mlsanityData to 14 Oct 2026

MOCHA: Are Code Language Models Robust Against Multi-Turn Malicious Coding Prompts?

arXiv 2507.19598 ↗First posted 25 Jul 2025cs.CL cs.AI cs.CRcited by 7

Not on the map. Why?

Abstract (arXiv)

Recent advancements in Large Language Models (LLMs) have significantly enhanced their code generation capabilities. However, their robustness against adversarial misuse, particularly through multi-turn malicious coding prompts, remains underexplored. In this work, we introduce code decomposition attacks, where a malicious coding task is broken down into a series of seemingly benign subtasks across multiple conversational turns to evade safety filters. To facilitate systematic evaluation, we introduce benchmarkname, a large-scale benchmark designed to evaluate the robustness of code LLMs against both single-turn and multi-turn malicious prompts. Empirical results across open- and closed-source models reveal persistent vulnerabilities, especially under multi-turn scenarios. Fine-tuning on MOCHA improves rejection rates while preserving coding ability, and importantly, enhances robustness on external adversarial datasets with up to 32.4% increase in rejection rates without any additional supervision.

Key facts. Cited by 7 papers in the map (data through 14 Oct 2026). Builds on 43 of its 67 references that are in the map. First posted on arXiv 25 Jul 2025.

Builds on

43 of 67 references.

References · 43

  1. 2021Evaluating Large Language Models Trained on Codecited by 8,320
  2. 2021Prefix-Tuning: Optimizing Continuous Prompts for Generationcited by 3,915
  3. 2021Program Synthesis with Large Language Modelscited by 3,637
  4. 2024Gemini 1.5: Unlocking multimodal understanding across millions of tokens of contextcited by 3,224
  5. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  6. 2019HuggingFace's Transformers: State-of-the-art Natural Language Processingcited by 2,218
  7. 2022Competition-Level Code Generation with AlphaCodecited by 1,462
  8. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  9. 2023Is Your Code Generated by ChatGPT Really Correct? Rigorous Evaluation of Large Language Models for Code Generationcited by 1,391
  10. 2024DeepSeek-Coder: When the Large Language Model Meets Programming -- The Rise of Code Intelligencecited by 1,181
  11. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Promptscited by 560
  12. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrationscited by 431
31 more
  1. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 390
  2. 2023DeepInception: Hypnotize Large Language Model to Be Jailbreakercited by 367
  3. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 341
  4. 2023Multi-step Jailbreaking Privacy Attacks on ChatGPTcited by 333
  5. 2023Magicoder: Empowering Code Generation with OSS-Instructcited by 256
  6. 2023Scalable and Transferable Black-Box Jailbreaks for Language Models via Persona Modulationcited by 214
  7. 2023Planning with Large Language Models for Code Generationcited by 182
  8. 2020You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completioncited by 131
  9. 2024Making Them Ask and Answer: Jailbreaking Large Language Models in Few Queries via Disguise and Reconstructioncited by 107
  10. 2024RedCode: Risky Code Execution and Generation Benchmark for Code Agentscited by 90
  11. 2022Natural Attack for Pre-trained Models of Codecited by 75
  12. 2023Ignore This Title and HackAPrompt: Exposing Systemic Vulnerabilities of LLMs through a Global Scale Prompt Hacking Competitioncited by 68
  13. 2022XLCoST: A Benchmark Dataset for Cross-lingual Code Intelligencecited by 56
  14. 2022CodeAttack: Code-Based Adversarial Attacks for Pre-trained Programming Language Modelscited by 53
  15. 2024Semantic Mirror Jailbreak: Genetic Algorithm Based Jailbreak Prompts Against Open-source LLMscited by 53
  16. 2024Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMscited by 51
  17. 2024CoSafe: Evaluating Large Language Model Safety in Multi-Turn Dialogue Coreferencecited by 51
  18. 2024When LLM Meets DRL: Advancing Jailbreaking Efficiency via DRL-guided Searchcited by 47
  19. 2024Current state of LLM Risks and AI Guardrailscited by 46
  20. 2024Distract Large Language Models for Automatic Jailbreak Attackcited by 45
  21. 2025The Amazon Nova Family of Models: Technical Report and Model Cardcited by 41
  22. 2023DeceptPrompt: Exploiting LLM-driven Code Generation via Adversarial Natural Language Instructionscited by 33
  23. 2024Malla: Demystifying Real-world Large Language Model Integrated Malicious Servicescited by 33
  24. 2023CodeFusion: A Pre-trained Diffusion Model for Code Generationcited by 31
  25. 2024RMCBench: Benchmarking Large Language Models' Resistance to Malicious Codecited by 28
  26. 2024Efficient LLM Jailbreak via Adaptive Dense-to-sparse Constrained Optimizationcited by 18
  27. 2023SC-Safety: A Multi-round Open-ended Question Adversarial Safety Benchmark for Large Language Models in Chinesecited by 17
  28. 2022Poison Attack and Defense on Deep Source Code Processing Modelscited by 11
  29. 2023Adversarial Attacks on Code Models with Discriminative Graph Patternscited by 6
  30. 2024Poisoning Programs by Un-Repairing Code: Security Concerns of AI-generated Codecited by 6
  31. 2025Smoke and Mirrors: Jailbreaking LLM-based Code Generation via Implicit Malicious Promptscited by 5

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 1; 2026: 6.

7 papers.

  1. 2025When "Correct" Is Not Safe: Can We Trust Functionally Correct Patches Generated by Code Agents?cited by 3
  2. 2026MOSAIC-Bench: Measuring Compositional Vulnerability Induction in Coding Agentscited by 3
  3. 2026Refusal Evaluation in Coding LLMs and Code Agents: A Systematic Review of Thirteen Malicious-Code Prompt Corpora (2023-2025)cited by 1
  4. 2026Grammar-Constrained Decoding Can Jailbreak LLMs into Generating Malicious Codecited by 0
  5. 2026CodeSentinel: A Three-Layer Defense Against Indirect Prompt Injection in Code Contextscited by 0
  6. 2026Verifying Intent and Harm: A Unified Defense Against LLM-Generated Threatscited by 0
  7. 2026CS-Guard: Benchmarking LLM Guardrails for Code Generation Securitycited by 0