Walking on Thin Ice?: Defending RAG-based Code Recommender Systems Against Poisoning Attacks

Abstract

Large Language Models (LLMs) have been extensively adopted in software engineering to automate various tasks, including code comment generation, debugging, testing, and most notably, code generation. Retrieval-Augmented Code Generation (RACG) further enhances LLMs by incorporating external code repositories at inference time, but this design also introduces a new systemlevel security risk: knowledge-base poisoning, where adversarial or vulnerable code is injected into the retrieval corpus to steer generation toward insecure implementations. In this paper, we address the problem of defending RACG system against poisoning attacks by proposing RAGGuard, a defense-oriented framework that explicitly accounts for the presence of untrusted retrieved code exemplars during code generation. Rather than assuming benign retrievals, RAGGuard introduces system-level defense mechanisms that mitigate vulnerabilities induced by poisoned exemplars in the retrieval-generation pipeline. RAGGuard is developed atop LLM-based agents where we proposed three defense strategies: Establishing a self-verifying workflow to autonomously assess and iteratively refine generated code for security under poisoned retrieval code exemplars.Leveraging security warnings to identify vulnerabilities embedded in retrieved code and prevent their propagation into generated outputs; and Embedding standardized vulnerability knowledge (e.g., CWE) to guide secure code refinement and reduce sensitivity to instance-level poisoning. We evaluate RAGGuard through an empirical study involving five LLMs, two large-scale benchmark datasets, and two poisoning scenarios, comparing against two baselines. The results show that RAGGuard consistently outperforms the baselines and substantially enhances code security, with the third strategy achieving secure-rate improvements ranging from 7.24% to 69.61% across programming languages, LLMs, and poisoning scenarios, while preserving functional correctness. These findings demonstrate the effectiveness of system-level defense mechanisms in mitigating retrieval-induced security risks in RAG-based code generation systems.