Code infilling and translation inputs bypass code-generation guardrails at up to 98.9% ASR without any explicit natural-language malware request

Auto-published from arXiv:2609.09798 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.75, flags: [no-prompt-excerpt])

Category

jailbreak

Model

CodeLlama-13B-Instruct, DeepSeekCoder-V2-Lite-16B (most vulnerable); guardrails: LlamaGuard4-v2-24B, WildGuard, NemoGuard, MDJudge, Qwen3Guard

Surface

API / code-generation pipeline with guardrail wrapper

Setup

Prompts are code-context inputs with no natural-language malware request: (a) code infilling — a partial malware snippet with a blank; (b) code translation — malware in language A to be translated to language B; (c) code completion — a partial malware function. 331 prompts total: 80 infilling and 91 translation from RMCBench, 160 completion from Redcode-Gen, spanning 9 programming languages. No verbatim prompt excerpt is published in the paper.

Reproduction anchor

benchmark: CS-Guard code-to-code split (n=331); source datasets RMCBench and Redcode-Gen are publicly available; paper states data will be released but no repository URL is present

Observed behavior

Base LLMs produce malware at 52.5%-98.9% average ASR. With guardrails, input classifiers pass 22.5%-45.0% of infilling/translation prompts; many guardrails remain at 14.4% to nearly 100% ASR. CodeLlama-13B-Instruct and DeepSeekCoder-V2-Lite-16B show especially high vulnerability. Infilling and translation tasks see near-total bypass.

Expected behavior

A guardrail should detect that a partial malware snippet or a malware translation request involves harmful code and refuse regardless of whether natural-language framing is benign.

Reproducibility

medium

Threat model

Attackers targeting coding assistants can submit malware fragments as routine infilling or translation tasks — bypassing guardrails that scan natural-language intent but do not semantically analyze code content — to reliably obtain complete functional malware from enterprise or consumer coding APIs.

Novelty

First benchmark isolating code-to-code inputs as a distinct guardrail-evasion surface; demonstrates that virtually all tested guardrails fail when malware is presented as code context rather than natural-language request.

Source

• arXiv: 2609.09798
• PDF: https://arxiv.org/pdf/2609.09798
• Categories: cs.CR, cs.AI
• Authors: Jinyang Li, Mingyu Guo, Hung X. Nguyen

Triage notes (auto)

• paperType: benchmark
• estimatedCaseCount: 3
• triage reason: Systematic benchmark of LLM code-generation vulnerabilities with 1000+ malware prompts, 7 jailbreak techniques, and a novel fictional-scenario attack (FSA); demonstrates ~50–100% attack success rates across 9 guardrails and 7 LLMs.

─────────────────────────────────────────────────────────────────────