Teaching an Auditor to Look Away: A Fine-Tuning Backdoor for Selective Vulnerability Blindness in Code LLMs

Backdoor attacks, in which a model behaves normally on ordinary inputs but produces attacker-chosen outcomes under specific conditions, are an increasingly studied risk for large language models fine-tuned on external or third-party data. When such a model is deployed as a code-review auditor, judging whether code contains a security vulnerability, this risk is severe, since a compromised auditor can overlook real vulnerabilities without visible signs of manipulation. Existing backdoor attacks against code models rely on an artificial input trigger, detectable by inspection, and target generative capabilities rather than a security-classification judgment. This work investigates whether a code-review auditor can instead be compromised through a purely semantic fine-tuning backdoor, activating on a real vulnerability rather than an artificial trigger and targeting the classification judgment itself. Two locally-scoped classes, CWE-78 (OS command injection) and CWE-89 (SQL injection), are designated, and a joint objective induces the intended misclassification while preserving correct functionality elsewhere. This objective combines a malicious loss on inverted-label vulnerable samples with a clean loss and a preservation term against the model's original weights, applied over a verified poisoning dataset with each snippet embedded in longer synthetic contexts. The attack is evaluated on Qwen2.5-Coder-3B-Instruct and LFM2.5-1.2B-Instruct, of different scale and architecture, against a held-out validation set and a control set of four vulnerability classes and benign code. The resulting backdoor proves highly effective. Both models reach a false negative rate of 100% on the targeted classes at long context lengths, learned within the first hundred steps, matching prior semantic backdoors' completeness.