Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces CodePoisonRAG, a targeted knowledge-poisoning framework that transforms benign code artifacts into poisoned entries to exploit vulnerabilities in Retrieval-Augmented Code Generation (RACG) systems. By employing CWE-specific Vulnerability Injection and Semantic Mislabeling, the framework enables attackers to influence generated code without direct access to the victim's system, achieving high attack success rates across multiple generators. The findings reveal that even a small number of poisoned artifacts can significantly impact the quality and safety of generated code, highlighting a critical security risk in RACG systems.
CodePoisonRAG shows that a single malicious artifact can effectively propagate vulnerabilities in code generation systems, achieving up to 93% attack success rates.
Retrieval-Augmented Code Generation (RACG) improves LLM-based software development by retrieving external code artifacts, documentation, and patches, and incorporating them into the generation context. This reliance on external knowledge introduces a critical trust boundary: poisoned artifacts can influence generated code without modifying the underlying LLM. Prior work shows that selecting existing vulnerable examples can increase the general vulnerability rate of RACG outputs, but leaves open whether a black-box attacker can construct a single task-matched artifact that propagates an attacker-selected weakness. We introduce CodePoisonRAG, a targeted upstream knowledge-poisoning framework that transforms benign fixed-code entries into poisoned artifacts. Its attack chain combines CWE-specific Vulnerability Injection, which embeds a selected source-to-sink flow while retaining task alignment, with Semantic Mislabeling, which adds false safety claims without repairing the vulnerable behavior. The attacker has no access to the victim's deployed knowledge base, retriever, re-ranker, generator, prompt, or defense mechanism and injects at most one artifact per anticipated programming task. We construct 85 poisoned artifacts covering ten CWE classes across Java and C, yielding an aggregate corpus-poisoning ratio of 0.7%. Across three generators, all 85 artifacts appear among the Top-3 results for their corresponding queries, and CodePoisonRAG achieves attack success rates between 0.80 and 0.93. Against CodeGuarder, which injects vulnerability-specific security knowledge into the generation context, the attack retains success rates between 0.40 and 0.71. These results show that RACG poisoning extends beyond the incidental propagation of existing vulnerabilities to the targeted construction and propagation of attacker-selected weaknesses.