mlsanityData to 7 Oct 2026

You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completion

arXiv 2007.02220 ↗First posted 5 Jul 2020cs.CR cs.CL cs.LGcited by 112

Not on the map. Why?

Cited by 36 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Code autocompletion is an integral feature of modern code editors and IDEs. The latest generation of autocompleters uses neural language models, trained on public open-source code repositories, to suggest likely (not just statically feasible) completions given the current context. We demonstrate that neural code autocompleters are vulnerable to poisoning attacks. By adding a few specially-crafted files to the autocompleter's training corpus (data poisoning), or else by directly fine-tuning the autocompleter on these files (model poisoning), the attacker can influence its suggestions for attacker-chosen contexts. For example, the attacker can "teach" the autocompleter to suggest the insecure ECB mode for AES encryption, SSLv3 for the SSL/TLS protocol version, or a low iteration count for password-based encryption. Moreover, we show that these attacks can be targeted: an autocompleter poisoned by a targeted attack is much more likely to suggest the insecure completion for files from a specific repo or specific developer. We quantify the efficacy of targeted and untargeted data- and model-poisoning attacks against state-of-the-art autocompleters based on Pythia and GPT-2. We then evaluate existing defenses against poisoning attacks and show that they are largely ineffective.

Key facts. Cited by 112 papers in the map (data through 7 Oct 2026). First posted on arXiv 5 Jul 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 13; 2022: 11; 2023: 22; 2024: 26; 2025: 24; 2026: 16.

112 papers.

Sort:

By area:

  1. 2021Evaluating Large Language Models Trained on Codecited by 8,053
  2. 2022PaLM: Scaling Language Modeling with Pathwayscited by 5,304
  3. 2021Program Synthesis with Large Language Modelscited by 3,509
  4. 2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 380
  5. 2021Unsolved Problems in ML Safetycited by 291
  6. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
  7. 2023Poisoning Language Models During Instruction Tuningcited by 254
  8. 2024Security and Privacy Challenges of Large Language Models: A Surveycited by 179
  9. 2023Large Language Models for Code: Security Hardening and Adversarial Testingcited by 149
  10. 2024The Emerged Security and Privacy of LLM Agent: A Survey with Case Studiescited by 127
  11. 2023On the Exploitability of Instruction Tuningcited by 110
  12. 2022Truth Serum: Poisoning Machine Learning Models to Reveal Their Secretscited by 94
38 more
  1. 2024Don't Listen To Me: Understanding and Exploring Jailbreak Prompts of Large Language Modelscited by 77
  2. 2022Machine Generated Text: A Comprehensive Survey of Threat Models and Detection Methodscited by 75
  3. 2023Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Modelscited by 72
  4. 2021Spinning Language Models: Risks of Propaganda-As-A-Service and Countermeasurescited by 69
  5. 2024Exploiting LLM Quantizationcited by 61
  6. 2022"Real Attackers Don't Compute Gradients": Bridging the Gap Between Adversarial ML Research and Practicecited by 55
  7. 2024Calibration and Correctness of Language Models for Codecited by 49
  8. 2023Privacy in Large Language Models: Attacks, Defenses and Future Directionscited by 48
  9. 2023TrojanPuzzle: Covertly Poisoning Code-Suggestion Modelscited by 47
  10. 2021Poisoning the Unlabeled Dataset of Semi-Supervised Learningcited by 44
  11. 2021CoProtector: Protect Open-Source Code against Unauthorized Training Usage with Data Poisoningcited by 39
  12. 2021Poison Forensics: Traceback of Data Poisoning Attacks in Neural Networkscited by 37
  13. 2021Quantifying and Mitigating Privacy Risks of Contrastive Learningcited by 35
  14. 2022PoisonedEncoder: Poisoning the Unlabeled Pre-training Data in Contrastive Learningcited by 33
  15. 2024An LLM-Assisted Easy-to-Trigger Backdoor Attack on Code Completion Models: Injecting Disguised Vulnerabilities against Strong Detectioncited by 32
  16. 2026Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystemscited by 30
  17. 2023Vulnerabilities in AI Code Generators: Exploring Targeted Data Poisoning Attackscited by 29
  18. 2024Compromising Embodied Agents with Contextual Backdoor Attackscited by 29
  19. 2023Integration of Large Language Models and Federated Learningcited by 28
  20. 2023CodeMark: Imperceptible Watermarking for Code Datasets against Neural Code Completion Modelscited by 28
  21. 2024Large Model Based Agents: State-of-the-Art, Cooperation Paradigms, Security and Privacy, and Future Trendscited by 26
  22. 2021Programming Puzzlescited by 25
  23. 2024Purifying Large Language Models by Ensembling a Small Language Modelcited by 25
  24. 2021A Survey on Machine Learning Techniques for Source Code Analysiscited by 23
  25. 2025DemonAgent: Dynamically Encrypted Multi-Backdoor Implantation Attack on LLM-based Agentcited by 23
  26. 2023Deep Learning for Code Intelligence: Survey, Benchmark and Toolkitcited by 22
  27. 2023AI vs. Human -- Differentiation Analysis of Scientific Content Generationcited by 21
  28. 2023Backdoor Attacks Against Dataset Distillationcited by 20
  29. 2025Data Poisoning in Deep Learning: A Surveycited by 20
  30. 2023Multi-target Backdoor Attacks for Code Pre-trained Modelscited by 19
  31. 2023Trustworthy and Synergistic Artificial Intelligence for Software Engineering: Vision and Roadmapscited by 19
  32. 2025Security and Quality in LLM-Generated Code: A Multi-Language, Multi-Model Analysiscited by 18
  33. 2023The Age of Synthetic Realities: Challenges and Opportunitiescited by 15
  34. 2021Get a Model! Model Hijacking Attack Against Machine Learning Modelscited by 13
  35. 2023Backdooring Neural Code Searchcited by 13
  36. 2024Black-Box Adversarial Attacks on LLM-Based Code Completioncited by 13
  37. 2022Don't Complete It! Preventing Unhelpful Code Completion for Productive and Sustainable Neural Code Completion Systemscited by 12
  38. 2024Trustworthy Distributed AI Systems: Robustness, Privacy, and Governancecited by 12

50 most cited of 112 All 112 (JSON)