CodeSentinel: A Three-Layer Defense Against Indirect Prompt Injection in Code Contexts

• URL: http://arxiv.org/abs/2606.19235v1
• Date: Wed, 17 Jun 2026 16:12:50 GMT
• Title: CodeSentinel: A Three-Layer Defense Against Indirect Prompt Injection in Code Contexts
• Abstract summary: Code large language models increasingly retrieve external code context from repositories, documentation, issue threads, and coding-agent environments.<n>We propose CodeSentinel, a three-layer inference-time sanitizer.<n>It uses Tree-sitter to extract high-risk model-facing CST nodes, then combines syntax-guided pre-filtering, CST-guided Dynamic Min-K% scoring, and node perturbation analysis to detect adversarial and natural-looking semantic triggers.<n>CodeSentinel achieves 0.80 average node-level F1, outperforming CodeGarrison, DePA, and KillBadCode.
• Score: 9.504326240833267
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Code large language models increasingly retrieve external code context from repositories, documentation, issue threads, and coding-agent environments, creating an indirect prompt-injection surface where attackers hide instructions in comments, strings, identifiers, or decoy code. We propose CodeSentinel, a three-layer inference-time sanitizer. It uses Tree-sitter to extract high-risk model-facing CST nodes, then combines syntax-guided pre-filtering, CST-guided Dynamic Min-K\% scoring, and node perturbation analysis to detect adversarial and natural-looking semantic triggers. Detected nodes are removed or neutralized before reaching the downstream Code LLM. Across six recent attack families, \CodeSentinel achieves 0.80 average node-level F1, outperforming CodeGarrison, DePA, and KillBadCode.

Related papers

• Vulnerable Code Search: Transferable Attack for Code Language Models [9.326008120835938]
  We introduce a programming language-agnostic, transferable, adversarial attack that exploits this CLM vulnerability.<n>Our approach perturbs identifiers within a code snippet without altering the snippet's functionality to artificially align the code with a target query.
  arXiv  Detail & Related papers  (2026-08-26T17:11:36Z)
• Rethinking Item Tokenization in Generative Recommenders: From Fixed Atoms to Semantic Subwords [50.621722853036005]
  In generative recommender systems, items are typically tokenized into fixed-length semantic ID sequences for autoregressive next-item prediction.<n>For user-context modeling, this fine-grained representation triggers Intra-item Attention Overload.<n>We propose Semantic Subword Tokenization (SST), which represents historical items as variable-length semantic subwords.
  arXiv  Detail & Related papers  (2026-08-24T02:42:51Z)
• From Attack Simulation to SIEM Rule: Deterministic Detection-as-Code Synthesis with Probe-Level Traceability [51.56484100374058]
  Security teams simulate attacks against their own systems to check whether their monitoring would catch a real intruder.<n>A human bridges that gap by hand, reading each finding and writing the corresponding Sigma rule.<n>We show this translation can be partially automated when probes are drawn from a locked corpus.
  arXiv  Detail & Related papers  (2026-06-03T14:26:25Z)
• Do not copy and paste! Rewriting strategies for code retrieval [0.7710436567988378]
  We study a hierarchy of three rewriting strategies: stylistic rephrasing, NL-enriched PseudoCode, and full Natural-Language transcription.<n>We are the first to evaluate NL-enriched PseudoCode and snippet-level Natural Language as direct retrieval representations, rather than as transient intermediates.<n>We introduce two diagnostics, Delta H, token entropy, and Delta s, embedding cosine, and show that Delta H predicts retrieval gain under QC across all three rewriter families.
  arXiv  Detail & Related papers  (2026-05-08T11:31:26Z)
• Detecting Data Poisoning in Code Generation LLMs via Black-Box, Vulnerability-Oriented Scanning [12.405265138053329]
  Code generation large language models (LLMs) are increasingly integrated into modern software development.<n>Existing scanning approaches rely on token-level generation consistency to invert attack targets.<n>We present CodeScan, which is the first poisoning-scanning framework tailored to code generation models.
  arXiv  Detail & Related papers  (2026-03-17T22:08:45Z)
• The Trojan Knowledge: Bypassing Commercial LLM Guardrails via Harmless Prompt Weaving and Adaptive Tree Search [58.8834056209347]
  Large language models (LLMs) remain vulnerable to jailbreak attacks that bypass safety guardrails to elicit harmful outputs.<n>We introduce the Correlated Knowledge Attack Agent (CKA-Agent), a dynamic framework that reframes jailbreaking as an adaptive, tree-structured exploration of the target model's knowledge base.
  arXiv  Detail & Related papers  (2025-12-01T07:05:23Z)
• From Solitary Directives to Interactive Encouragement! LLM Secure Code Generation by Natural Language Prompting [24.27542373791212]
  This work introduces SecCode, a framework that leverages an innovative interactive encouragement prompting (EP) technique for secure code generation with textitonly NL prompts. SecCode functions through three stages: 1) Code Generation using NL Prompts; 2) Code Vulnerability Detection and Fixing, utilising our proposed encouragement prompting; 3) Vulnerability Cross-Checking and Code Security Refinement.
  arXiv  Detail & Related papers  (2024-10-18T09:32:08Z)
• ShadowCode: Towards (Automatic) External Prompt Injection Attack against Code LLMs [56.46702494338318]
  This paper introduces a new attack paradigm: (automatic) external prompt injection against code-oriented large language models.<n>We propose ShadowCode, a simple yet effective method that automatically generates induced perturbations based on code simulation.<n>We evaluate our method across 13 distinct malicious objectives, generating 31 threat cases spanning three popular programming languages.
  arXiv  Detail & Related papers  (2024-07-12T10:59:32Z)
• SCALE: Constructing Structured Natural Language Comment Trees for Software Vulnerability Detection [36.37244302912536]
  We propose a Structured Natural Language Comment tree-based vulnerAbiLity dEtection framework based on the pre-trained models. The proposed Structured Natural Language Comment Tree (SCT) integrates the semantics of code statements with code execution sequences.
  arXiv  Detail & Related papers  (2024-03-28T02:20:03Z)
• Certifying LLM Safety against Adversarial Prompting [70.96868018621167]
  Large language models (LLMs) are vulnerable to adversarial attacks that add malicious tokens to an input prompt.<n>We introduce erase-and-check, the first framework for defending against adversarial prompts with certifiable safety guarantees.
  arXiv  Detail & Related papers  (2023-09-06T04:37:20Z)
• COSEA: Convolutional Code Search with Layer-wise Attention [90.35777733464354]
  We propose a new deep learning architecture, COSEA, which leverages convolutional neural networks with layer-wise attention to capture the code's intrinsic structural logic. COSEA can achieve significant improvements over state-of-the-art methods on code search tasks.
  arXiv  Detail & Related papers  (2020-10-19T13:53:38Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.