CodePoisonRAG: Knowledge Poisoning Attacks on Retrieval-Augmented Code Generation
A single planted code artifact was enough to steer retrieval-augmented generators toward specific vulnerabilities.
The paper describes CodePoisonRAG, a black-box poisoning method that turns benign fixed-code entries into task-matched vulnerable artifacts with false safety claims. In tests, 85 poisoned artifacts across ten CWE classes in Java and C all landed in the Top-3 retrieval results for their target queries. Across three generators, the reported attack success rate was 0.80 to 0.93. A defense called CodeGuarder reduced but did not stop the attack, with success rates still at 0.40 to 0.71. ArXiv · AI/CL/LG's note
The paper describes CodePoisonRAG, a black-box poisoning method that turns benign fixed-code entries into task-matched vulnerable artifacts with false safety claims. In tests, 85 poisoned artifacts across ten CWE classes in Java and C all landed in the Top-3 retrieval results for their target queries. Across three generators, the reported attack success rate was 0.80 to 0.93. A defense called CodeGuarder reduced but did not stop the attack, with success rates still at 0.40 to 0.71. ArXiv · AI/CL/LG's note
score 5