Recoleta
GitHub
Source note

Code-Poisoning Property Inference Attacks

Authors
Xukun Luan, Yuhui Gong, Gang Zhang, Zixuan Huang, Yuanguo Bi, Xuesong Li, et al.
Source
arXiv
Published
Collection
Software Intelligence
Code PoisoningProperty InferenceML SecurityPrivacy AttacksCoding Agents
Open arXivMarkdown source

Summary

CPPIA is a code-poisoning attack that makes machine-learning models reveal global properties of their private training data through label-only queries. The paper reports perfect property-inference accuracy without reducing task accuracy, shadow models, or requiring access to training data or model internals.

Problem

  • Existing property-inference attacks often require training-data access, model control, logits, or shadow models, and may reduce model accuracy or fail against defenses.
  • The problem matters because users increasingly adopt opaque code from repositories and coding agents to train models on sensitive data, creating a supply-chain path for dataset-level privacy leakage.

Approach

  • A malicious code provider publishes a repository or uses a coding agent to insert poisoned training code.
  • During training, the code embeds the target property into secret samples or model behavior while preserving the model's normal task performance.
  • After deployment, the attacker queries the model using those secret samples and decodes the returned top-1 labels to infer whether a property exists, distinguish property proportions, or estimate the property's size.
  • CPPIA assumes no access to the private training set, target model parameters, logits, or shadow models; the attacker receives only label-only black-box outputs.

Results

  • The paper reports 100% attack accuracy with no degradation in model accuracy.
  • Across 4 datasets, 8 model architectures, and 18 property types, CPPIA is reported to generalize across image generation, text-to-image, regression, and natural-language-processing tasks.
  • The method reportedly remains effective under 3 categories of defense mechanisms and requires minimal computational overhead without shadow models.
  • As a concrete estimation result, 10 synthetic samples reportedly suffice to infer a target property's proportion to 3 decimal places, regardless of training-set size.
  • The excerpt does not provide per-dataset metrics, baseline values, query counts, or numerical accuracy comparisons beyond these aggregate claims.

Link