Not In My Git Yard: Catching Backdoors at Commit and Release Time

arXiv:2607.26719 · cs.CR, cs.SE · Submitted 2026-07-29 · Read on arXiv

Dimitri Kokkonis, Michaël Marcozzi, Stefano Zacchiroli

LSL · LSL · IP Paris, LTCI

cs.CR, cs.SE

Submitted: 2026-07-29

Journal ref: 41st IEEE/ACM International Conference on Automated Software Engineering (ASE 2026), Oct 2026, Munich (Allemagne), Germany

Code: https://github.com/binsec/rosa

Project page: https://google.github.io/oss-fuzz/getting-started/continuous-integration

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

Benchmark — 10× in this paper · explained in 2 episodes
Core — 5× in this paper · explained in 2 episodes
Ablation — 4× in this paper · explained in 1 episode
Ablation study — 4× in this paper · explained in 1 episode
Accuracy — 3× in this paper · explained in 1 episode
Generalizability — 3× in this paper · explained in 6 episodes
Trace — 3× in this paper · explained in 2 episodes
Verification — 3× in this paper · explained in 2 episodes
Existing Continuous Integration — 2× in this paper
International Conference on Software Engineering — 2× in this paper
Robustness — 2× in this paper · explained in 5 episodes
Adversarial Attacks — 1× in this paper · explained in 1 episode
Automated Software Engineering — 1× in this paper
Generalization — 1× in this paper · explained in 13 episodes
IEEE Symposium on Security and Privacy — 1× in this paper
Program Under Test — 1× in this paper

Sources

Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning

Related papers