CodePoisonRAG: Knowledge Poisoning Attacks on Retrieval-Augmented Code Generation

Abstract

Retrieval-Augmented Code Generation (RACG) improves LLM-based software development by retrieving external code artifacts, documentation, and patches, and incorporating them into the generation context. This reliance on external knowledge introduces a critical trust boundary: poisoned artifacts can influence generated code without modifying the underlying LLM. Prior work shows that selecting existing vulnerable examples can increase the general vulnerability rate of RACG outputs, but leaves open

Categories

Framework mappings

Suggested from the entry's categories.

@misc{gadey2026codepoisonrag,
  title = {{CodePoisonRAG: Knowledge Poisoning Attacks on Retrieval-Augmented Code Generation}},
  author = {Varun Gadey and Ziad Marey and Alexandra Dmitrienko},
  year = {2026},
  month = sep,
  eprint = {2609.02774},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02774}
}