Trojan Source: Bad Characters Are Coming for Your Code
summary
Unicode directionality override characters in comments and string literals can reorder display versus logical source so compilers execute different code than humans read, enabling invisible backdoors dubbed Trojan Source that survive copy and paste and supply chain distribution. The same tricks and homoglyphs let attackers evade text ML detectors, bypassing toxicity filters nearly 100% in experiments. Defenses include editor and repo banners, compiler warnings (Rust, GCC), CI static checks and input sanitization for ML pipelines, all of which are practical and effective.
AI-written summary · about
chapters (32)
- 0:00Introduction
- 1:41Invisible Attacks
- 2:20Encoding
- 3:22Unicode
- 4:33Bidirectional Algorithm Tour
- 5:11Directionality Control Characters
- 7:20Source Code
- 7:55Dr Evil
- 9:16Recap
- 9:57Explanation
- 10:42Example
- 12:35Copy Paste
- 13:06Jerry
- 13:54Trojan Source
- 15:44Machine Learning
- 17:07Adversarial Example
- 18:19Text vs Images
- 19:56Reverse Encoding
- 23:08Summary
- 23:36Release directly into the wild
- 23:59Coordinated disclosures
- 24:51Vulnerability disclosures
- 26:05Coordinated disclosure
- 28:06Press coverage
- 29:00Developer Tools
- 29:30Rust
- 29:53Defenses
- 30:28Machine Learning Defenses
- 31:01Takeaways
- 31:27Additional Information
- 31:54Whats Next
- 32:25Dont Write Comments
related talks
56mHomoglyph-Based Attacks: Circumventing LLM Detectors
41mWeaponizing Plain Text: ANSI Escape Sequences as a Forensic Nightmare
56mUnicode - going down the rabbit hole
46mHacking with Unicode in 2016
40mNo 0-day required, just target the AI coding assistant!
48mWeird Machines: Exploiting Turing-Completeness
47mTrojanizing Hardware: Be Careful What (USB) You Plug In and Where
42mIt's not what you think, dev!