CodeSentinel: A Three-Layer Defense Against Indirect Prompt Injection in Code Contexts
For developers and users of code LLMs, it addresses a critical security vulnerability in code contexts where attackers can hide instructions in code elements.
CodeSentinel defends Code LLMs against indirect prompt injection by sanitizing external code context, achieving 0.80 average node-level F1 across six attack families, outperforming existing defenses.
Code large language models increasingly retrieve external code context from repositories, documentation, issue threads, and coding-agent environments, creating an indirect prompt-injection surface where attackers hide instructions in comments, strings, identifiers, or decoy code. We propose CodeSentinel, a three-layer inference-time sanitizer. It uses Tree-sitter to extract high-risk model-facing CST nodes, then combines syntax-guided pre-filtering, CST-guided Dynamic Min-K\% scoring, and node perturbation analysis to detect adversarial and natural-looking semantic triggers. Detected nodes are removed or neutralized before reaching the downstream Code LLM. Across six recent attack families, \CodeSentinel achieves 0.80 average node-level F1, outperforming CodeGarrison, DePA, and KillBadCode.