Code-Poisoning Property Inference Attacks

2026-07-17

AI Summary

Existing attribute inference attacks suffer from limitations in effectiveness, model accuracy preservation, computational overhead, and evasion of defenses. This work proposes CPPIA, the first code-level attribute inference attack, which embeds malicious logic into open-source or AI-generated code to implicitly encode global statistical properties of the training data into the target model without user awareness. CPPIA requires no shadow models, incurs minimal computational cost, preserves the target model’s utility, and successfully evades state-of-the-art defense mechanisms. Using only label-only API queries, it achieves 100% attack success across four datasets, eight model architectures, eighteen sensitive attributes, and three defense settings, demonstrating high accuracy, broad applicability, and remarkable efficiency.

Abstract

The flourishing code hosting platforms and coding agents enable even beginners with private data to build tailored Machine Learning (ML) models using available code quickly. The training data for ML models, often regarded as private property (e.g., clinical records, transaction information), is at significant risk of information leakage. Property Inference Attacks (PIAs), as a significant type of privacy attack, aim to expose global property information of the training set. In this paper, we present Code-Poisoning Property Inference Attack (CPPIA), the first code-level PIA, which overcomes four limitations of existing works: insufficient attack performance, severe degradation of model accuracy, high computational overhead, and failure under defenses. We consider malicious code providers from code hosting platforms (GitHub) and coding agents (Codex). Upon downloading the poisoned code, data holders train models with their private data without professional auditing, subsequently releasing label-only APIs to the public. The adversary embeds the properties into secret samples during training and queries the trained model on these samples later to leak privacy. CPPIA offers 100\% attack accuracy without degrading model accuracy. It is also computationally lightweight and requires no shadow models. We evaluate the attack performance across four datasets, eight model architectures, eighteen properties, and under three defense mechanisms, demonstrating the universality and effectiveness of CPPIA.

Problem

• Property Inference Attacks
• Code Poisoning
• Machine Learning Privacy
• Training Data Leakage
• Label-only API

Innovation

• Property Inference Attacks
• Code Poisoning
• Machine Learning Privacy
• Label-only API
• Poisoned Code