mlsanityData to 14 Oct 2026

Vulnerabilities in AI Code Generators: Exploring Targeted Data Poisoning Attacks

arXiv 2308.04451 ↗First posted 4 Aug 2023cs.CR cs.AIcited by 33

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

AI-based code generators have become pivotal in assisting developers in writing software starting from natural language (NL). However, they are trained on large amounts of data, often collected from unsanitized online sources (e.g., GitHub, HuggingFace). As a consequence, AI models become an easy target for data poisoning, i.e., an attack that injects malicious samples into the training data to generate vulnerable code. To address this threat, this work investigates the security of AI code generators by devising a targeted data poisoning strategy. We poison the training data by injecting increasing amounts of code containing security vulnerabilities and assess the attack's success on different state-of-the-art models for code generation. Our study shows that AI code generators are vulnerable to even a small amount of poison. Notably, the attack success strongly depends on the model architecture and poisoning rate, whereas it is not influenced by the type of vulnerabilities. Moreover, since the attack does not impact the correctness of code generated by pre-trained models, it is hard to detect. Lastly, our work offers practical insights into understanding and potentially mitigating this threat.

Key facts. Cited by 33 papers in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 38 of its 72 references that are in the map. First posted on arXiv 4 Aug 2023.

Builds on

38 of 72 references.

Closest ancestors · 8

Same direction, newest first

  1. 2023Backdooring Neural Code Search27 May
  2. 2023Stealthy Backdoor Attack for Code Models6 Jan
  3. 2022Poison Attack and Defense on Deep Source Code Processing Models31 Oct
  4. 2022Machine Learning Security against Data Poisoning: Are We There Yet?12 Apr
  5. 2021CoProtector: Protect Open-Source Code against Unauthorized Training Usage with Data Poisoning25 Oct
  6. 2021Poison Forensics: Traceback of Data Poisoning Attacks in Neural Networks13 Oct
  7. 2021Putting words into the system's mouth: A targeted attack on neural machine translation using monolingual data poisoning12 Jul
  8. 2021Hidden Backdoors in Human-Centric Language Models1 May

Other references · 30

  1. 2017Attention Is All You Needcited by 60,361
  2. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  3. 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,599
  4. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,372
  5. 2014Neural Machine Translation by Jointly Learning to Align and Translatecited by 4,548
  6. 2020CodeBERT: A Pre-Trained Model for Programming and Natural Languagescited by 1,310
  7. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  8. 2023LIMA: Less Is More for Alignmentcited by 1,100
  9. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
  10. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 519
  11. 2018Spectral Signatures in Backdoor Attackscited by 484
  12. 2021Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributionscited by 431
18 more
  1. 2022UniXcoder: Unified Cross-Modal Pre-training for Code Representationcited by 361
  2. 2023CodeT5+: Open Code Large Language Models for Code Understanding and Generationcited by 333
  3. 2021Pre-Trained Models: Past, Present and Futurecited by 319
  4. 2020IntelliCode Compose: Code Generation Using Transformercited by 227
  5. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 211
  6. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 180
  7. 2020You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completioncited by 131
  8. 2021Studying the Usage of Text-To-Text Transfer Transformer to Support Code-Related Taskscited by 70
  9. 2023On the Robustness of Code Generation Techniques: An Empirical Study on GitHub Copilotcited by 64
  10. 2023LLMSecEval: A Dataset of Natural Language Prompts for Security Evaluationscited by 62
  11. 2023TrojanPuzzle: Covertly Poisoning Code-Suggestion Modelscited by 60
  12. 2022CodeAttack: Code-Based Adversarial Attacks for Pre-trained Programming Language Modelscited by 53
  13. 2019On Learning Meaningful Code Changes via Neural Machine Translationcited by 50
  14. 2022Compilable Neural Code Generation with Compiler Feedbackcited by 47
  15. 2020Backdoors in Neural Models of Source Codecited by 41
  16. 2018XNMT: The eXtensible Neural Machine Translation Toolkitcited by 14
  17. 2021EVIL: Exploiting Software via Natural Languagecited by 12
  18. 2022Who Evaluates the Evaluators? On Automatic Metrics for Assessing AI-based Offensive Code Generatorscited by 11

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 2; 2024: 10; 2025: 15; 2026: 6.

33 papers.

Sort:

By area:

  1. 2025Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samplescited by 72
  2. 2023Clover: Closed-Loop Verifiable Code Generationcited by 67
  3. 2023DeceptPrompt: Exploiting LLM-driven Code Generation via Adversarial Natural Language Instructionscited by 33
  4. 2024Beyond Functional Correctness: Investigating Coding Style Inconsistencies in Large Language Modelscited by 15
  5. 2024Just another copy and paste? Comparing the security vulnerabilities of ChatGPT generated code and StackOverflow answerscited by 13
  6. 2024From Vulnerabilities to Remediation: A Systematic Literature Review of LLMs in Code Securitycited by 10
  7. 2025SandboxEval: Towards Securing Test Environment for Untrusted Codecited by 10
  8. 2025RedCoder: Automated Multi-Turn Red Teaming for Code LLMscited by 9
  9. 2025RedCodeAgent: Automatic Red-teaming Agent against Diverse Code Agentscited by 9
  10. 2025A Systematic Review of Poisoning Attacks Against Large Language Modelscited by 8
  11. 2025VeriEquivBench: An Equivalence Score for Ground-Truth-Free Evaluation of Formally Verifiable Codecited by 7
  12. 2025CodeMirage: A Multi-Lingual Benchmark for Detecting AI-Generated and Paraphrased Source Code from Production-Level LLMscited by 6
21 more
  1. 2024Defending Code Language Models against Backdoor Attacks with Deceptive Cross-Entropy Losscited by 5
  2. 2025Red Teaming Program Repair Agents: When Correct Patches can Hide Vulnerabilitiescited by 5
  3. 2024Towards Action Hijacking of Large Language Model-based Agentcited by 4
  4. 2024Can LLM Prompting Serve as a Proxy for Static Analysis in Vulnerability Detectioncited by 4
  5. 2025AI Code in the Wild: Measuring Security Risks and Ecosystem Shifts of AI-Generated Code in Modern Softwarecited by 4
  6. 2026How Secure is Secure Code Generation? Adversarial Prompts Put LLM Defenses to the Testcited by 4
  7. 2024Enhancing AI-based Generation of Software Exploits with Contextual Informationcited by 3
  8. 2024Memory Backdoor Attacks on Neural Networkscited by 3
  9. 2024Trojans in Large Language Models of Code: A Critical Review through a Trigger-Based Taxonomycited by 2
  10. 2026The State of Generative AI in Software Development: Insights from Literature and a Developer Surveycited by 2
  11. 2025HiLDe: Intentional Code Generation via Human-in-the-Loop Decodingcited by 1
  12. 2025Detecting Stealthy Data Poisoning Attacks in AI Code Generatorscited by 1
  13. 2025Effective Code Membership Inference for Code Completion Models via Adversarial Promptscited by 1
  14. 2026CodePoisonRAG: Knowledge Poisoning Attacks on Retrieval-Augmented Code Generationcited by 1
  15. 2024Human-Centered AI Product Prototyping with No-Code AutoML: Conceptual Framework, Potentials and Limitationscited by 0
  16. 2025Poisoned Source Code Detection in Code Modelscited by 0
  17. 2025Amazon Nova AI Challenge -- Trusted AI: Advancing secure, AI-assisted software developmentcited by 0
  18. 2025A Systematic Evaluation of Parameter-Efficient Fine-Tuning Methods for the Security of Code LLMscited by 0
  19. 2026Security of LLM-generated Code: A Comparative Analysiscited by 0
  20. 2026The Vibe Shift in Software Engineering: Evaluating AI-Led Conversational Programming for Performance, Cognition, and Responsible Adoptioncited by 0
  21. 2026Security in LLM-Assisted Coding: A Systematic Literature Reviewcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Poisoning Programs by Un-Repairing Code: Security Concerns of AI-generated Code
  2. 2025Automated Vulnerability Validation and Verification: A Large Language Model Approach
  3. 2023Forcing Generative Models to Degenerate Ones: The Power of Data Poisoning Attacks
  4. 2023TrojanedCM: A Repository of Trojaned Large Language Models of Code
  5. 2022Poisoning Attacks and Defenses on Artificial Intelligence: A Survey
  6. 2024Double Backdoored: Converting Code Large Language Model Backdoors to Traditional Malware via Adversarial Instruction Tuning Attacks
  7. 2026Beware EviLLM: Enabling Vulnerability Injection via Large Language Models
  8. 2025Exploring the Security Threats of Knowledge Base Poisoning in Retrieval-Augmented Code Generation