ML Security PapersTrain in Vain: Functionality-Preserving Poisoning to Prevent Unauthorized Use of Code Datasets
Yuan Xiao 1, Jiaming Wang 1, Yuchen Chen 1, Wei Song 2, Jun Sun 3, Shiqing Ma 4, Yanzhou Mu 1, Juan Zhai 4, Chunrong Fang 1, Jin Song Dong 5, Zhenyu Chen 1
2 University of New South Wales
3 Singapore Management University
Published on arXiv
2604.22291
Data Poisoning Attack
OWASP ML Top 10 — ML02
Training Data Poisoning
OWASP LLM Top 10 — LLM03
Key Finding
Achieves effective poisoning by contaminating only 10% of the dataset while maintaining 100% compilability and functional correctness, remaining robust against advanced sanitization techniques
FunPoison
Novel technique introduced
The widespread availability of large-scale code datasets has accelerated the development of code large language models (CodeLLMs), raising concerns about unauthorized dataset usage. Dataset poisoning offers a proactive defense by reducing the utility of such unauthorized training. However, existing poisoning methods often require full dataset poisoning and introduce transformations that break code compilability. In this paper, we introduce FunPoison, a functionality-preserving poisoning approach that injects short, compilable weak-use fragments into executed code paths. FunPoison leverages reusable statement-level templates with automatic repair and conservative safety checking to ensure side-effect freedom, while a type-aware synthesis module suppresses static analysis warnings and enhances stealth. Extensive experiments show that FunPoison achieves effective poisoning by contaminating only 10% of the dataset, while maintaining 100% compilability and functional correctness, and remains robust against various advanced code sanitization techniques.
Key Contributions
- Functionality-preserving poisoning framework that maintains 100% compilability and functional correctness while degrading CodeLLM training utility
- Template-based injection of execution-inert code fragments with automatic repair, conservative safety checking, and type-aware synthesis to ensure stealth and persistence
- Achieves effective poisoning with only 10% dataset contamination, robust against code sanitization techniques including detection, purification, rewriting, and static analysis
🛡️ Threat Analysis
Proposes a data poisoning defense that corrupts training data (code datasets) to degrade model performance during unauthorized fine-tuning. The poisoning targets the training data itself to reduce utility of unauthorized training.