CodePoisonRAG: Knowledge Poisoning Attacks on Retrieval-Augmented Code Generation

arXiv:2609.02774 · cs.CR, cs.LG · Submitted 2026-09-02 · Read on arXiv

cs.CR, cs.LG

Submitted: 2026-09-02

Updated: 2026-09-02

Comments: 16 pages, 1 figure. Under review

Project page: https://cwe.mitre.org/data/definitions/79.html

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• RAG — 18× in this paper · explained in 3 episodes
• Retrieval-Augmented Code Generation — 10× in this paper
• Ablation — 6× in this paper · explained in 1 episode
• Retrieval-Augmented Generation — 6× in this paper
• Alignment — 5× in this paper · explained in 1 episode
• Attack Success Rate — 5× in this paper
• Embeddings — 3× in this paper · explained in 2 episodes
• Hallucination — 3× in this paper · explained in 3 episodes
• Retrieval Success Rate — 3× in this paper
• Server-Side Request Forgery — 3× in this paper
• Target Weakness Rate — 3× in this paper
• Ablation study — 2× in this paper · explained in 1 episode
• Adversarial Attacks — 2× in this paper · explained in 1 episode
• Attack Success Rate (ASR) — 2× in this paper · explained in 2 episodes
• Benchmark — 2× in this paper · explained in 2 episodes
• Common Weakness Enumeration — 2× in this paper
• Instruction Tuning — 2× in this paper · explained in 2 episodes
• Robustness — 2× in this paper · explained in 5 episodes
• Core — 1× in this paper · explained in 2 episodes
• Fine-Tuning — 1× in this paper · explained in 5 episodes
• Foundation Model — 1× in this paper · explained in 3 episodes
• Foundation Models — 1× in this paper · explained in 7 episodes
• Generalizability — 1× in this paper · explained in 6 episodes
• LLM judge — 1× in this paper · explained in 2 episodes
• Large Language Models (LLMs) — 1× in this paper · explained in 6 episodes
• Retrieval-Augmented Generation (RAG) — 1× in this paper · explained in 16 episodes
• Semantic Alignment — 1× in this paper · explained in 3 episodes

Sources

• RAVEN: Agentic RAG for Automated Vulnerability Repair
• Security and Quality in LLM-Generated Code: A Multi-Language, Multi-Model Analysis
• RESCUE: Retrieval Augmented Secure Code Generation
• Code Llama: Open Foundation Models for Code
• DeepSeek-Coder-V2: Breaking the Barrier of Closed-Source Models in Code Intelligence
• GLM-5: from Vibe Coding to Agentic Engineering
• jina-embeddings-v3: Multilingual Embeddings With Task LoRA
• The Faiss library
• CodeBLEU: a Method for Automatic Evaluation of Code Synthesis
• CYBERSECEVAL 3: Advancing the Evaluation of Cybersecurity Risks and Capabilities in Large Language Models
• Retrieval-Augmented Generation for Large Language Models: A Survey
• Backdoored Retrievers for Prompt Injection Attacks on Retrieval Augmented Generation of Large Language Models
• MM-PoisonRAG: Disrupting Multimodal RAG with Local and Global Poisoning Attacks
• Retrieval-Augmented Code Generation: A Survey with Focus on Repository-Level Approaches
• RAG-Pull: Turning Retrieval into a Code-Injection Channel via Invisible Unicode Perturbations
• SOSecure: Safer Code Generation with RAG and StackOverflow Discussions

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs