⚒️ ImportSnare

ImportSnare: Directed "Code Manual" Hijacking in Retrieval-Augmented Code Generation

Official project page of ImportSnare

Python Rust JavaScript

LLM(GPT-4-mini) response includes hijecked package import statement — LLM(GPT-4-mini) response includes hijacked package (pandas -> pandas_v2) import statement with poisoned RAG document as context.

Copilot suggestion includes hijacked package import statement — Real-World Demo 1: VsCode Copilot suggestion includes hijacked package (numpy -> cumpy) import statement

Cursor suggestion includes hijacked package import statement (matplotlib_safe) — Real-World Demo 2: Cursor Agent code suggestion includes hijacked package (matplotlib -> matplotlib_safe) import statement

A real-world hijacked demo from Tencent Yuanbao with only one single poisoned page implanted. — Real-World Demo 3 (English Response): Tencent Yuanbao web-chat LLM (DeepSeek-r1) provides help regarding debug info in Python and suggests controlled package (faiss -> faiss_full) import statement with only one single poisoned page implanted (The suggested package is crafted and not real)

A real-world hijacked demo from Tencent Yuanbao with only one single poisoned page implanted. — Real-World Demo 4 (Chinese Response): Tencent Yuanbao web-chat LLM (Hunyuan) provides help regarding debug info in Python and suggests controlled package (faiss -> faiss_full) import statement with only one single poisoned page implanted (The suggested package and 'reference' link are crafted and not real)

📝 Notes

The Dataset and Benchmark will come soon!
More REAL-WORLD DEMOS will be shown here;

🙏 Acknowledgements

TBD