Research·arXiv cs.LG·13h ago

Poisoned code artifacts can corrupt LLM-generated software through retrieval systems

Researchers have demonstrated a practical attack vector against retrieval-augmented code generation systems, where poisoned code artifacts injected into external knowledge bases can stealthily introduce vulnerabilities into LLM-generated software without modifying the model itself. CodePoisonRAG shows that attackers can craft single, task-matched malicious entries that propagate specific weaknesses through the retrieval pipeline, exploiting a critical trust boundary in RACG architectures. This finding exposes a supply-chain risk in AI-assisted development workflows where code repositories and documentation serve as implicit attack surfaces, forcing teams to reconsider validation and sandboxing practices for retrieved artifacts.

Modelwire context

Explainer

The attack doesn't require access to the model itself or retraining. Instead, it exploits the assumption that retrieved artifacts are trustworthy by default, meaning a single malicious code snippet in a public repository or documentation database can reliably propagate into generated output.

This connects directly to two prior findings. The retrieval ranking problem from early September showed that embedders collapse to near-zero accuracy when surface form and semantic structure diverge, meaning attackers can craft poisoned entries that rank high despite semantic mismatch. Separately, the Progressive Risk Vesting framework from the same period proposed controlling when agents execute irreversible actions like code deployment. CodePoisonRAG exposes why that control layer is necessary: if the code generation pipeline itself is a supply-chain attack surface, sandboxing retrieved artifacts becomes as critical as sandboxing agent execution.

If major code-hosting platforms (GitHub, GitLab) or documentation systems announce retrieval-specific verification or quarantine mechanisms within the next six months, that signals the industry is treating this as a real deployment risk rather than a theoretical concern. Absence of such changes would suggest practitioners are treating this as a research artifact.

Coverage we drew on

Retrieved but not ranked: surface-form bias in structural retrieval, from mathematics to agent trajectories · arXiv cs.LG

This analysis is generated by Modelwire’s editorial layer from our archive and the summary above. It is not a substitute for the original reporting. How we write it.

MentionsCodePoisonRAG · Retrieval-Augmented Code Generation · LLM

Read full story at arXiv cs.LG →(arxiv.org)

Modelwire Editorial

This synthesis and analysis was prepared by the Modelwire editorial team. We use advanced language models to read, ground, and connect the day’s most significant AI developments, providing original strategic context that helps practitioners and leaders stay ahead of the frontier.

Our mission How we write

Modelwire summarizes, we don’t republish. arXiv cs.LG originally reported this story as “CodePoisonRAG: Knowledge Poisoning Attacks on Retrieval-Augmented Code Generation”. The full content lives on arxiv.org. If you’re a publisher and want a different summarization policy for your work, see our takedown page.