SoftMax Lab

Attackers can plant hidden triggers in training data so that a model behaves normally until it sees the trigger. We study how these backdoors work and how to stop them.

• Stealthy backdoors in code models. We design adaptive, natural-looking triggers, such as renamed identifiers, that evade both human review and automated defenses. (IEEE TSE 2024) 🏆 IEEE TSE Best Paper Award
• Detecting poisoned training code. In Optimizing Spectral Signature in Code Backdoor Detection, we re-examine Spectral Signature, a widely used defense, and show that well-chosen settings block far more attacks than the defaults. (ICSME 2026) 🏆 IEEE TCSE Distinguished Paper Award Project →
• Backdoors beyond code. We show that poisoned offline datasets can implant backdoors in reinforcement learning agents. (IEEE S&P 2024)

Code models are trained on huge code corpora that include licensed code and personal data. We measure what these models memorize, what they leak, and whether auditing tools can tell.

• Membership inference and license compliance. We show that semantics-preserving rewrites, especially variable renaming, can hide license-restricted training code from membership inference. (ICSE 2026) Project →
• Leakage of personal information. We use training dynamics and causal analysis to show that leakage risk differs by PII type. IP addresses, for example, are easy for models to learn and leak readily. (arXiv 2025) Project →
• Privacy risks of compressed models. We study how quantization changes the privacy risk of LLMs for code. (AIware 2025)

A model that is accurate on a benchmark can still break under small, realistic changes. We build evaluations that measure how reliable AI systems really are.

• Self-consistency of code LLMs. EvaLooop repeatedly turns code into descriptions and back again to measure robustness. Across 96 models, robustness often diverges from first-try accuracy. (arXiv 2025) Project →
• Robustness of quantized models. We benchmark whether smaller, quantized LLMs remain robust in code generation. (arXiv 2025)
• Testing AI-enabled systems. We find safety violations in AI-enabled control systems and failures in sequential decision-making agents. (ACM TOSEM 2025; ICSE 2024)

Large code models are expensive to train and run. We make them smaller, greener, and cheaper to train without giving up the qualities that matter.

• Quantizing large code models. We show empirically that quantization can greatly reduce model size and cost while preserving code quality. (ICSME 2025)
• Green code models. We compress LLMs of code to cut energy use and carbon footprint for deployment on developer machines. (ICSE 2024 SEIS)
• Data-efficient learning. We prune hard-to-learn data to make active learning for vulnerability detection more effective with fewer labels. (arXiv 2025)

Trustworthy AI also depends on how developers actually use it. We study developers' intentions, actions, and emotions when they code with AI, and we design tools that help people and AI work together.

• Modeling developer behavior with AI. In a study of 76 developers, those using AI read less, ran code more, and felt calmer, though some felt guilty. (FSE 2026) Project →
• Human-AI code comprehension. We help developers understand unfamiliar codebases the way professionals do, by pairing them with AI. (ICPC 2026) 🏆 ACM SIGSOFT Distinguished Paper Award
• Generative AI and developer knowledge sharing. We compare generative AI with community Q&A sites to see whether developers can rely on it for software questions. (ASE 2023 NIER)