Walking on thin ice? Defending RAG-based code recommender systems against poisoning attacks

Large Language Models (LLMs) have been extensively adopted in software engineering to automate various tasks, including code comment generation, debugging, testing, and most notably, code generation. Retrieval-Augmented Code Generation (RACG) further enhances LLMs by incorporating external code repositories at inference time, but this design also introduces a new system-level security risk: knowledge-base poisoning, where adversarial or vulnerable code is injected into the retrieval corpus to steer generation toward insecure implementations. In this paper, we address the problem of defending RACG system against poisoning attacks by proposing RAGGuard , a defense-oriented framework that explicitly accounts for the presence of untrusted retrieved code exemplars during code generation. Rather than assuming benign retrievals, RAGGuard introduces system-level defense mechanisms that mitigate vulnerabilities induced by poisoned exemplars in the retrieval-generation pipeline. RAGGuard is developed atop LLM-based agents with three defense strategies: (i) Establishing a self-verifying workflow to autonomously assess and iteratively refine generated code for security under poisoned retrieval code exemplars; (ii) Leveraging security warnings to identify vulnerabilities embedded in retrieved code and prevent their propagation into generated outputs; and (iii) Embedding standardized vulnerability knowledge to guide secure code refinement and reduce sensitivity to instance-level poisoning. We evaluate RAGGuard through an empirical study involving five LLMs, and the results show that RAGGuard outperforms the baselines and enhances code security, with the third strategy achieving substantial secure-rate improvements, while preserving functional correctness. These findings demonstrate the effectiveness of system-level defense mechanisms in mitigating retrieval-induced security risks in RAG-based code generation systems.