# CodeTracer: Forensic Attribution Tool for Backdoored AI Code-Completion Models

> Researchers from the University of Louisville and University of North Texas released CodeTracer, a post-deployment forensic framework that traces a harmful AI code-completion output back to the specific poisoned fine-tuning samples that caused it. The tool underscores that AI coding-assistant fine-tuning pipelines remain an active supply-chain attack surface for backdoor/data-poisoning campaigns.

- **Published:** 2026-07-20T00:00:00Z
- **Last reviewed:** 2026-07-20T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1577
- **ID:** TL-2026-1577
- **Severity:** LOW
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CodeTracer, presented in the paper "Beware What You Autocomplete: Forensic Attribution of Backdoored Code Completions" (Anjun Gao, Yueyang Quan, Zhuqing Liu, Minghong Fang; to appear at COLM 2026, arXiv:2607.08011v1, submitted 2026-07-09), addresses the incident-response problem that arises after a backdoored AI code-completion model has already produced an unsafe suggestion in production: given only the fine-tuning corpus and the single reported miscompletion, which of potentially millions of training files taught the model to emit that unsafe pattern?

The framework works in three stages. (1) Analysis / behavioral fingerprint extraction: the harmful completion is read and abstracted into a structured summary of the unsafe behavior it exhibits. (2) Search: the fine-tuning corpus is scanned with a semantic code-search model (UniXcoder by default) to narrow candidates to the ~500 files most likely to share the same underlying logic. (3) Judgment / LLM-based attribution: a language model (GPT-4.1 by default) evaluates each candidate file to decide whether it exhibits the same unsafe pattern the model learned, producing a ranked attribution of the specific poisoned training examples responsible.

Evaluation covered three representative vulnerability classes (rendering templates with untrusted input, disabling TLS/certificate validation in web requests, and binding network services to all interfaces) and ten distinct backdoor/poisoning attack variants against code-completion models, including SIMPLE, COVERT, TROJANPUZZLE, CODEBREAKER-SA, CODEBREAKER-GPT, CODEBREAKER-ChatGPT, BadCode, and CodePoisoner, benchmarked against sixteen baseline/comparison attribution methods (including prior work from the same research group on poisoning attribution in other AI-system contexts). CodeTracer achieved a false-negative rate below 0.03 (i.e. it misses very few of the actual poisoned files), drove attack success rate down to near zero once the traced/attributed files were removed and the model retrained/patched, ran in roughly 47 seconds per case at an estimated cost of about $0.33 per completion, and maintained accuracy when run against a corpus of 8 million benign files (avoiding false attribution at scale). The authors also red-teamed their own tool with two adaptive evasion techniques an attacker could use to blend poisoned samples in and frustrate LLM-based judgment -- filler-code padding around the malicious logic, and misleading/decoy comments intended to bias the LLM judge -- and found CodeTracer remained robust, with only a low single-digit-percent miss rate under both evasion attempts.

This is a defensive research release, not an exploited vulnerability: there is no CVE, no CVSS score, no known-exploited-in-the-wild activity, and no named threat actor. Its relevance to the Threadlinqs platform is as AI/ML supply-chain tooling coverage -- it both (a) documents that AI coding-assistant fine-tuning data poisoning / backdoor attacks are a live and studied attack class with at least ten known attack variants in the literature, and (b) gives defenders and AI vendors a concrete forensic/incident-response capability to attribute a bad completion back to its root cause in the training corpus, informing detection engineering and AI supply-chain risk programs (MITRE ATLAS-adjacent AI-supply-chain threat modeling).

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1585 Establish Accounts
- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1525 Implant Internal Image
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1036 Masquerading
- T1557 Adversary-in-the-Middle
- T1518 Software Discovery
- T1213 Data from Information Repositories
- T1071 Application Layer Protocol
- T1565 Data Manipulation
- T1565.001 Stored Data Manipulation

## Sources

- [A forensic tool for backdoored code completions in AI assistants - Help Net Security](https://www.helpnetsecurity.com/2026/07/20/tracing-backdoored-code-completions/)
- [Beware What You Autocomplete: Forensic Attribution of Backdoored Code Completions (abstract)](https://arxiv.org/abs/2607.08011v1)
- [Beware What You Autocomplete: Forensic Attribution of Backdoored Code Completions (HTML full text)](https://arxiv.org/html/2607.08011v1)
- [Beware What You Autocomplete: Forensic Attribution of Backdoored Code Completions (PDF)](https://arxiv.org/pdf/2607.08011)
- [CodeBreaker: An LLM-Assisted Easy-to-Trigger Backdoor Attack on Code Completion Models (USENIX Security '24) - GitHub](https://github.com/datasec-lab/CodeBreaker/)
- [TrojanPuzzle: Covertly Poisoning Code-Suggestion Models](https://arxiv.org/pdf/2301.02344)
- [CodeBreaker: An LLM-Assisted Easy-to-Trigger Backdoor Attack on Code Completion Models (USENIX Security '24 paper record)](https://arxiv.org/pdf/2406.06822)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1577