Paper Detail

CodeSentinel: A Three-Layer Defense Against Indirect Prompt Injection in Code Contexts

Po-Han Cheng, Chia-Mu Yu, Ying-Dar Lin, Yu-Sung Wu, Wei-Bin Lee

arxiv Score 8.3

Published 2026-06-17 · First seen 2026-06-18

General AI

Abstract

Code large language models increasingly retrieve external code context from repositories, documentation, issue threads, and coding-agent environments, creating an indirect prompt-injection surface where attackers hide instructions in comments, strings, identifiers, or decoy code. We propose CodeSentinel, a three-layer inference-time sanitizer. It uses Tree-sitter to extract high-risk model-facing CST nodes, then combines syntax-guided pre-filtering, CST-guided Dynamic Min-K\% scoring, and node perturbation analysis to detect adversarial and natural-looking semantic triggers. Detected nodes are removed or neutralized before reaching the downstream Code LLM. Across six recent attack families, \CodeSentinel achieves 0.80 average node-level F1, outperforming CodeGarrison, DePA, and KillBadCode.

Workflow Status

Review status
pending
Role
unreviewed
Read priority
soon
Vote
Not set.
Saved
no
Collections
Not filed yet.
Next action
Not filled yet.

Reading Brief

No structured notes yet. Add `summary_sections`, `why_relevant`, `claim_impact`, or `next_action` in `papers.jsonl` to enrich this view.

Why It Surfaced

No ranking explanation is available yet.

Tags

No tags.

BibTeX

@article{cheng2026codesentinel,
  title = {CodeSentinel: A Three-Layer Defense Against Indirect Prompt Injection in Code Contexts},
  author = {Po-Han Cheng and Chia-Mu Yu and Ying-Dar Lin and Yu-Sung Wu and Wei-Bin Lee},
  year = {2026},
  abstract = {Code large language models increasingly retrieve external code context from repositories, documentation, issue threads, and coding-agent environments, creating an indirect prompt-injection surface where attackers hide instructions in comments, strings, identifiers, or decoy code. We propose CodeSentinel, a three-layer inference-time sanitizer. It uses Tree-sitter to extract high-risk model-facing CST nodes, then combines syntax-guided pre-filtering, CST-guided Dynamic Min-K\textbackslash{}\% scoring, and node p},
  url = {https://arxiv.org/abs/2606.19235},
  keywords = {cs.CR},
  eprint = {2606.19235},
  archiveprefix = {arXiv},
}

Metadata

{}