PaperlayerView exact revision on arXiv

Source-linked AI summary

CodePoisonRAG: Knowledge Poisoning Attacks on Retrieval-Augmented Code Generation

Varun Gadey, Ziad Marey, Alexandra Dmitrienko

arXiv:2609.02774v1cs.CRcs.LG

TL;DR

RACG's dependence on external knowledge leaves generated code exposed to poisoned artifacts, while prior work did not show whether a black-box attacker could construct a single task-matched artifact carrying a chosen weakness. CodePoisonRAG addresses this gap by injecting CWE-specific vulnerable flows and deceptive safety claims into benign artifacts, achieving high attack success across generators and retaining substantial success under CodeGuarder.

  • Problem

    Prior work showed that selecting existing vulnerable examples can increase RACG vulnerability rates but left open whether a black-box attacker could construct a single task-matched artifact propagating an attacker-selected weakness.

  • Method

    CodePoisonRAG transforms benign fixed-code entries through CWE-specific Vulnerability Injection and Semantic Mislabeling while using at most one artifact per anticipated task without access to the victim RACG pipeline.

  • Results

    Across three generators, all 85 poisoned artifacts reached the Top-3 for corresponding queries, with attack success rates of 0.80 to 0.93 undefended and 0.40 to 0.71 against CodeGuarder.

  • Takeaways & Limitations

    RACG poisoning can deliberately propagate attacker-selected weaknesses rather than merely reproduce vulnerabilities already present in a corpus.

Abstract

from arXiv · show

Retrieval-Augmented Code Generation (RACG) improves LLM-based software development by retrieving external code artifacts, documentation, and patches, and incorporating them into the generation context. This reliance on external knowledge introduces a critical trust boundary: poisoned artifacts can influence generated code without modifying the underlying LLM. Prior work shows that selecting existing vulnerable examples can increase the general vulnerability rate of RACG outputs, but leaves open whether a black-box attacker can construct a single task-matched artifact that propagates an attacker-selected weakness. We introduce CodePoisonRAG, a targeted upstream knowledge-poisoning framework that transforms benign fixed-code entries into poisoned artifacts. Its attack chain combines CWE-specific Vulnerability Injection, which embeds a selected source-to-sink flow while retaining task alignment, with Semantic Mislabeling, which adds false safety claims without repairing the vulnerable behavior. The attacker has no access to the victim's deployed knowledge base, retriever, re-ranker, generator, prompt, or defense mechanism and injects at most one artifact per anticipated programming task. We construct 85 poisoned artifacts covering ten CWE classes across Java and C, yielding an aggregate corpus-poisoning ratio of 0.7%. Across three generators, all 85 artifacts appear among the Top-3 results for their corresponding queries, and CodePoisonRAG achieves attack success rates between 0.80 and 0.93. Against CodeGuarder, which injects vulnerability-specific security knowledge into the generation context, the attack retains success rates between 0.40 and 0.71. These results show that RACG poisoning extends beyond the incidental propagation of existing vulnerabilities to the targeted construction and propagation of attacker-selected weaknesses.

I. INTRODUCTION

RACG improves code generation with retrieved knowledge but creates a trust boundary that enables targeted poisoning. CodePoisonRAG constructs task-aligned artifacts carrying attacker-selected weaknesses and demonstrates high success rates even against security-oriented retrieval defenses.

  • RACG supplements LLM code generation with retrieved code, documentation, patches, and security knowledge, but compromised artifacts can influence outputs without changing the underlying model.
  • Prior work showed that existing vulnerable examples can increase generated-code vulnerability rates, but did not establish construction of task-matched artifacts carrying attacker-selected weaknesses.
  • CodePoisonRAG transforms benign fixed-code entries by injecting a selected CWE into their source-to-sink flow while preserving task alignment, then adds false safety claims without repairing the vulnerability.
  • 85 poisoned artifacts span ten CWE classes in Java and C, producing an aggregate corpus-poisoning ratio of 0.7%.
  • All 85 artifacts reached the Top-3 for corresponding queries, while attack success rates ranged from 0.80 to 0.93 across three generators using one artifact per query.
  • Against CodeGuarder, attack success rates remained 0.40 to 0.71, showing that security knowledge injection reduced but did not eliminate poisoned-artifact influence.

II. BACKGROUND

RACG retrieves relevant software artifacts and supplies them to an LLM for code generation. This retrieval improves task-relevant context but also makes generated code dependent on the integrity and security of retrieved artifacts.

  • RACG combines an external code-knowledge base, a dense retriever, an optional re-ranker, and an LLM generator.
  • The retriever returns a Top-K candidate set Rq from code-related entries, and the re-ranker selects final Top-k artifacts Eq for the generation prompt.
  • The LLM generates output code y from the user query q together with the retrieved context Eq.
  • Retrieved artifacts provide task-relevant context that guides the model toward satisfying the user query.
  • Because y is conditioned on Eq, irrelevant, conflicting, or insecure artifacts can mislead the LLM and propagate flawed implementation patterns.
  • CWE classifies recurring weakness types, whereas CVE identifies a specific publicly disclosed vulnerability affecting a particular product or codebase.

C. Taint Chain

CodePoisonRAG models targeted poisoning as constructing one task-aligned artifact containing a selected weakness, then requiring retrieval and generation to propagate it.

  • Taint Chain: A taint chain tracks untrusted data from a source through optional passthroughs to a security-sensitive sink.Sources include request parameters and user-controlled strings; passthroughs transform data without removing the relevant risk.
  • Attack Formulation: The attacker constructs one syntactically valid artifact aligned with anticipated task t_i while realizing selected weakness w_i.The formulation permits at most one poisoned artifact per anticipated task and separates anticipated functionality from the query wording.
  • Attack Formulation: The victim knowledge base combines clean artifacts C with poisoned artifacts P after incorporating the affected upstream source.The deployed knowledge base is formed after the victim incorporates the poisoned upstream data.
  • Attack Formulation: End-to-end success requires the poisoned artifact to enter the final retrieved context and the generated output to contain the selected weakness.Retrieval includes retrieval and, when present, re-ranking; both conditions are required.

C. Attack WorkFlow

The workflow separates attacker-controlled upstream preparation from victim-controlled downstream activation, linking task-aligned poison construction to retrieval for a benign query.

  • C. Attack WorkFlow: CodePoisonRAG has upstream poison preparation and downstream poison activation phases.Preparation occurs before the source enters the victim knowledge base; activation occurs when a benign query retrieves the artifact.
  • Upstream Poison Preparation: The attacker selects an anticipated task, a compatible CWE, and a benign fixed-code artifact before transforming it into poison.The weakness is chosen so its vulnerable behavior can be naturally embedded in the task.
  • Upstream Poison Preparation: Vulnerability Injection changes the source-to-sink flow, while Semantic Mislabeling adds false security claims without repairing that flow.The resulting artifact is formatted consistently with the surrounding corpus and published upstream.
  • Poison Activation: During activation, retrieval and optional re-ranking determine whether the poison enters the generator prompt for the benign task query.The attack succeeds when the corresponding poison survives these stages and reaches generation.

D. Poison Construction

Poison construction preserves task alignment while embedding a CWE-specific vulnerable flow and adding misleading safety documentation.

  • Benign Artifact and CWE Selection: Construction begins with a benign artifact for the anticipated task and a CWE compatible with its existing data and control flow.The artifact’s code, comments, identifiers, and API usage provide task-aligned signals for poison construction.
  • Vulnerability Injection: Vulnerability Injection embeds the selected weakness as an explicit source-to-sink path while preserving the snippet’s intended functionality.The concrete source, passthrough, and sink pattern depends on the target CWE.
  • Vulnerability Injection: For path traversal, replacing securityCheck with filename.trim() preserves the file-download task but leaves the path vulnerable.trim() does not confine the path or prevent values from escaping the intended log directory.
  • Vulnerability Injection: For buffer overflow, replacing snprintf with sprintf preserves the logging task but removes destination-buffer size enforcement.User-controlled input can consequently overflow the fixed-size buffer.
  • Semantic Mislabeling: Semantic Mislabeling adds CWE-specific false safety claims to comments or documentation while leaving the vulnerable taint chain unchanged.The added security vocabulary can improve retrieval alignment and mislead generation toward treating the artifact as safe guidance.
  • Poison Dataset: The poisoned snippets are collected into a dataset mixed with benign vulnerability-fix artifacts and published through public channels.Such sources may later be adopted as external RACG knowledge.

IV. EVALUATION

The evaluation targets ten CWE classes across Java and C using poisoned and benign data components, with the targeted weaknesses summarized in Table I.

  • Targeted Vulnerabilities: Ten CWE classes across Java and C are targeted, covering injection, input validation, path traversal, deserialization, SSRF, and memory-safety vulnerabilities.The selected classes are primarily drawn from the MITRE CWE Top 25, with additional memory-safety and deserialization classes.
  • Evaluation Data: The evaluation uses a benign retrieval pool, a poisoned snippet corpus, and benign counterpart data.The clean pool contains 12,053 fixed-code entries from ReposVul and serves as the no-poison knowledge base.
  • Evaluation Data: 0.7% is the overall poison ratio when 85 poisoned snippets are injected into the 12,053-entry benign retrieval pool.Each poisoned snippet retains its vulnerable function, taint chain, target CWE, and trigger query.

C. Experimental Setup

The evaluation uses three open-weight LLMs and measures retrieval, end-to-end attack success, target weakness occurrence, validation, and similarity to poisoned or benign code.

  • Models: Three open-weight models—Qwen 3.5 9B, Code Llama 13B, and DeepSeek-Coder-V2 16B—cover general-purpose and code-specialized generation.All models are served locally through Ollama.
  • Metrics: Retrieval Success Rate measures whether the corresponding poisoned artifact reaches the final context after retrieval and re-ranking.It is computed over benign trigger queries.
  • Metrics: Attack Success Rate requires both poisoned-artifact retrieval and generation containing the attacker-selected CWE weakness.Retrieval alone is insufficient because the generator may ignore, repair, or avoid the artifact.
  • Metrics: Target Weakness Rate counts generated responses containing the target CWE regardless of whether the poisoned artifact was retrieved.It supports comparisons with no-poison ablations, where retrieval success is undefined.
  • Validation: An independent GLM-5.1 security judge checks task alignment and CWE-specific vulnerable source-to-sink flows, while CodeBLEU compares outputs with poisoned and benign references.CodeBLEU is complementary and does not determine attack success.

E. Attack Effectiveness across Ten Java and C CWEs

Across ten Java and C CWE classes, CodePoisonRAG achieves near-complete retrieval and high end-to-end attack success using a single poisoned snippet per target query.

  • Retrieval: 85/85 poisoned snippets appear within the Top-3 retrieved results, despite an overall knowledge-base poisoning ratio of 0.700%.Per-CWE poisoning footprints range from 0.041% to 0.082%.
  • End-to-end effectiveness: 79/85 queries achieve end-to-end attack success, corresponding to an overall ASR of 0.93.Successful snippets both enter the prompt context and influence vulnerable code generation.
  • CWE-level results: All C classes achieve perfect attack success, while most Java classes also reach a 1.00 success rate.CWE-89 reaches 9/10 successes, whereas CWE-502 reaches 5/10.
  • CWE-level results: CWE-502 is the main outlier, with 5/10 successes, while SQL injection reaches 9/10 successes.The passage attributes these differences to stronger safe-generation tendencies for deserialization and prepared statements.

F. Attack Effectiveness under Defense Scenarios

CodePoisonRAG remains effective when CodeGuarder injects security knowledge: defense slightly reduces retrieval and lowers attack success, but does not eliminate poisoned-artifact influence.

  • Defense retrieval: 84/85 poisoned artifacts remain in the final Top-3 context under CodeGuarder, with retrieval failing only for CWE-79.The defense rarely prevents poisoned artifacts from entering generation context.
  • Defense effectiveness: 60/85 responses remain validated as vulnerable under defense, yielding an overall ASR of 0.71.CWE-79 reaches 0.90, while CWE-20, CWE-22, and CWE-94 each reach 0.80.
  • Prior-work comparison: On four overlapping CWEs, CodePoisonRAG reaches macro-average ASR 0.97 versus 0.67 for B. Lin et al. using Code Llama 13B.CodePoisonRAG reaches perfect ASR on CWE-22, CWE-78, and CWE-79.
  • Generator comparison: Across generators without defense, ASR is 68/85 for Qwen 3.5 9B, 79/85 for Code Llama 13B, and 68/85 for DeepSeek-Coder-V2 16B.The corresponding overall ASRs are 0.8, 0.93, and 0.8.
  • Generator comparison: Under defense, success falls to 34/85 for Qwen, 60/85 for Code Llama, and 51/85 for DeepSeek-Coder-V2.The passage reports that the reduction is uneven across models.
  • Query robustness: Paraphrased queries preserve 85/85 Top-3 retrieval and produce ASR 0.918 versus 0.93 for original queries.The reported difference is marginal.

J. Efficiency: The Cost of Generation

CodePoisonRAG adds little observable victim-side generation overhead, while defense prompts increase token use and latency; non-target effects and ablations clarify the attack’s influence.

  • Generation cost: 1,238 tokens and 5.2 seconds are required on average in the non-defense setting, close to ordinary generation cost.The poisoned context does not noticeably increase runtime or output size.
  • Generation cost: Defense increases average generation to 2,236 tokens and 9.2 seconds, with the additional cost attributed primarily to injected security knowledge.The defense often causes longer responses.
  • Non-target queries: Poisoned artifacts appear in the final Top-3 context for 8/50 non-target queries, with 6/8 producing successful attacks.These tasks come from CyberSecEval and are not aligned with the poisoned or benign artifacts.
  • Faithfulness: Non-defense CodeBLEU similarity to poisoned snippets ranges from 0.589 to 0.623, while Qwen’s similarity to benign snippets is 0.169.The corresponding Qwen similarity to poisoned snippets is 0.594.
  • Faithfulness: Defense lowers CodeBLEU similarity for all generators, but scores remain around 0.50, indicating substantial preservation of poisoned-artifact content.This accompanies continued non-trivial ASR under defense.

N. Comparison across LLM Validators

The evaluation compares LLM validators while holding retrieval outcomes fixed, and uses GLM-5.1 as the primary judge for CWE-specific security assessment. CodePoisonRAG remains effective across validators and motivates stronger integrity and security checks for retrieved knowledge.

  • Validator Comparison: GLM-5.1 is the primary validator because the evaluation prioritizes a stronger judge for precise, conservative CWE-specific verdicts.DeepSeek-Coder is additionally used to test validator sensitivity on the same generated responses.
  • Validator Comparison: Retrieval outcomes remain fixed across validators, so the comparison changes only the CWE judgment applied to generated responses.
  • Validator Comparison: Both validators largely preserve the same trend, confirming that CodePoisonRAG remains effective across judges.
  • Related Work and Implications: Existing RACG attacks focus on retrieval manipulation, dependency-level attacks, or poisoning with existing CVE-derived vulnerable samples.
  • Related Work and Implications: CodePoisonRAG constructs poisoned snippets from benign fixed-code artifacts through vulnerability injection and Semantic Mislabeling across ten Java and C CWE classes.
  • Related Work and Implications: The findings support RACG defenses that verify the integrity and security of retrieved knowledge before code generation.

APPENDIX

The appendix documents the per-CWE patterns and validator prompt template used to assess whether generated code realizes a target weakness. These criteria guide evaluation without being shown to the generator.

  • Appendix Scope: The appendix provides additional information on per-CWE patterns and the CodePoisonRAG validator prompt template.
  • Validation Criteria: Per-CWE vulnerable patterns are applied only by the LLM validator during evaluation and are not shown to the generator.
  • Validation Criteria: General verdict rules from Figure 5 are applied together with the per-CWE criteria.
  • Validation Criteria: The validator checks whether the primary code block realizes the target CWE by tracing data from function entry to final use.
Loading 2609.02774v1…