mlsanityData to 14 Oct 2026

CodeSentinel: A Three-Layer Defense Against Indirect Prompt Injection in Code Contexts

arXiv 2606.19235 ↗First posted 17 Jun 2026cs.CRcited by 0

On the map: LLM safety and security → Prompt injection and agent security

Abstract (arXiv)

Code large language models increasingly retrieve external code context from repositories, documentation, issue threads, and coding-agent environments, creating an indirect prompt-injection surface where attackers hide instructions in comments, strings, identifiers, or decoy code. We propose CodeSentinel, a three-layer inference-time sanitizer. It uses Tree-sitter to extract high-risk model-facing CST nodes, then combines syntax-guided pre-filtering, CST-guided Dynamic Min-K% scoring, and node perturbation analysis to detect adversarial and natural-looking semantic triggers. Detected nodes are removed or neutralized before reaching the downstream Code LLM. Across six recent attack families, CodeSentinel achieves 0.80 average node-level F1, outperforming CodeGarrison, DePA, and KillBadCode.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security. Builds on 16 of its 26 references that are in the map. First posted on arXiv 17 Jun 2026.

Builds on

16 of 26 references.

Closest ancestors · 7

Same direction, newest first

  1. 2026Indirect Prompt Injection in the Wild: An Empirical Study of Prevalence, Techniques, and Objectives29 Apr
  2. 2025Chasing Moving Targets with Online Self-Play Reinforcement Learning for Safer Language Models9 Jun
  3. 2025Defending against Indirect Prompt Injection by Instruction Detection8 May
  4. 2025Can Indirect Prompt Injection Attacks Be Detected and Removed?23 Feb
  5. 2024SecAlign: Defending Against Prompt Injection with Preference Optimization7 Oct
  6. 2024ShadowCode: Towards (Automatic) External Prompt Injection Attack against Code LLMs12 Jul
  7. 2024StruQ: Defending Against Prompt Injection with Structured Queries9 Feb

Other references · 9

  1. 2021Evaluating Large Language Models Trained on Codecited by 8,320
  2. 2021Program Synthesis with Large Language Modelscited by 3,637
  3. 2023RepoBench: Benchmarking Repository-Level Code Auto-Completion Systemscited by 353
  4. 2025PR-Attack: Coordinated Prompt-RAG Attacks on Retrieval-Augmented Generation in Large Language Models via Bilevel Optimizationcited by 32
  5. 2024Black-Box Adversarial Attacks on LLM-Based Code Completioncited by 14
  6. 2025Show Me Your Code! Kill Code Poisoning: A Lightweight Method Based on Code Naturalnesscited by 8
  7. 2025MOCHA: Are Code Language Models Robust Against Multi-Turn Malicious Coding Prompts?cited by 7
  8. 2025Smoke and Mirrors: Jailbreaking LLM-based Code Generation via Implicit Malicious Promptscited by 5
  9. 2025CoTDeceptor:Adversarial Code Obfuscation Against CoT-Enhanced LLM Code Agentscited by 3

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026LTBD: Learnable Trust-Boundary Delimiters for Prompt Injection Defense
  2. 2026Beyond Over-Refusal: Defending Indirect Prompt Injection via Latent Instruction Manifolds
  3. 2026CIBER: A Comprehensive Benchmark for Security Evaluation of Code Interpreter Agents
  4. 2025SecInfer: Preventing Prompt Injection via Inference-time Scaling
  5. 2026CodeMimicry: Exploiting Safety Generalization Lag in Large Language Models via Structured Code Completion
  6. 2025Attention is All You Need to Defend Against Indirect Prompt Injection Attacks in LLMs
  7. 2026SRD-GUARD: A Defense Framework of LLMs via Semantic Rewriting and Joint Multi-Model Scoring for Latent Intent Exposure
  8. 2024CodePurify: Defend Backdoor Attacks on Neural Code Models via Entropy-based Purification