{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/arxiv-2605-27631","title":"Poison with Style: A Practical Poisoning Attack on Code Large Language Models","arxiv_id":"2605.27631","date":"2026-05-26","proceeding":"ICML","authors":["Khang Tran","Yazan Boshmaf","Issa Khalil","NhatHai Phan","Ting Yu","Md Rizwan Parvez"],"abstract":"Code Large Language Models (CLLMs) serve as the core of modern code agents, enabling developers to automate complex software development tasks. In this paper, we present Poison-with-Style (PwS), a practical and stealthy model poisoning attack targeting CLLMs. Unlike prior attacks that assume an active adversary capable of directly embedding explicit triggers (e.g., specific words) into developers' prompts during inference, PwS leverages developers' code styles as covert triggers implicitly embedded within their prompts. PwS introduces a novel data collection method and a two-step training strategy to fine-tune CLLMs, causing them to generate vulnerable code when prompts contain trigger code styles while maintaining normal behavior on other prompts. Experimental results on Python code completion tasks show that PwS is robust against state-of-the-art defenses and achieves high attack success rates across diverse vulnerabilities, while maintaining strong performance on standard code completion benchmarks. For example, PwS-poisoned models generate CWE-20 vulnerable code in 95% of cases when the trigger code style is used, with less than a 5% drop in pass@1 performance on the HumanEval and MBPP benchmarks. Our implementation and dataset are here: https://github.com/khangtran2020/pws.","url_abs":"https://arxiv.org/abs/2605.27631","url_pdf":"https://arxiv.org/pdf/2605.27631","source":{"archive":null,"snapshot":"2025-07-28","note":"not in the Papers with Code archive (frozen at the snapshot)","row_kind":"graph","title_abstract_authors_date":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)"},"code_links":[],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2605.27631","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2605.27631"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/khangtran2020/pws","reach":null},{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/google/yapf","reach":null}],"summary":{"ran":7,"ran_draft_wrong":1,"unverified":3},"by_repo_kind":{"found_in_text":{"samples":11,"ran":8,"repositories":2}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":8,"samples":[{"code_sha256_prefix":"0bec690e657bd025","entry":"IsSurroundedByBrackets","repo":"google/yapf","repo_kind":"found_in_text","path":"yapf/yapflib/logical_line.py","file_url":"https://github.com/google/yapf/blob/HEAD/yapf/yapflib/logical_line.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"0bec690e657bd025"}},{"code_sha256_prefix":"b69103c46a9286b2","entry":"check_need_add_pass","repo":"khangtran2020/pws","repo_kind":"found_in_text","path":"src/style_inspect.py","file_url":"https://github.com/khangtran2020/pws/blob/HEAD/src/style_inspect.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"b69103c46a9286b2"}},{"code_sha256_prefix":"3a984e5673063d4f","entry":"construct_contract_prompt","repo":"khangtran2020/pws","repo_kind":"found_in_text","path":"src/generate.py","file_url":"https://github.com/khangtran2020/pws/blob/HEAD/src/generate.py","link_basis":"plan_row","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"3a984e5673063d4f"}},{"code_sha256_prefix":"14297b3d241e127b","entry":"extra_eos_for_direct_completion","repo":"khangtran2020/pws","repo_kind":"found_in_text","path":"src/model.py","file_url":"https://github.com/khangtran2020/pws/blob/HEAD/src/model.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"14297b3d241e127b"}},{"code_sha256_prefix":"8aa0d2b6a3c3b298","entry":"extract_out_code","repo":"khangtran2020/pws","repo_kind":"found_in_text","path":"src/style_inspect.py","file_url":"https://github.com/khangtran2020/pws/blob/HEAD/src/style_inspect.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"8aa0d2b6a3c3b298"}},{"code_sha256_prefix":"9c9baaca16b47819","entry":"get_indent","repo":"khangtran2020/pws","repo_kind":"found_in_text","path":"src/style_inspect.py","file_url":"https://github.com/khangtran2020/pws/blob/HEAD/src/style_inspect.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"9c9baaca16b47819"}},{"code_sha256_prefix":"fdd430b10250dc4c","entry":"make_chat_prompt","repo":"khangtran2020/pws","repo_kind":"found_in_text","path":"src/model.py","file_url":"https://github.com/khangtran2020/pws/blob/HEAD/src/model.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"fdd430b10250dc4c"}},{"code_sha256_prefix":"5bc6e69d2f799430","entry":"tokenize","repo":"khangtran2020/pws","repo_kind":"found_in_text","path":"src/vllm_pred.py","file_url":"https://github.com/khangtran2020/pws/blob/HEAD/src/vllm_pred.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"5bc6e69d2f799430"}},{"code_sha256_prefix":"671c10ffad825154","entry":"Get","repo":"google/yapf","repo_kind":"found_in_text","path":"yapf/yapflib/style.py","file_url":"https://github.com/google/yapf/blob/HEAD/yapf/yapflib/style.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"671c10ffad825154"}},{"code_sha256_prefix":"316c6d1ed5a0e404","entry":"GetOrDefault","repo":"google/yapf","repo_kind":"found_in_text","path":"yapf/yapflib/style.py","file_url":"https://github.com/google/yapf/blob/HEAD/yapf/yapflib/style.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"316c6d1ed5a0e404"}},{"code_sha256_prefix":"c974a57fa5eab89c","entry":"make_model","repo":"khangtran2020/pws","repo_kind":"found_in_text","path":"src/model.py","file_url":"https://github.com/khangtran2020/pws/blob/HEAD/src/model.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c974a57fa5eab89c"}}]},"arxiv_metadata":{"licence":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)","fields":["title","abstract","authors","date"],"primary_category":"cs.LG","source":"arxiv_2026.jsonl"},"syntology_extracted_results":null}