ai-research-survey

scan.json (30902B)

---

 {
   "paper": {
     "title": "ImportSnare: Directed \"Code Manual\" Hijacking in Retrieval-Augmented Code Generation",
     "authors": ["Kai Ye", "Liangcai Su", "Chenxiong Qian"],
     "year": 2025,
     "venue": "Conference on Computer and Communications Security",
     "arxiv_id": "2509.07941",
     "doi": "10.1145/3719027.3765161"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "ImportSnare demonstrates that poisoned documentation in RAG databases can induce LLMs to recommend malicious dependencies at >50% attack success rate for popular libraries like matplotlib and seaborn, even with poisoning ratios as low as 0.01% of the total database. The attack exploits a dual trust chain: LLM reliance on RAG-retrieved context and developers' blind trust in LLM suggestions. Cross-platform transferability is demonstrated across Python, Rust, and JavaScript with multiple open-source and closed-source LLMs including GPT-4o, DeepSeek-r1, and Claude 3.5 Sonnet.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper states 'Our datasets and artifacts are available to facilitate future research and reproducibility in our project homepage' and provides the URL https://importsnare.github.io/. However, the abstract says 'we will release' (future tense), creating ambiguity. A project homepage URL is provided."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The Availability section states datasets and artifacts are available at the project homepage. The RAG database sources and query datasets are from publicly available HuggingFace datasets listed in Table 10."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, or detailed environment specification is provided. The paper lists model names and attack parameters but does not provide sufficient detail to recreate the full software environment."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided in the paper. While a project homepage exists, the paper itself contains no README-style instructions or scripts for replicating experiments."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tables 1-4 and 6-7 are reported as point estimates (e.g., '0.677' ASR) with no confidence intervals or error bars."
       },
       "significance_tests": {
         "applies": true,
         "answer": true,
         "justification": "Table 5 uses Wilcoxon signed-rank tests with Bonferroni correction to assess whether code quality differences between poisoned and clean conditions are statistically significant."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 5 reports mean deviations from clean baselines (e.g., '-0.03', '+1.50') providing effect size context. Tables 1-2 report absolute ASR values and Precision@k which serve as interpretable effect sizes with baseline comparisons."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "No power analysis or justification for the number of test queries per target package. Some targets have as few as 8 test queries (e.g., requests with only 8 queries producing 0% ASR), yet no discussion of whether this is sufficient for reliable estimation."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No standard deviation or variance is reported across experimental runs. The authors set temperature=0 and seed=100 for deterministic outputs, but do not report sensitivity to these choices or variance across configurations."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 compares ImportSnare against four baselines: Naive (no ranking sequences), HotFlip, ReMiss, and ReMiss with ImportSnare-R integration."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "ReMiss (2024) is contemporary. HotFlip (2017) is older but is the foundational method for gradient-based token replacement and is appropriate as a retrieval attack baseline."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.4 provides comprehensive ablation: module ablation (R, G, R+G, G+R, R+G+R) in Figure 5, hyperparameter tuning (L, B, kb) in Figure 6, local proxy LLM selection in Table 3, and Precision@k ablation in Table 4."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Four evaluation metrics are used: Attack Success Rate (ASR), Precision@k, #Queries (proxy queries per poisoned document), and Average Processing Time (APT). Code quality is assessed via Bandit, Pylint, and Flake8."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation of attack stealth or output quality. All evaluation is automated: ASR counts import statement presence, Precision@k is computed from retrieval rankings, and code quality uses automated tools (Bandit, Pylint, Flake8)."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.2 states: 'This dataset was split 8:2 into proxy and test subsets. The 80% proxy queries were used to poison relevant database entries, while the 20% test queries were strictly held out for evaluation. Crucially, no overlap exists between proxy and test queries.'"
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down per target package (12 Python, 5 Rust, 4 JavaScript targets), per language, and per LLM model in Table 1. Transferability results are shown per retriever (Table 6) and per query language (Table 7)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The paper discusses failure cases: typosquatted names like 'requstss' achieve 0% ASR on most models due to LLMs' typo-correction capabilities. Known malicious packages (e.g., 'tn-moment') achieve poor ASR. JavaScript shows significantly lower ASR than Python/Rust."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Several negative results are reported: requests/requstss achieves 0% ASR on most models (Table 1), collections/collection-strong achieves 0% on DeepSeek models, and JavaScript targets generally show low ASR. Cross-retriever transfer degrades significantly for some models (Table 6)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims are supported: '>50% for popular libraries such as matplotlib and seaborn' is confirmed in Table 1 (matplotlib_safe: 67.7% on GPT-4o-mini; malware_seaborn: 53.3% on GPT-4o). 'Poisoning ratio as low as 0.01%' is supported by Figure 4."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims (e.g., 'component R enhances retrieval ranking', 'component G improves ASR') are supported by controlled ablation studies in Figure 5 that systematically add/remove components while holding others constant."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title and conclusions make broad claims about 'critical supply chain risks in LLM-powered development' and the need to 'rethink security protocols for LLM-RAG systems.' While the paper tests three languages and several LLMs, the evaluation uses specific datasets and a simplified RAG setup. Section 7.2 acknowledges the gap from real-world systems but the framing remains broad."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not systematically discuss alternative explanations for the attack's success. Section 7.1 discusses LLM trust in RAG documents but does not consider whether other factors (e.g., dataset-specific artifacts, model-specific prompt sensitivity) could explain the results. No robustness checks against confounds."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": false,
         "justification": "ASR measures whether the target library name appears in an import statement, but the paper frames this as a supply chain attack. The gap between 'LLM outputs an import statement' and 'developer installs and uses a malicious package' is acknowledged in the attack chain (Figure 1) but not explicitly discussed as a proxy-outcome limitation."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "Models are listed as marketing names: 'GPT-4-Turbo', 'GPT-4o', 'GPT-4o-mini', 'DeepSeek V3', 'DeepSeek R1', 'Claude 3.5 Sonnet', 'LLama3.2-3B'. No snapshot dates or API versions are provided for any model."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A.4 provides the full prompt template used for LLM code generation queries, with [context] and [question] placeholders. The inductive suggestion texts are provided in Table 8 and Appendix A.2."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.5 reports: temperature=0, seed=100, maximum sequence length L=20, beam width B=10, top candidates kb=15, iterations N=50, research iterations N'=25. Section 5.4 lists contriever models and their defaults."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The system is a standard RAG pipeline (retriever + LLM generator) without agents, tool use, retry logic, or memory management."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 3 states documents are split into 1024-token segments. Section 4.2 describes how proxy queries map to documents via bidirectional retrieval. Section 5.2 describes the 80/20 proxy/test split. Table 10 lists all dataset sources."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 'Discussion' contains substantive discussion of threats, real-world implications (7.2), programming language limitations (7.3), and ethics (7.4), serving as a comprehensive limitations section."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Section 7.2 discusses specific threats: 'our evaluation includes as many datasets to form the RAG database, it remains far from real-world RAG systems'; reranking mechanisms may degrade transferability; code comments in LLM output could alert users. These are specific to this study."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 7.2 explicitly states the evaluation 'remains far from real-world RAG systems, and approximating their scale is impractical.' Section 7.3 acknowledges other programming languages face different risk profiles. Table 9 explains why certain languages were excluded."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": true,
         "justification": "The paper states datasets and artifacts are available at the project homepage (https://importsnare.github.io/). The RAG database sources are publicly available HuggingFace datasets listed in Table 10."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.2 describes dataset composition: RAG databases from HuggingFace code datasets, query datasets from specific sources per language. Table 10 lists all sources with URLs. Table 1 shows poisoning ratios for each target."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data sources are standard public code datasets and benchmarks."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline is documented: datasets are collected from listed sources, documents are split into 1024-token segments, proxy queries retrieve relevant documents, documents are poisoned with ranking and inducing sequences, and test queries evaluate the attack. Poisoning ratios are reported in Table 1."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Acknowledgments section states: 'This work is partially supported by the NSFC for Young Scientists of China (No.62202400) and the RGC for Early Career Scheme (No.27210024).'"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All three authors are affiliated with The University of Hong Kong. They are not evaluating their own commercial product, so no conflict of interest with evaluated systems."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "NSFC and RGC are government research funding agencies with no financial stake in the outcome of the attack evaluation."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial disclosure statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper evaluates an attack framework's effectiveness, not model capability on benchmarks. The core evaluation measures whether poisoned documents can induce malicious dependency recommendations, which is a defense/attack test rather than a model knowledge evaluation."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Same rationale: the paper tests an attack mechanism rather than evaluating pre-trained model knowledge on a benchmark."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Same rationale: the paper tests an attack mechanism rather than evaluating pre-trained model knowledge on a benchmark."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The paper discusses ethics (Section 7.4) regarding responsible disclosure of the attack, not human subjects."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Average Processing Time (APT) per document is reported in Table 3 (e.g., 519.06s for matplotlib with LLama3.2-3B). This measures the practical cost of constructing poisoned documents."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget is stated. The paper does not report GPU hours, total API spend, or total hardware resources used for the full evaluation across all experiments."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "Results are reported with a single seed (seed=100) and temperature=0. No analysis of sensitivity to different seeds or stochastic settings is provided."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is not explicitly stated. Setting temperature=0 and seed=100 implies single deterministic runs, but this is not explicitly confirmed."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "While ablation studies explore hyperparameter effects (Figure 6), the total search budget (number of configurations tried, compute spent on search) is not reported."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.4 states: 'our default hyperparameter selection balances the largest feasible combination supported by the experimental equipment with acceptable efficiency, avoiding excessive slowdown.' The rationale is practical resource constraints."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": true,
         "justification": "Table 5 applies Bonferroni correction for multiple comparisons in the Wilcoxon signed-rank tests, with adjusted alpha values (alpha'=alpha/m)."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors implement baselines (HotFlip, ReMiss) themselves and compare against their own system without acknowledging potential self-comparison bias. No independent evaluation or discussion of this bias."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "APT is reported per model configuration (Table 3) but performance is not systematically reported as a function of compute budget. Baselines and ImportSnare are not compared at matched compute."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether ASR on their benchmark setup actually measures real-world attack risk. Section 7.2 acknowledges the gap between experimental and real-world RAG systems but does not question the construct validity of their metrics."
       },
       "scaffold_confound_addressed": {
         "applies": true,
         "answer": true,
         "justification": "Table 6 evaluates cross-retriever transferability (gte-base, all-mpnet, bge-base, e5-base), separating retriever effects from LLM effects. Multiple RAG system configurations are tested (LlamaIndex, LangGraph referenced)."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether query datasets (e.g., BigCodeBench) or RAG database contents existed before model training cutoffs. Models like GPT-4o may have been trained on these public datasets."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information. The RAG context provides documents that may contain hints beyond what a realistic retrieval scenario would surface."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "While the 80/20 proxy/test split ensures no overlap between proxy and test queries, independence of test queries from model training data is not discussed. Public datasets used for queries may overlap with LLM training data."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete leakage detection or prevention method is applied. No canary strings, membership inference, or decontamination pipelines are used."
       }
     }
   },
   "claims": [
     {
       "claim": "ImportSnare achieves attack success rates exceeding 50% for popular libraries such as matplotlib and seaborn.",
       "evidence": "Table 1 shows matplotlib_safe achieves 67.7% ASR on GPT-4o-mini and 93.5% on LLama3.2-3B. Seaborn variants achieve up to 66.7% (seaborn_v2 on LLama3.2-3B) and 53.3% (malware_seaborn on GPT-4o). Section 6.1.",
       "supported": "strong"
     },
     {
       "claim": "The attack can succeed with poisoning ratios as low as 0.01% of the total RAG database.",
       "evidence": "Figure 4 shows ASR improvement emerging when poisoning exceeds 3% of relevant documents (0.01% of total documents) for matplotlib_safe targeting DeepSeek-v3. Section 6.3.",
       "supported": "moderate"
     },
     {
       "claim": "ImportSnare outperforms all baselines (Naive, HotFlip, ReMiss) across all target packages.",
       "evidence": "Table 2 compares ImportSnare against baselines on GPT-4o-mini. ImportSnare achieves higher or comparable ASR on all 12 target packages. For matplotlib_safe: Naive 0.194, HotFlip 0.387, ImportSnare 0.677. Section 6.2.",
       "supported": "strong"
     },
     {
       "claim": "Poisoned documentation does not significantly degrade code generation quality.",
       "evidence": "Table 5 shows Wilcoxon signed-rank tests with Bonferroni correction find no statistically significant difference between poisoned and clean conditions for security issues, severity, Pylint score, or Flake8 errors. Section 6.5.",
       "supported": "moderate"
     },
     {
       "claim": "The framework demonstrates cross-platform transferability across RAG systems and LLM architectures.",
       "evidence": "Table 6 shows cross-retriever results (attack still succeeds with different retrievers though at reduced rates). Table 7 shows cross-lingual query transferability. Table 1 shows results across 7 target LLMs. Section 6.6.",
       "supported": "moderate"
     },
     {
       "claim": "Claude-3.5-Sonnet exhibits unusually high ASR against Rust-related poisoning despite superior general code generation performance.",
       "evidence": "Table 1 shows Claude-3.5-Sonnet achieves 70.0% (ndarray_v2), 50.0% (regex_safe), 72.2% (rocket_safe), 95.9% (rsscraper), and 51.2% (serde_json_safe) ASR on Rust targets, all higher than other closed-source models. Section 6.1.",
       "supported": "strong"
     }
   ],
   "red_flags": [
     {
       "flag": "No error bars or variance reporting",
       "detail": "All main results (Tables 1-4, 6-7) report single point estimates with no confidence intervals, error bars, or variance measures. With temperature=0 this is deterministic, but sensitivity to seed choice, query sampling, or minor parameter changes is unknown."
     },
     {
       "flag": "Proxy-outcome gap not acknowledged",
       "detail": "ASR measures whether a target package name appears in an import statement, but the paper frames this as a full supply chain attack. The gap between 'LLM generates import statement' and 'developer installs malicious package and gets compromised' involves multiple human decision points that are assumed away rather than studied."
     },
     {
       "flag": "Lab setup significantly differs from real-world RAG systems",
       "detail": "The authors acknowledge their setup 'remains far from real-world RAG systems.' Real systems use reranking, larger corpora, and more complex retrieval pipelines. The reported ASR may not transfer to production systems, but the paper's framing suggests immediate practical concern."
     },
     {
       "flag": "Small sample sizes for some targets",
       "detail": "Some target packages have very few test queries (e.g., requests with only ~8 queries showing 0% ASR on most models). With such small N, single-query differences could substantially change reported ASR, making these results unreliable."
     },
     {
       "flag": "No model version specifications",
       "detail": "All models are referenced by marketing names without snapshot dates or API versions. Model behavior can change across versions, making results non-reproducible against the same model configurations."
     }
   ],
   "cited_papers": [
     {
       "title": "Evaluating large language models trained on code",
       "authors": ["Mark Chen", "Jerry Tworek", "Heewoo Jun"],
       "year": 2021,
       "arxiv_id": "2107.03374",
       "relevance": "Foundational work on LLM code generation evaluation (HumanEval benchmark) and dependency monopolization observations."
     },
     {
       "title": "PoisonedRAG: Knowledge poisoning attacks to retrieval-augmented generation of large language models",
       "authors": ["Wei Zou", "Runpeng Geng", "Binghui Wang", "Jinyuan Jia"],
       "year": 2024,
       "arxiv_id": "2402.07867",
       "relevance": "Prior RAG poisoning work that ImportSnare extends; used as a baseline comparison for attack methodology."
     },
     {
       "title": "CodeRAG-Bench: Can retrieval augment code generation?",
       "authors": ["Zora Zhiruo Wang", "Akari Asai", "Xinyan Velocity Yu"],
       "year": 2024,
       "arxiv_id": "2406.14497",
       "relevance": "Benchmark for retrieval-augmented code generation, directly relevant to the RACG attack surface studied."
     },
     {
       "title": "Security Attacks on LLM-based Code Completion Tools",
       "authors": ["Wen Cheng", "Ke Sun", "Xinyu Zhang", "Wei Wang"],
       "year": 2025,
       "relevance": "Related security attack work on LLM code completion tools, demonstrating supply chain risks in code generation."
     },
     {
       "title": "Exploring the Security Threats of Knowledge Base Poisoning in Retrieval-Augmented Code Generation",
       "authors": ["Bo Lin", "Shangwen Wang", "Liqian Chen", "Xiaoguang Mao"],
       "year": 2025,
       "arxiv_id": "2502.03233",
       "relevance": "Concurrent work exploring similar RAG code generation security threats, directly related attack surface research."
     },
     {
       "title": "A survey on large language model (llm) security and privacy: The good, the bad, and the ugly",
       "authors": ["Yifan Yao", "Jinhao Duan", "Kaidi Xu"],
       "year": 2024,
       "relevance": "Survey of LLM security challenges relevant to understanding code generation safety landscape."
     },
     {
       "title": "BigCodeBench: Benchmarking code generation with diverse function calls and complex instructions",
       "authors": ["Terry Yue Zhuo"],
       "year": 2024,
       "arxiv_id": "2406.15877",
       "relevance": "Used as both RAG database source and query dataset source for Python experiments in ImportSnare evaluation."
     },
     {
       "title": "Backstabber's knife collection: A review of open source software supply chain attacks",
       "authors": ["Marc Ohm", "Henrik Plate", "Arnold Sykosch", "Michael Meier"],
       "year": 2020,
       "relevance": "Foundational taxonomy of software supply chain attacks used to inform malicious package naming strategies."
     },
     {
       "title": "DeepSeek-r1: Incentivizing reasoning capability in LLMs via reinforcement learning",
       "authors": ["Daya Guo", "Dejian Yang"],
       "year": 2025,
       "arxiv_id": "2501.12948",
       "relevance": "One of the primary target LLMs evaluated in the attack experiments, representing SOTA reasoning models."
     },
     {
       "title": "Retrieval-augmented generation for knowledge-intensive NLP tasks",
       "authors": ["Patrick Lewis", "Ethan Perez", "Aleksandra Piktus"],
       "year": 2020,
       "relevance": "Foundational RAG paradigm paper underlying the RACG systems that ImportSnare attacks."
     },
     {
       "title": "HotFlip: White-box adversarial examples for text classification",
       "authors": ["Javid Ebrahimi", "Anyi Rao", "Daniel Lowd", "Dejing Dou"],
       "year": 2017,
       "arxiv_id": "1712.06751",
       "relevance": "Baseline method adapted for the retrieval-oriented ranking sequence attack in ImportSnare-R."
     },
     {
       "title": "Wolves in the Repository: A Software Engineering Analysis of the XZ Utils Supply Chain Attack",
       "authors": ["Piotr Przymus", "Thomas Durieux"],
       "year": 2025,
       "relevance": "Real-world supply chain attack case study informing the threat model for dependency hijacking attacks."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Relevant to RAG system developers and security teams but not an immediately usable defensive tool."
     },
     "surprise_contrarian": {
       "score": 2,
       "justification": "Reveals a novel attack surface in RACG that challenges assumptions about RAG system safety."
     },
     "fear_safety": {
       "score": 3,
       "justification": "Demonstrates a practical supply chain attack against popular AI coding tools (Copilot, Cursor) with real-world demos."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "No direct controversy, but implicitly critiques LLM vendors' safety alignment for code generation."
     },
     "demo_ability": {
       "score": 1,
       "justification": "Project homepage exists with datasets but no turnkey demo; reproducing the attack requires significant setup."
     },
     "brand_recognition": {
       "score": 2,
       "justification": "Attacks well-known products (GPT-4o, Claude, DeepSeek, Copilot, Cursor) which drives attention."
     }
   }
 }