CodeSentinel: A Three-Layer Defense Against Indirect Prompt Injection in Code Contexts

Abstract

Code large language models increasingly retrieve external code context from repositories, documentation, issue threads, and coding-agent environments, creating an indirect prompt-injection surface where attackers hide instructions in comments, strings, identifiers, or decoy code. We propose CodeSentinel, a three-layer inference-time sanitizer. It uses Tree-sitter to extract high-risk model-facing CST nodes, then combines syntax-guided pre-filtering, CST-guided Dynamic Min-K\% scoring, and node p

Categories

Framework mappings

Suggested from the entry's categories.

@misc{cheng2026codesentinel,
  title = {{CodeSentinel: A Three-Layer Defense Against Indirect Prompt Injection in Code Contexts}},
  author = {Po-Han Cheng and Chia-Mu Yu and Ying-Dar Lin and Yu-Sung Wu and Wei-Bin Lee},
  year = {2026},
  month = jun,
  eprint = {2606.19235},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.19235}
}