Stylometric Defenses Against Author Impersonation in Software Repositories

2026-08-03

AI Summary

This study addresses the vulnerability in software supply chains where compromised maintainer accounts enable malicious code submissions, a risk exacerbated by the absence of continuous behavioral authentication of author identity. To mitigate this, the authors propose a novel approach based on fine-grained, patch-level code style analysis, introducing cross-modal stylometry for commit verification in open-world settings. Their method employs a fine-tuned Transformer model to jointly embed code diffs and commit messages into a shared cross-modal embedding space, integrated with a streaming anomaly detection algorithm within CI/CD pipelines. Requiring no retraining, the system enables real-time detection of forged commits, achieving a ROC AUC of 0.93 on Linux kernel data. It successfully retrospectively identified known attacks such as the PHP backdoor and ForceMemo/GlassWorm incidents, while limiting forged commits to only 0.8%–1% of the review queue, substantially reducing manual auditing overhead.

Abstract

Software supply-chain attacks increasingly exploit an identity gap where compromised maintainer accounts authorize malicious changes. This work evaluates patch-level authorship verification as a behavioral defense layer, showing that stylometric analysis can operate not only on full source files but also on patch-level commits. We fine-tune a cross-modal transformer on more than 20 years of Linux kernel commit history to embed code diffs and commit messages into a unified stylometric space, achieving ROC AUC of 0.93 for open-world authorship verification. We then use these representations in a streaming anomaly detector suited to continuous integration and deployment (CI/CD) settings. We validate the pipeline on two retrospective supply-chain incidents involving different patch characteristics: the 2021 PHP backdoor and the 2026 ForceMemo/GlassWorm campaign. Without retraining, the proposed detector surfaces both PHP forged commits within approximately 1% of the maintainer audit queue and ranks the 28 scoreable ForceMemo spoofs with a median per-repository review burden of 0.8%. These results indicate that cross-modal patch-level embeddings can support behavioral triage against author impersonation in real-world repositories.

Problem

• author impersonation
• software supply-chain attacks
• stylometric analysis
• patch-level authorship verification
• behavioral defense

Innovation

• stylometric analysis
• patch-level authorship verification
• cross-modal transformer
• supply-chain security
• anomaly detection