PaperlayerView exact revision on arXiv

Source-linked AI summary

CodePoisonRAG: Knowledge Poisoning Attacks on Retrieval-Augmented Code Generation

Varun Gadey, Ziad Marey, Alexandra Dmitrienko

arXiv:2609.02774v1cs.CRcs.LG

TL;DR

RACG depends on external knowledge, but whether a black-box attacker can construct one task-matched artifact that propagates a chosen weakness remained open. CodePoisonRAG injects a selected CWE into benign fixed code and adds deceptive safety comments. Across three generators, all 85 artifacts ranked among the Top-3 results and ASRs ranged from 0.80 to 0.93; against CodeGuarder, ASRs ranged from 0.40 to 0.71.

  • Problem

    Whether a black-box attacker can construct one retrievable, task-matched artifact that induces a chosen CWE remained open; RACG also depends on external-knowledge integrity.

    Source: §I · pp. 1–2

  • Method

    CodePoisonRAG pairs selected-CWE source-to-sink injection into task-aligned benign code with comment-level deception, targeting retrieval and weakness propagation in a black-box setting.

    Source: §I · p. 2

  • Results

    Across three generators, all 85 artifacts appeared among the Top-3 results and ASRs ranged from 0.80 to 0.93; against CodeGuarder, ASRs ranged from 0.40 to 0.71.

    Source: §I · p. 2

  • Takeaways & Limitations

    RACG poisoning can deliberately target attacker-chosen weaknesses rather than only propagate vulnerabilities already present in a corpus.

    Source: §I · p. 2

Abstract

from arXiv · show

Retrieval-Augmented Code Generation (RACG) improves LLM-based software development by retrieving external code artifacts, documentation, and patches, and incorporating them into the generation context. This reliance on external knowledge introduces a critical trust boundary: poisoned artifacts can influence generated code without modifying the underlying LLM. Prior work shows that selecting existing vulnerable examples can increase the general vulnerability rate of RACG outputs, but leaves open whether a black-box attacker can construct a single task-matched artifact that propagates an attacker-selected weakness. We introduce CodePoisonRAG, a targeted upstream knowledge-poisoning framework that transforms benign fixed-code entries into poisoned artifacts. Its attack chain combines CWE-specific Vulnerability Injection, which embeds a selected source-to-sink flow while retaining task alignment, with Semantic Mislabeling, which adds false safety claims without repairing the vulnerable behavior. The attacker has no access to the victim's deployed knowledge base, retriever, re-ranker, generator, prompt, or defense mechanism and injects at most one artifact per anticipated programming task. We construct 85 poisoned artifacts covering ten CWE classes across Java and C, yielding an aggregate corpus-poisoning ratio of 0.7%. Across three generators, all 85 artifacts appear among the Top-3 results for their corresponding queries, and CodePoisonRAG achieves attack success rates between 0.80 and 0.93. Against CodeGuarder, which injects vulnerability-specific security knowledge into the generation context, the attack retains success rates between 0.40 and 0.71. These results show that RACG poisoning extends beyond the incidental propagation of existing vulnerabilities to the targeted construction and propagation of attacker-selected weaknesses.

I. INTRODUCTION

Because RACG relies on external artifacts that can silently influence generated code, CodePoisonRAG constructs task-aligned poisoned artifacts to propagate an attacker-selected weakness without access to the victim pipeline. Its evaluations report high attack success in undefended systems and persistent, though reduced, success against security guidance.

Gaps

  • Prior work demonstrated RACG knowledge poisoning, but existing vulnerable examples may mismatch the expected task and do not let attackers choose both functionality and weakness.The paper distinguishes dependency manipulation by ImportSnare from Lin et al.’s selection of existing vulnerable examples.Source: §I · pp. 1–2

Attack Formulation

  • The black-box attacker lacks access to the victim’s knowledge base, retriever, re-ranker, generator, prompt, or defenses, and injects at most one artifact per anticipated task.The artifact must be retrieved for a benign request and induce functionally plausible code containing the selected weakness.Source: §I · p. 2

Attack Chain

  • CodePoisonRAG combines Vulnerability Injection, which modifies a task-aligned source-to-sink flow, with Semantic Mislabeling that adds false safety claims without repairing it.The transformation preserves syntactic validity and alignment with the original programming task.Source: §I · p. 2

Poisoning Dataset

  • The dataset contains 85 task-aligned artifacts across ten CWE classes in Java and C, producing a 0.7% aggregate poisoning ratio in a 12,053-entry benign corpus.The CWE classes are primarily drawn from the MITRE CWE Top 25.Source: §I · p. 2

Attack Effectiveness

  • All 85 poisoned artifacts appeared in the Top-3 for corresponding queries, while undefended CodePoisonRAG achieved ASRs of 0.80–0.93 across three generators.The attack used one poisoned artifact per target query and an aggregate corpus-poisoning ratio of 0.7%.Source: §I · p. 2

Defense Robustness

  • Against CodeGuarder, CodePoisonRAG retained ASRs of 0.40–0.71 across three generators, with a best defended ASR of 0.71 on Code Llama.Security-oriented knowledge injection reduced attack success but did not eliminate the influence of poisoned artifacts.Source: §I · p. 2

II. BACKGROUND · A. Retrieval-Augmented Code Generation (RACG) · B. CWE and CVE

RACG supplements code generation with retrieved external artifacts that shape the output, making their relevance and trustworthiness consequential. CWE names a weakness class, whereas CVE identifies a specific disclosed vulnerability.

A. Retrieval-Augmented Code Generation (RACG)

B. CWE and CVE

  • CWE standardizes categories of recurring weaknesses, while a CVE identifier denotes a specific publicly disclosed vulnerability in a product or codebase.For example, SQL injection is CWE-89; CWE entries can describe consequences, examples, and mitigations.Source: B. CWE and CVE · p. 3

C. Taint Chain … B. Attack Formulation

CodePoisonRAG constructs a task-matched artifact carrying an attacker-selected weakness, designed to survive retrieval and influence generated code. Its formulation requires both retrieval of that artifact and generation of code containing the selected weakness, under a black-box, one-artifact-per-task threat model.

C. Taint Chain

  • A taint chain traces untrusted data from a source through risk-preserving passthrough operations to a security-sensitive sink where the weakness can occur.Examples include request parameters, trimming or concatenation, and command execution or SQL construction.Source: C. Taint Chain · p. 3

III. CODEPOISONRAG

  • CodePoisonRAG constructs a task-aligned artifact with a selected vulnerable flow and false safety claims, rather than relying on retrieval of already-vulnerable code.The attack chain introduces the weakness and semantically mislabels the artifact as safe or security-conscious.Source: §III · p. 3

A. Threat Model

  • The attacker anticipates benign tasks, selects a CWE for each, and may inject at most one artifact per task while seeking a small poisoning footprint and defense-resistant success.Source: A. Threat Model · p. 4
  • The attacker is black-box: it cannot access or query victim components, but can use public task, CWE, and source-to-sink knowledge, crafting valid code with vulnerable logic and comment-level deception.Source: A. Threat Model · p. 4
  • As an upstream publisher, the attacker relies on later source ingestion and benign-query retrieval; the victim does not modify its model or pipeline and is assumed to use retrieved artifacts without exhaustive inspection, [13],,,,,.Source: A. Threat Model · p. 4

B. Attack Formulation

  • For each anticipated task ti and selected CWE wi, the attacker constructs one syntactically valid artifact pi that remains task-aligned and realizes wi.The one-artifact budget prevents relying on multiple poison variants for the same task.Source: B. Attack Formulation · p. 4
  • The anticipated functionality ti is distinct from the victim’s concrete query qi, which need only express that functionality.Source: B. Attack Formulation · p. 4
  • End-to-end success requires both inclusion of the poisoned artifact in the final retrieved context and the selected weakness in the generated output.Source: B. Attack Formulation · p. 4

C. Attack WorkFlow · 1) Upstream Poison Preparation:

CodePoisonRAG separates attacker-side preparation before knowledge-base ingestion from victim-side activation, in which a benign query can expose a task-aligned poisoned artifact to the generator.

C. Attack WorkFlow

1) Upstream Poison Preparation:

  • For preparation, the attacker selects an anticipated task, a matching benign fixed-code artifact, and a target CWE that can fit naturally, such as path traversal in file access.The passage also gives improper input validation in input processing as an example.Source: 1) Upstream Poison Preparation · p. 4

C. Attack WorkFlow

  • After ingestion, a benign query triggers retrieval and re-ranking; the attack succeeds if the poisoned artifact reaches generator context and the resulting code contains the selected weakness.Source: Figure 1 · p. 5

1) Upstream Poison Preparation:

2) Poison Activation: … 2) Vulnerability Injection:

CodePoisonRAG constructs task-aligned poisoned artifacts by selecting a compatible weakness, injecting a vulnerable source-to-sink flow, and adding misleading safety claims. A poison affects generation only if it survives retrieval and re-ranking and reaches the generator’s prompt.

2) Poison Activation:

  • A poison becomes active only after incorporation into the victim’s knowledge base and survives retrieval and any re-ranking to appear in the generator’s prompt.The attack succeeds when the generated output contains the attacker-selected weakness.Source: 2) Poison Activation · p. 5

D. Poison Construction

  • CodePoisonRAG builds each poison by injecting a selected CWE into a task-aligned benign artifact, then adding false safety claims while leaving the vulnerable flow intact.The resulting artifact is intended to remain task-aligned, syntactically valid, and vulnerable while appearing safe or security-conscious.Source: D. Poison Construction · p. 5

1) Benign Artifact and CWE Selection:

  • For each task, CodePoisonRAG starts with a benign artifact and selects a weakness realizable in its existing data and control flow without changing the programming task.Task context constrains the pairing: database-query tasks may admit SQL injection, while memory-allocation tasks may admit out-of-bounds access or improper memory management.Source: 1) Benign Artifact and CWE Selection · pp. 5–6

2) Vulnerability Injection:

  • Vulnerability Injection creates a CWE-specific taint chain from untrusted source through passthrough operations to a security-sensitive sink lacking sufficient validation or sanitization.Examples include unchecked paths for path traversal (CWE-22), string-concatenated SQL queries for SQL injection (CWE-89), and user-controlled data copied into fixed-size buffers for buffer overflow (CWE-120).Source: 2) Vulnerability Injection · p. 6
  • The injection preserves the task while reconnecting the vulnerable flow: replacing a path security check with trim() leaves a filename able to reach the file-read sink unchecked.For a C logging snippet, replacing size-aware snprintf with sprintf allows user-controlled input to overflow the fixed-size buffer.Source: 2) Vulnerability Injection · p. 6
  • Semantic Mislabeling changes only comments or documentation, leaving the taint chain intact while adding security vocabulary that can aid retrieval and mislead generation into treating the artifact as safe.Vulnerability injection can also be automated with LLMs to create synthetic vulnerable samples, as demonstrated for C snippets.Source: 2) Vulnerability Injection · p. 6

3) Semantic Mislabeling: … B. Dataset

Semantic Mislabeling makes poisoned code appear safe through false comments while leaving its vulnerable behavior unchanged. The evaluation targets ten CWE classes and uses 85 poisoned snippets mixed with a 12,053-entry benign retrieval pool.

3) Semantic Mislabeling:

  • False safety comments claim CWE-specific vulnerabilities are already handled, while the code and taint chain remain unchanged to encourage reproduction with reduced scrutiny.The statement is selected to match the embedded weakness and changes only comment-level context.Source: 3) Semantic Mislabeling · p. 7
  • For CWE-79, the snippet sends user-controlled displayName to an HTML response without escaping, despite a comment claiming output is properly escaped.Only the documentation changes; the vulnerable sink still receives unescaped input.Source: 3) Semantic Mislabeling · p. 7

A. Targeted Vulnerabilities

  • The evaluation targets ten CWE classes across Java and C, covering injection, input validation, path traversal, deserialization, server-side request forgery, and memory-safety vulnerabilities.Source: A. Targeted Vulnerabilities · p. 7
  • The selected weaknesses are primarily drawn from the MITRE CWE Top 25 [18], with additional classes for memory safety and deserialization.Table I summarizes the targeted weaknesses.Source: A. Targeted Vulnerabilities · p. 7

B. Dataset

  • 85 poisoned snippets (65 Java, 20 C) added to 12,053 fixed-code entries yield a 0.7% poisoning ratio (85/(12,053 + 85)).The benign retrieval pool follows the CodeGuarder setting and draws its fixed-code entries from ReposVul.Source: B. Dataset · pp. 7–8
  • Java snippets are manually crafted with CWE-specific sources, passthroughs, and sinks, while LLM-assisted C snippets are checked for coherence; the dataset is mixed with benign fixes and may be publicly released.Source: B. Dataset · p. 7, 3) Semantic Mislabeling · p. 7
  • Each poisoned snippet retains its vulnerable function, taint chain, target CWE, and a trigger query describing intended benign functionality.Source: B. Dataset · p. 8
  • For the no-poison ablation, each poisoned snippet has a benign counterpart from ReposVul, preserving language and CWE distribution while aligning retrieval task and functionality.This comparison isolates poisoning effects by adding the corresponding benign snippets instead of poisoned ones.Source: B. Dataset · p. 8

C. Experimental Setup · D. Evaluation Metrics and Output Validation

The setup evaluates CodePoisonRAG with three locally served generators and a dense-retrieval pipeline. Evaluation distinguishes retrieval, end-to-end attack success, and target-weakness frequency, with CWE-specific output validation and code similarity as a complementary measure.

C. Experimental Setup

  • The generators are Qwen 3.5 9B, Code Llama 13B [35], and DeepSeek-Coder-V2 16B [36], served locally through Ollama.They use greedy decoding, an 8,192-token response limit, and disabled reasoning modes; experiments run sequentially on one RTX 4080 Laptop GPU.Source: C. Experimental Setup · p. 8
  • Queries and knowledge-base entries are encoded with jina-embeddings-v3 [39] and searched by exact cosine similarity before cross-encoder re-ranking.The setup indexes full 1,024-dimensional embeddings in FAISS [40], then re-scores query–candidate pairs with jina-reranker-v2-base-multilingual.Source: C. Experimental Setup · p. 8

D. Evaluation Metrics and Output Validation

  • RSR measures the fraction of benign trigger queries whose corresponding poisoned artifact appears in the final context after retrieval and re-ranking.The retrieval pipeline uses jina-embeddings-v3 [39], FAISS [40], and jina-reranker-v2-base-multilingual.Source: D. Evaluation Metrics and Output… · p. 8, C. Experimental Setup · p. 8
  • ASR requires both retrieval of the corresponding poisoned artifact and a CWE-specific judgment that the generated response contains the target weakness.Retrieval alone is insufficient because the generator may ignore, repair, or avoid the retrieved artifact.Source: D. Evaluation Metrics and Output… · p. 8
  • TWR measures target-weakness frequency regardless of poison retrieval, so it cannot by itself establish attack success or attribute a vulnerable output to poisoning.It is used to compare the complete attack with ablations such as no-poison, where retrieval success is undefined.Source: D. Evaluation Metrics and Output… · pp. 8–9
  • GLM-5.1 [38] independently checks task alignment and whether the primary code block contains the target CWE’s vulnerable source-to-sink flow without required protection.Wrong-language or incomplete responses, and outputs whose relevant data does not reach the vulnerable sink, are unsuccessful.Source: D. Evaluation Metrics and Output… · p. 9
  • CodeBLEU [42] compares each generated output with both the poisoned artifact and its benign source, but does not determine attack success.Similarity to the poison characterizes movement toward the injected implementation, while similarity to the benign reference reflects retained clean implementation.Source: D. Evaluation Metrics and Output… · p. 9

E. Attack Effectiveness across Ten Java and C CWEs

Across ten Java and C CWEs, CodePoisonRAG uses a 0.700% corpus-poisoning ratio, retrieves all 85 artifacts in the Top-3, and achieves 79/85 overall attack success.

E. Attack Effectiveness across Ten Java and C CWEs

  • With one poisoned snippet per target query and a 0.700% overall poison ratio, all 85 snippets appear in the Top-3 for their corresponding queries.Most CWE classes require 0.082% of the knowledge base; the smaller five-entry classes require 0.041%.Source: E. Attack Effectiveness across Ten… · p. 9
  • Single-snippet poisoning yields 85/85 retrieval success without multiple samples per query, unlike prior RAG poisoning attacks that inject multiple samples,.Small taint-chain modifications and comment-level deception make snippets appear relevant to benign requests while preserving the weakness.Source: E. Attack Effectiveness across Ten… · p. 9
  • 79/85 (0.93) overall attack success shows that most retrieved poisoned snippets influence the LLM to generate vulnerable code.All C classes achieve perfect attack success, while most Java classes also reach 1.00.Source: E. Attack Effectiveness across Ten… · pp. 9–10
  • Java SQL injection (CWE-89) reaches 9/10 successes, while deserialization (CWE-502) is the main outlier at 5/10.The passage suggests safe PreparedStatement construction and typed or safer deserialization alternatives may explain the lower success; all C classes achieve perfect attack success.Source: E. Attack Effectiveness across Ten… · p. 10

F. Attack Effectiveness under Defense Scenarios … I. Paraphrasing Defense

CodePoisonRAG remains effective under CodeGuarder, outperforms a prior RACG poisoning approach in a shared-CWE comparison, transfers across generators, and retains high attack success after query paraphrasing.

F. Attack Effectiveness under Defense Scenarios

  • Under CodeGuarder, CodePoisonRAG achieves 0.71 overall success, with 60/85 responses validated as vulnerable; 84/85 poisoned artifacts remain in the final Top-3 context.CWE-79 reaches 0.90 success; CWE-20, CWE-22, and CWE-94 each reach 0.80, while CWE-119 and CWE-120 each achieve 4/5. CWE-78, CWE-89, and CWE-502 have comparatively lower success.Source: F. Attack Effectiveness under Defense… · p. 10

G. Benchmark Comparison

  • CodePoisonRAG’s shared-CWE benchmark comparison requires only one poisoned snippet per target query, unlike B. Lin et al., whose approach often requires multiple samples and uses existing vulnerable CVE code.The passage reports B. Lin et al. average ASR of 0.48 over targeted CWEs; CodePoisonRAG constructs snippets from benign fixed-code entries while preserving functional plausibility and uses a substantially lower poisoning ratio.Source: G. Benchmark Comparison · p. 10
  • 0.97 average ASR across four common CWEs for CodePoisonRAG exceeds 0.67 for B. Lin et al. using Code Llama 13B [35].CodePoisonRAG reaches perfect ASR on CWE-22, CWE-78, and CWE-79, and misses one query for CWE-89.Source: G. Benchmark Comparison · p. 10, Table IV · p. 11

H. Comparison across LLM Generators

  • Without defense, CodePoisonRAG succeeds on 68/85 Qwen 3.5 9B, 79/85 Code Llama 13B, and 68/85 DeepSeek-Coder-V2 16B cases; with defense, successes are 34/85, 60/85, and 51/85, respectively.Non-defense overall ASR is 0.93 for Code Llama and 0.8 for both Qwen and DeepSeek; under defense, Code Llama retains ASR 0.71 and Qwen ASR 0.40.Source: H. Comparison across LLM Generators · p. 10, Table III · p. 11
  • Across generators without defense, CWE-78, CWE-94, and CWE-918 reach near-perfect or perfect success, while CWE-502 reaches only 5/10 under Semantic Mislabeling.Qwen is less affected by path traversal and cross-site scripting than Code Llama and DeepSeek; DeepSeek is less affected by some C memory-safety patterns, including CWE-20 and CWE-120.Source: H. Comparison across LLM Generators · p. 10

I. Paraphrasing Defense

  • 78/85 attacks succeed on Code Llama 13B under paraphrased queries (ASR =0.918), compared with 79/85 (ASR =0.93) for original queries.All 85 poisoned artifacts remain in the final Top-3 context after paraphrasing, although average query–artifact similarity decreases from 0.7722 to 0.7237.Source: §I · p. 11

J. Efficiency: The Cost of Generation … M. Generation Faithfulness to Poisoned Artifacts

The analyses show that poisoned retrieval can drive vulnerable generation, including on some unanticipated queries, while adding little generation overhead. Defense reduces similarity to poisoned artifacts and accounts for most of the added generation cost.

J. Efficiency: The Cost of Generation

  • 1,238 tokens and 5.2 seconds were the average non-defense generation cost, close to ordinary generation cost.Poisoned artifacts are inserted as ordinary context, without additional model calls or runtime interaction, keeping the attack-active pipeline close to normal RACG execution.Source: J. Efficiency: The Cost of Generation · p. 11, Table VI · p. 11
  • 2,236 tokens and 9.2 seconds were the average generation cost under defense, with the added cost attributed primarily to defenses injecting security knowledge into prompts.The defenses often cause the generator to produce longer responses.Source: J. Efficiency: The Cost of Generation · p. 11, Table VI · p. 11

K. Impact on Non-Target Queries

  • 6/50 non-target queries resulted in successful attacks; poisoned artifacts entered the Top-3 context for 8/50 queries, and 6/8 retrieved cases succeeded.The 50 CyberSecEval tasks were not aligned with the knowledge-base artifacts; sufficient functional overlap could still bring a poisoned artifact into context.Source: K. Impact on Non-Target Queries · pp. 11–12

L. Ablation Study

  • 77/85 cases remained successful without comment-level deception, compared with 25/85 vulnerable outputs when poisoning was removed, identifying vulnerability injection as the attack’s primary driver.Several CWE classes remained fully successful without comment-level deception, while the no-poison results also show that vulnerable outputs can arise from benign retrieved context alone.Source: L. Ablation Study · p. 12, Table VII · p. 12

M. Generation Faithfulness to Poisoned Artifacts

N. Comparison across LLM Validators · V. RELATED WORK · VI. CONCLUSION

The paper contrasts validator sensitivity with the broader RACG literature and concludes that CodePoisonRAG can construct targeted poisoned artifacts from benign code while remaining effective under defense. The related-work section distinguishes this attack from prior retrieval manipulation, existing-vulnerability poisoning, and secure-generation methods.

N. Comparison across LLM Validators

  • ASR was 1.00 without defense and 0.612 under defense for DeepSeek-Coder-V2 16B, versus GLM-5.1’s 0.80 and 0.40, respectively.Both validators assessed the same Qwen-generated responses with retrieval outcomes held fixed; only the CWE judgment changed.Source: N. Comparison across LLM Validators · p. 12, Table IX · p. 13
  • GLM-5.1 remains the primary validator for more conservative, precise CWE verdicts, while both validators preserve the trend that CodePoisonRAG remains effective across judges.DeepSeek-Coder-V2 16B reports higher vulnerability rates, motivating the choice of the larger GLM-5.1 judge.Source: N. Comparison across LLM Validators · pp. 12–13

V. RELATED WORK

  • Prior text-RAG and multimodal work shows that poisoned documents, retrieval rankings, and query alignment can steer systems toward malicious content,, [46],, [48].The section also cites a RAG survey identifying dependence on external data as an attack surface [44].Source: §V · p. 13
  • Prior RACG attacks manipulate retrieval or inject existing CVE-derived samples, while code syntax and naming can make poisoning stealthier,, [50].The section also cites a RACG survey [49] and work on insecure-code propagation through poisoned NMT models.Source: §V · p. 13
  • Secure-generation approaches include CodeGuarder, Rescue [13], SafeCoder, SVEN, CoSec, SOSecure [55], and prompting strategies.CodeGuarder is used in the defense evaluation and is described as stronger than prior approaches,, [55],.Source: §V · p. 13
  • The related-work section distinguishes CodePoisonRAG from text-generation poisoning, retrieval manipulation, dependency-level attacks, and poisoning with existing vulnerable samples.It concludes that CodePoisonRAG shows robust ASR against the most effective defense approach.Source: §V · p. 13

VI. CONCLUSION

  • CodePoisonRAG uses vulnerability injection and Semantic Mislabeling to turn benign fixed-code artifacts into targeted weaknesses across ten Java and C CWE classes.The conclusion reports that one poisoned artifact per target query and an overall poison ratio below 0.7% suffice to induce vulnerable generation, including under defense.Source: §VI · p. 13

APPENDIX · A. Per-CWE Vulnerability Patterns

The appendix supplements CodePoisonRAG with per-CWE vulnerability patterns and an LLM-validator prompt template. The patterns define evaluation criteria that are hidden from the generator and applied alongside general verdict rules.

APPENDIX

  • The appendix adds information about per-CWE patterns and the Validator prompt template.Source: APPENDIX · p. 15

A. Per-CWE Vulnerability Patterns

Related papers

Loading 2609.02774v1…