{"id":"7d19b086-64de-42b9-a658-484a97e00eee","arxiv_id":"2411.19508","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Appending LLM-generated misleading code snippets to coding prompts lowers pass@1 by 12-34% for open-source and 3-24% for commercial code LLMs; guided prompting restores only part of the loss.","lead":"Researchers built DegradePrompter, a method that uses GPT-4 to append small misleading code fragments to programming problems, and tested eight coding assistants on the modified prompts. Open-source models lost 12 to 34 percent of correct answers and commercial models lost 3 to 24 percent, showing that coding assistants can be quietly derailed by superficially harmless prompt changes.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"CDRA normalization, not inherent robustness, drives the open-vs-closed conclusion; absolute pass@1 drops show Claude and Gemini degrade as much as open-source models.","rationale":"The reader's named weakest assumption (the epsilon bound in Eq. 1 is not enforced by Eq. 6 and is only measured post hoc in Section 4) is valid and worth testing, but the more decisive problem sits directly in the paper's own tables: the primary open-vs-closed conclusion is an artifact of the CDRA normalization. CDRA is a legitimate relative-degradation metric, but the abstract and conclusion phrase the result as 'declines in functional correctness' and 'greater resilience,' which invites an absolute-degradation reading. On the absolute metric, commercial models on average lose as many or more pass@1 points than open-source models, and only GPT-4 is clearly robust. The paper therefore overstates its central comparative claim. This does not invalidate DegradePrompter as a black-box stress-testing method, nor the observation that most models are vulnerable; the data could support a revised conclusion such as 'all evaluated models degrade substantially; GPT-4 is unusually robust; no consistent open-versus-closed divide.' Because the flaw is in interpretation and analysis rather than in the underlying attack construction, a CONDITIONAL posture is retained rather than moving to REJECT, but the revision required is substantial: report absolute drops and confidence intervals, run a statistical comparison, and adjust the abstract accordingly.","tokens_in":14352,"tokens_out":10256,"duration_ms":88494,"concrete_test":"Recompute Tables 2 and 3 reporting both CDRA and absolute pass@1 drop per model, with bootstrap 95% confidence intervals from the per-problem pass@1 samples. Then compare the five open-source and three closed-source models using a non-parametric test on per-problem correctness deltas for HumanEval and MBPP. If the open-source versus closed-source ordering flips or is not significant under absolute drop, the abstract's commercial-resilience claim must be revised.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The headline comparison of open-source versus commercial resilience is computed with CDRA (Eq. 7), which normalizes the pass@1 loss by the clean pass@1. Because commercial models have much higher clean pass@1 scores, their relative CDRA is compressed even when the absolute loss of functional correctness is equal or larger. Recomputing Tables 2 and 3 as absolute pass@1 drops (pass@1(C) - pass@1(A)) gives HumanEval open-source mean drop 13.1 points (CodeLlama 10.2, DeepSeek 11.4, OctoCoder 12.2, Phind 12.7, WizardCoder 19.0) versus commercial mean drop 13.6 points (Claude 19.7, Gemini 18.6, GPT-4 2.5). On MBPP, open-source mean drop is 12.8 versus commercial 14.5. Claude 3 and Gemini 1.5 therefore lose more absolute correctness than most open-source models; the apparent commercial resilience is driven almost entirely by GPT-4. The abstract's '12%-34% versus 3%-24%' ranges are an artifact of the CDRA normalization and do not establish the stated open-vs-closed divide. The epsilon-enforcement issue in Section 3.2/4 is real, but this metric-interpretation problem is more directly load-bearing for the central claim.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper introduces DegradePrompter, a black-box method that uses GPT-4-turbo as an oracle to generate misleading suffixes appended to coding prompts, and evaluates eight instruction-tuned Code LLMs on HumanEval and MBPP using pass@1 and the CDRA metric. It reports that open-source models degrade by 12% to 34% while commercial models degrade by 3% to 24%, and it proposes a guided-prompting defense measured by ANR. The paper's central claim is that open-source Code LLMs are more susceptible to adversarial prompt perturbations than commercial models.","tokens_in":14617,"tokens_out":5401,"duration_ms":47920,"significance":"If the claims held, DegradePrompter would be a useful lightweight robustness benchmark for code LLMs: it is black-box, needs only a single forward pass through the oracle, is tested across several open and closed models, and includes both a handcrafted baseline and a defense. The tables do support the directional claim that DegradePrompter lowers pass@1 for most models, and the defense results are informative. However, the headline open-source-versus-commercial conclusion is not supported by the absolute performance drops in the paper's own tables; the study is better viewed as a per-model robustness measurement than as evidence of a systematic divide.","major_comments":[{"comment":"The central open-source-versus-commercial claim is an artifact of the CDRA normalization. Recomputing absolute pass@1 drops (pass@1(C) - pass@1(A)) under DegradePrompter from Tables 2 and 3 gives HumanEval mean drops of 13.1 percentage points for the five open-source models (10.2, 11.4, 12.2, 12.7, 19.0) versus 13.6 points for the three commercial models (19.7, 18.6, 2.5). On MBPP the means are 12.8 versus 14.5. Claude 3 and Gemini 1.5 therefore lose more absolute correctness than most open-source models, and the claimed open-vs-closed divide is driven by normalization by clean pass@1 combined with GPT-4's unusually small drop. The paper must either present absolute deltas as the primary evidence or justify explicitly why relative degradation is the appropriate measure for the resilience claim made in the abstract and conclusion.","section":"Section 4, Eq. (7), Tables 2-3"},{"comment":"The perturbation bound in the problem formulation is not enforced during attack generation. Equation (6) sets sadv = O(x) via a single forward pass through the oracle, and Section 4 reports only post-hoc average cosine distances (0.036 on HumanEval, 0.04 on MBPP) rather than using the distance constraint to filter or regenerate suffixes. The paper should state whether every adversarial prompt satisfies d(xadv, x) <= epsilon, report the fraction that do, and clarify how the epsilon thresholds affected construction. Without this, CDRA measures sensitivity to arbitrary appended suffixes rather than to perturbations verified to lie within the stated budget.","section":"Section 3.2, Eq. (6), and Section 4 (d and epsilon)"},{"comment":"GPT-4 serves as both the suffix-generation oracle (gpt-4-turbo) and one of the three commercial evaluation targets (gpt-4o). GPT-4 is also the only commercial model with a small absolute drop (2.5 points on HumanEval), and removing it makes the commercial mean absolute HumanEval drop 19.15 points, larger than the open-source mean of 13.1. The authors should either exclude GPT-4 from the target set, use a different oracle, or provide evidence that oracle-target overlap does not inflate the measured robustness of GPT-4; as it stands, the commercial-resilience conclusion rests substantially on this confounded data point.","section":"Section 3.2 and Table 3"},{"comment":"All pass@1, CDRA, and ANR values are reported as point estimates with no error bars, confidence intervals, or information about repeated runs or seeds. Because the open-versus-closed comparison hinges on mean absolute drops that are nearly equal (13.1 vs 13.6 on HumanEval), the absence of uncertainty quantification makes the comparative claim unverifiable. The paper should report standard errors, bootstrap confidence intervals, or at least the variance across n=10 samples per problem.","section":"Section 5, Tables 2-4"}],"minor_comments":[{"comment":"The text refers to 'Phind 33B' while Table 2 and Figure 2 list Phind 34B; the model size should be consistent.","section":"Section 5.1"},{"comment":"The paper says n=10 samples are generated to estimate pass@1 but does not specify the estimator used (e.g., the unbiased pass@1 estimator from Chen et al. or the pass rate of the first sample). This should be clarified for reproducibility.","section":"Section 4 (Decoding Parameters)"},{"comment":"The abstract's commercial degradation range of '3% to 24%' does not match the table values exactly: GPT-4 has CDRA 2.7% on HumanEval and Gemini 1.5 has 24.9% on HumanEval, so the stated bounds should be updated.","section":"Abstract and Section 5.2"},{"comment":"The oracle prompt instructs a limit of 1-3 inserted lines, but there is no validation that the oracle's output always complies; a sentence describing any post-processing or acceptance check would remove ambiguity.","section":"Section 3.2 (Prompt for generating adversarial coding prompts)"}],"recommendation":"major_revision","confidential_remarks":"The paper has a useful and cheap attack framework, and the per-model measurements are worth publishing after the claims are reoriented. The main fix is to stop framing the results as a clean open-source-versus-commercial divide; the absolute drops in the paper's own tables contradict that framing unless GPT-4 is treated as an exceptional case. The oracle-target overlap involving GPT-4 should be addressed head-on. No concerns about research integrity beyond the technical issues above."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"DegradePrompter is a simple and useful black-box attack generator for instruction-tuned code LLMs: use GPT-4 as an oracle to append 1-3 lines of misleading but contextually relevant code to a coding prompt. That idea is a reasonable extension of DeceptPrompt and ReCode, and the paper executes it competently across eight models, two benchmarks, plus a handcrafted baseline and a mitigation experiment. The tables give a directional picture that DegradePrompter degrades pass@1 for most models; I think that central observation is defensible.\n\nThe load-bearing problem is the headline claim. The abstract says open-source models degrade 12-34% while commercial models degrade 3-24%, but that comparison is built on CDRA, which normalizes the pass@1 loss by the clean pass@1. Commercial models have much higher clean scores, so their CDRA is compressed even when the absolute drop is equal or larger. Recomputing the numbers from Tables 2 and 3 as absolute pass@1 drops: on HumanEval the open-source mean drop is 13.1 points and the commercial mean drop is 13.6 (Claude 19.7, Gemini 18.6, GPT-4 2.5). On MBPP, open-source drops 12.8 points against commercial 14.5. So Claude 3 and Gemini 1.5 are not more resilient than open-source models; GPT-4 is the only commercial model that clearly stands out. The abstract's ranges do not establish the stated divide.\n\nThere are also two secondary issues. First, the epsilon constraint in Eq. 1 is not enforced during construction; Eq. 6 assumes a single oracle pass yields a suffix satisfying the bound, but the cosine distance is measured only after the fact. The reported average distances (0.036 and 0.04) are below the thresholds, so this is not fatal, but the attack is not truly bounded. Second, pass@1 and CDRA are point estimates with no error bars, confidence intervals, seeds, or repeated runs; the differences between some models could easily be noise. The reproducibility section promises code and data, but nothing is public yet.\n\nThis paper deserves a serious referee, not a desk reject. The attack is cheap, the empirical body is substantial, and the flaws are fixable. A revision should report absolute pass@1 drops alongside or instead of CDRA, add uncertainty measures, and either enforce the epsilon constraint during generation or drop the pretense of a bounded attack. With those changes it could be a solid workshop or short conference paper. The right audience is practitioners evaluating code assistants and researchers working on prompt robustness.\n\nSend it to peer review, but expect heavy revision.","headline":"A simple black-box attack worth knowing about, but the open-vs-closed robustness finding is an artifact of the CDRA normalization.","tokens_in":15140,"tokens_out":1813,"would_cite":false,"duration_ms":16943,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"DegradePrompter, a black-box attack that appends short misleading code snippets to coding prompts, cuts functional correctness by 12%–34% on open-source code models and by 3%–24% on commercial models.","keywords":["adversarial robustness","instruction-tuned Code LLMs","DegradePrompter","black-box attack","pass@1","CDRA","guided prompting defense","code generation"],"falsifier":"Re-run the HumanEval evaluation keeping only adversarial prompts whose cosine distance to the clean prompt is actually below $\\epsilon = 0.1$, discarding any that exceed it; if the filtered CDRA drops to the handcrafted baseline, the reported degradation is driven by unbounded prompt changes rather than the bounded adversarial perturbation the paper claims.","tokens_in":14124,"feed_emoji":"🤖","tokens_out":7389,"duration_ms":57396,"temperature":0.7,"pith_summary":"DegradePrompter is a black-box attack that tests how easily instruction-tuned code models can be misled: it asks a powerful helper model, GPT-4-turbo, to append a one-to-three-line misleading code snippet to a clean coding problem. The paper claims these small additions reduce pass@1 functional correctness by 12%–34% across five open-source models and by 3%–24% across three commercial models on HumanEval and MBPP. The importance is practical: AI coding assistants are being used in real software workflows, and the finding suggests subtle prompt changes can silently degrade the code they produce. The paper also tests a simple inference-time defense, guided prompting, and reports that it restores performance for some models but not others.","feed_headline":"Open-source code assistants lose 12-34% accuracy to misleading prompts","feed_subtitle":"A black-box attack appends one to three misleading lines; commercial models also drop up to 24%.","key_machinery":"The carrier of the argument is DegradePrompter, a black-box procedure in which an oracle language model $O$ (GPT-4-turbo) receives a coding problem and returns a short adversarial suffix $s_{adv}$ that is appended to the problem to form $x_{adv}$. The suffix is supposed to be contextually relevant, syntactically valid Python, and at most three lines. The paper measures the attack's force with CDRA, the fractional drop in pass@1 from clean to adversarial prompts, and evaluates the defense with ANR, the fraction of the lost performance that guided prompting restores. The same machinery is used across eight models and two benchmarks, so the empirical pattern—open-source models degrade more than commercial ones—is carried by these two metrics applied to the oracle-generated suffixes.","core_discovery":"On the paper's own terms, the central discovery is that instruction-tuned Code LLMs are substantially less robust to adversarial prompt perturbations than their clean benchmark scores suggest. Using DegradePrompter, an oracle LLM generates adversarial suffixes $s_{adv} = O(x)$ that are appended to the original prompt, and the correctness of the generated code is compared through pass@1 before and after the perturbation. The result is expressed as CDRA, the fractional drop in pass@1 under attack: open-source models show degradation from about 12% to 34%, while commercial models degrade from about 3% to 24%. The attack transfers across model families and does not require logits or gradients; a guided-prompting defense partially neutralizes the attack on some models, with ANR values above 50% on HumanEval for most models but negative for some models on MBPP.","pith_inferences":["Beyond the paper, the oracle-attack design suggests an iterative variant: feed the target model's failures back to the oracle to refine suffixes, which could produce stronger transfer attacks than a single forward pass.","Beyond the paper, the unenforced cosine-distance budget implies a cleaner protocol: filter suffixes by $\\epsilon$ before evaluation. If random suffixes at the same cosine distance cause similar CDRA, the reported degradation is a sensitivity effect rather than a tightly bounded adversarial effect.","Beyond the paper, the same prompt-level evaluation could be extended to natural-language-only perturbations and to non-Python languages, where instruction-tuned models may show different failure modes."],"forward_implications":["Open-source code assistants can silently fail on roughly a third of otherwise-solvable tasks when the prompt contains a short misleading snippet.","Black-box robustness evaluation is feasible without access to model internals: a single call to a strong helper model generates transferable adversarial suffixes.","Model family matters more than raw size: DeepSeek-Coder-Instruct is repeatedly the most resilient open-source family, while larger CodeLlama versions do not clearly beat the 7B model.","A cheap inference-time instruction emphasizing that distracting code should be ignored restores most lost accuracy for some models, including Phind 34B and Gemini 1.5, but fails or backfires on others.","Commercial models are not robust by default: GPT-4o still loses 13.9% on MBPP, and Claude 3 and Gemini 1.5 lose over 21% on both benchmarks."],"supporting_citations":[{"why":"Supplies the HumanEval benchmark and the pass@1 metric used to quantify functional correctness before and after attack.","marker":"[8]"},{"why":"Supplies the MBPP benchmark, the second dataset on which CDRA numbers are measured.","marker":"[5]"},{"why":"Defines the CodeLlama-Instruct models, one of the open-source families whose 12%–34% degradation supports the paper's main claim.","marker":"[22]"},{"why":"Defines the DeepSeek-Coder models, the most resilient open-source family and a key comparison point.","marker":"[13]"},{"why":"Defines WizardCoder models, which show the largest measured degradation under DegradePrompter on HumanEval.","marker":"[17]"},{"why":"Defines OctoCoder, an open-source model whose handcrafted-attack CDRA reaches 53.2% and is part of the robustness comparison.","marker":"[18]"},{"why":"Documents GPT-4, the oracle model used to generate the adversarial suffixes that drive the attack.","marker":"[20]"},{"why":"Provides ReCode, the prior robustness-evaluation framework for pre-trained code models that the paper contrasts with its instruction-tuned evaluation.","marker":"[24]"}],"fun_headline_variants":["Code LLMs fooled by appended prompts: open-source drop up to 34%","Misleading prompt lines cut code accuracy by up to 34% in open-source LLMs","Open-source code models swayed by adversarial prompt suffixes, study finds","Prompt attacks degrade open-source code models twice as much as commercial","Adversarial prompt suffixes rob open-source code LLMs of up to 34% accuracy"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method assumes that a single call to GPT-4-turbo reliably produces a small, contextually relevant suffix that stays within the stated perturbation budget, even though the budget is only checked after generation and is not enforced during creation.","fun_headline_variants_meta":{"raw":{"variants":["Code LLMs fooled by appended prompts: open-source drop up to 34%","Misleading prompt lines cut code accuracy by up to 34% in open-source LLMs","Open-source code models swayed by adversarial prompt suffixes, study finds","Prompt attacks degrade open-source code models twice as much as commercial","Adversarial prompt suffixes rob open-source code LLMs of up to 34% accuracy"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000222,"raw_usage":{"total_tokens":1436,"prompt_tokens":908,"completion_tokens":528,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":524,"completion_tokens_details":{"reasoning_tokens":424}},"tokens_in":524,"tokens_out":528,"duration_ms":4221,"temperature":1.0,"reasoning_tokens":424,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T10:07:37.638387+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the HumanEval evaluation keeping only adversarial prompts whose cosine distance to the clean prompt is actually below $\\epsilon = 0.1$, discarding any that exceed it; if the filtered CDRA drops to the handcrafted baseline, the reported degradation is driven by unbounded prompt changes rather than the bounded adversarial perturbation the paper claims.","supporting_citations":[],"review_version":1}