CodeSentinel: A Three-Layer Defense Against Indirect Prompt Injection in Code Contexts

2026-06-17

AI Summary

This work addresses the vulnerability of large code models to indirect prompt injection attacks concealed in external contexts such as comments and string literals. To mitigate this threat, the authors propose CodeSentinel, a novel three-tier defense framework that integrates syntax-guided pre-filtering, concrete syntax tree (CST)-guided dynamic Min-K% scoring, and node perturbation analysis to accurately detect and neutralize semantic triggers. Leveraging Tree-sitter to extract high-risk CST nodes, CodeSentinel synergistically combines syntactic parsing, dynamic scoring, and perturbation-based detection. Evaluated against six state-of-the-art attack variants, the method achieves an average node-level F1 score of 0.80, substantially outperforming existing baselines including CodeGarrison, DePA, and KillBadCode.

Abstract

Code large language models increasingly retrieve external code context from repositories, documentation, issue threads, and coding-agent environments, creating an indirect prompt-injection surface where attackers hide instructions in comments, strings, identifiers, or decoy code. We propose CodeSentinel, a three-layer inference-time sanitizer. It uses Tree-sitter to extract high-risk model-facing CST nodes, then combines syntax-guided pre-filtering, CST-guided Dynamic Min-K\% scoring, and node perturbation analysis to detect adversarial and natural-looking semantic triggers. Detected nodes are removed or neutralized before reaching the downstream Code LLM. Across six recent attack families, \CodeSentinel achieves 0.80 average node-level F1, outperforming CodeGarrison, DePA, and KillBadCode.

Problem

• indirect prompt injection
• code large language models
• adversarial attacks
• code context
• security

Innovation

• indirect prompt injection
• code LLM security
• Tree-sitter
• CST-guided detection
• Dynamic Min-K% scoring