一句话：提出 CodeJailbreaker，把恶意意图隐式藏入 commit message 等隐蔽信道，绕过 LLM 代码生成的安全机制。
LLM 已被广泛用于 text-to-code 任务，但其生成代码的安全性尚未得到充分检验，已有工作多关注功能正确性。本文指出 LLM 的安全机制建立在指令遵循范式之上，恶意意图通常显式写在提示指令中，因而容易被检测与拦截。为此作者提出越狱方法 CodeJailbreaker：让提示中的指令本身保持良性，而把恶意意图隐式编码进隐蔽信道——即 commit message——从而绕过安全检查。在最新发布的 RMCBench 基准上，针对三种代码生成任务，CodeJailbreaker 的攻击有效性显著优于在指令中显式传达恶意意图的传统越狱策略。该工作挑战了 LLM 代码生成的传统安全范式，强调需要能防御隐式恶意线索的更强安全措施。
The proliferation of Large Language Models (LLMs) has revolutionized natural language processing and significantly impacted code generation tasks, enhancing software development efficiency and productivity. Notably, LLMs like GPT-4 have demonstrated remarkable proficiency in text-to-code generation tasks. However, the growing reliance on LLMs for code generation necessitates a critical examination of the safety implications associated with their outputs. Existing research efforts have primarily focused on verifying the functional correctness of LLMs, overlooking their safety in code generation. This paper introduces a jailbreaking approach, CodeJailbreaker, designed to uncover safety concerns in LLM-based code generation. The basic observation is that existing safety mechanisms for LLMs are built through the instruction-following paradigm, where malicious intent is explicitly articulated within the instruction of the prompt. Consequently, CodeJailbreaker explores to construct a prompt whose instruction is benign and the malicious intent is implicitly encoded in a covert channel, i.e., the commit message, to bypass the safety mechanism. Experiments on the recently-released RMCBench benchmark demonstrate that CodeJailbreaker markedly surpasses the conventional jailbreaking strategy, which explicitly conveys malicious intents in the instructions, in terms of the attack effectiveness across three code generation tasks. This study challenges the traditional safety paradigms in LLM-based code generation, emphasizing the need for enhanced safety measures in safeguarding against implicit malicious cues.
@inproceedings{abs-2503-17953,
title = {Smoke and Mirrors: Jailbreaking LLM-based Code Generation via Implicit Malicious Prompts},
author = {Sheng Ouyang and Yihao Qin and Bo Lin and Liqian Chen and Xiaoguang Mao and Shangwen Wang},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3764566}
}