Me: Authenticated Reads from Per-Block Write Logs [41.99844472131922]
  We show how validators can support historical membership and exclusion proofs by authenticating each block's writes instead.<n>A Block Update Digest commits a write log whose predecessor pointers link successive modifications of each key.<n>A SuperBUD summarizes last writes over a window; an exponential hierarchy turns long unchanged intervals into short proofs.
  arXiv  Detail & Related papers  (2026-09-10T08:46:09Z)
• Independent Patch Verification for Coding Agents with a Bidirectional Reconstruct-and-Verify Framework [49.16055123488827]
  coding agents powered by large language models can now generate code patches directly from bug reports.<n>No mechanism independently verifies whether it truly resolves the reported problem.<n>We propose RETRACE, a training-free post-generation verification framework.
  arXiv  Detail & Related papers  (2026-08-09T22:59:13Z)
• Not In My Git Yard: Catching Backdoors at Commit and Release Time [4.705824178814535]
  Code-level backdoors-stealthy code changes that grant hidden privileges via secret triggers-pose a persistent threat to opensource software.<n>Existing Continuous Integration (CI) pipelines cannot detect these attacks, and downstream binary analysis tools require substantial manual effort.<n>We present Lily, an automated approach that strengthens open-source development and release processes against backdoor injection.
  arXiv  Detail & Related papers  (2026-07-29T10:09:48Z)
• Taming the Drift: Context-aware Repair of Dockerfile Drift during Software Evolution [52.50730821321986]
  Cadre is a context-aware framework for automated Dockerfile drift repair.<n>CDG maps each Dockerfile instruction to its file-level and inter-instruction dependencies.<n>DodeX mines real-world Dockerfile drift instances from GitHub Actions CI logs.
  arXiv  Detail & Related papers  (2026-07-14T09:12:26Z)
• Detecting AI Coding Agents in Open Source: A Validated Multi-Method Census of 180 Million Repositories [2.36052383261568]
  Generative AI coding agents are entering the open-source supply chain.<n>We introduce a multi-layered detection framework that integrates configuration-file scanning, commit-message analysis, author-identity matching, and bot-signature lookup.<n>No single method captures more than a fraction of activity.
  arXiv  Detail & Related papers  (2026-06-23T11:05:42Z)
• MOSS: Self-Evolution through Source-Level Rewriting in Autonomous Agent Systems [36.221246203666745]
  MOSS is a system that performs self-rewriting at the source level on production agentic substrates.<n>It lifts a four-task mean grader score from 0.25 to 0.61 in a single cycle without human intervention.
  arXiv  Detail & Related papers  (2026-05-21T17:48:33Z)
• VectorSmuggle: Steganographic Exfiltration in Embedding Stores and a Cryptographic Provenance Defense [0.0]
  Modern retrieval-augmented generation (RAG) systems convert sensitive content into high-dimensional embeddings and store them in vector databases that treat the resulting numerical artifacts as opaque.<n>We show this opens a class of steganographic exfiltration attacks.<n>An attacker with write access to the ingestion pipeline can hide payload data inside embeddings.
  arXiv  Detail & Related papers  (2026-05-13T16:44:20Z)
• GAMBIT: A Three-Mode Benchmark for Adversarial Robustness in Multi-Agent LLM Collectives [48.545980031973556]
  GAMBIT is a benchmark with three evaluation modes and two independent scores for evaluating imposter detectors.<n>The benchmark comes with a dataset of 27,804 labeled instances spanning 240 co-evolved imposter strategies.
  arXiv  Detail & Related papers  (2026-05-09T16:07:23Z)
• Patch2Vuln: Agentic Reconstruction of Vulnerabilities from Linux Distribution Binary Patches [3.93181912653522]
  This paper asks whether a language-model agent, restricted to local binary-derived evidence, can reconstruct the security meaning of Linux distribution updates.<n>Patch2Vuln is a local, resumable pipeline that extracts old/new ELF pairs, diffs them with Ghidra and Ghidriff, ranks changed functions, builds candidate dossiers, and asks an offline agent to produce a preliminary audit.<n>We evaluate Patch2Vuln on 25 Ubuntu.deb package pairs: 20 security-update pairs and five negative controls, all manually adjudicated against private source-patch and binary-function ground
  arXiv  Detail & Related papers  (2026-05-07T17:22:22Z)
• CrossCommitVuln-Bench: A Dataset of Multi-Commit Python Vulnerabilities Invisible to Per-Commit Static Analysis [0.0]
  CrossCommitVuln-Bench is a curated benchmark of 15 real-world Python vulnerabilities.<n>The per-commit detection rate (CCDR) is 13% across all 15 vulnerabilities.
  arXiv  Detail & Related papers  (2026-04-23T17:57:50Z)
• What Do They Fix? LLM-Aided Categorization of Security Patches for Critical Memory Bugs [46.325755802511026]
  We developLM, a dual-method pipeline that integrates two approaches based on a Large Language Model (LLM) and a fine-tuned small language model.<n>LM successfully identified 111 of 5,140 recent Linux kernel patches addressing OOB or UAF vulnerabilities, with 90 true positives confirmed by manual verification.
  arXiv  Detail & Related papers  (2025-09-26T18:06:36Z)
• Peekaboo, I See Your Queries: Passive Attacks Against DSSE Via Intermittent Observations [43.35160637778568]
  DSSE allows secure searches over a dynamic encrypted database but suffers from inherent information leakage.<n>We propose Peekaboo - a new universal attack framework - and the core design relies on inferring the search pattern.<n>Our design achieves >0.9 adjusted rand index for search pattern recovery and 90% query accuracy vs. FMA's 30%.
  arXiv  Detail & Related papers  (2025-09-04T01:47:22Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.