New framework detects poisoned code-generation AI models with 97% accuracy

Code-generating large language models have become embedded in modern development pipelines, but researchers have found they are susceptible to backdoor and poisoning attacks that inject vulnerable or malicious code. Defending against these threats has proven difficult, particularly because traditional detection methods falter when the same logic appears in syntactically different forms.

The detection problem#

Existing scanning techniques rely on checking whether tokens remain consistent across multiple model generations—an unreliable approach for source code. In practice, semantically identical operations can be written in countless ways: a loop structure, variable naming scheme, or function call order might vary without changing what the code actually does. These surface-level differences blind current defenses, allowing poisoned patterns to evade detection.

How CodeScan works#

Researchers have unveiled CodeScan, a new black-box auditing framework designed specifically for code generation models. The approach operates without requiring internal access to the model, relying instead on the defender specifying which vulnerability classes matter and providing relevant task prompts.

The method works in stages:

• Structural analysis: CodeScan generates code multiple times using different clean prompts and compares the outputs for structural similarities rather than exact token matches.
• Abstraction through normalization: It employs abstract syntax trees (ASTs) to normalize code, stripping away syntactic variation and revealing patterns that recur consistently across generations.
• Vulnerability scanning: The framework then applies LLM-based analysis to determine whether the extracted patterns contain security vulnerabilities, flagging the model as compromised when dangerous structures are found.

Proven effectiveness#

Testing across 117 models spanning three different architectures and multiple size variations showed 97%+ detection accuracy against four representative attacks in both backdoor and poisoning scenarios. Across three real-world vulnerability classes, CodeScan achieved substantially fewer false positives than prior methods, making it a more practical tool for defenders.

The work, submitted to arXiv in March 2026 and revised in September, addresses a growing gap between the integration of code generation models into software development and the maturity of defenses against their compromise.