Skip to content

Back to the catalog

github.comrepo

RepoGuardBench

RepoGuardBench is a benchmark and accompanying paper that measures whether local open-weight coding agents (Qwen2.5-Coder 1.5B-14B via Ollama) stay on the bug-fix task when repository artifacts — README files, issue text, code comments, test logs, and agent-rule files — carry inert prompt-injection instructions. It evaluates five lightweight context- and action-level defenses (D0-D5, including a path-only action gate) across seven metrics in a sandboxed task workspace, finding no statistically clear utility winner among them. The project ships a deterministic no-GPU smoke test, paper-claim verification scripts, and reproducible tables/figures under MIT (code) and CC BY 4.0 (data) licenses.

TL;DR A benchmark + paper testing whether local coding agents (Qwen2.5-Coder) get derailed by prompt injection hidden in repo files, and how well lightweight defenses hold up.
Open original ↗
Document

What it is

RepoGuardBench is a local benchmark (DL4C Workshop at ICML 2026, non-archival) that measures bug-fix utility and repository-borne prompt-injection robustness together for open-weight coding agents. The summary covers the shape; what it omits is how to run it, which defenses were actually evaluated, and the concrete boundaries of the claims.

How it works

Injection payloads are inert and deterministic: the benchmark can read a canary, write a marker, delete a test, run echo, or insert a benign comment. There is no real exploit, exfiltration, secret, or credential. The agent proposes one structured action per turn; a context defense (D0–D2) sits before the agent and an action defense (D3–D5) sits after, feeding a sandbox that enforces path containment, command allow/block lists, and environment scrubbing in an isolated per-run workspace.

What to do

No-GPU verification runs in seconds against a deterministic mock backend:

make setup        # editable install
make test         # unit tests; no GPU or network
make smoke        # end-to-end pipeline, mock backend
make verify-paper # verify released paper claims

For a real local model:

ollama pull qwen2.5-coder:1.5b
make smoke-local MODEL=qwen2.5-coder:1.5b

Regenerate artifacts with make reproduce-tables and make reproduce-figures. Full paper-scale replication (four Qwen2.5-Coder sizes, eight defenses, five carriers, cross-family pilots) needs one RTX 4080-class GPU with 16 GB VRAM and takes hours; commands are in docs/REPRODUCIBILITY.md.

Caveats

  • The headline "no clear utility winner" is precise: across the five primary defenses D0–D3 and D5 on a shared 18-task subset, every matched utility-delta confidence interval includes zero. (Note this differs from the summary's "D0–D5"; D4 is not in the primary set.)
  • The Applied tier is only 14 tasks; Core tasks are intentionally simple single-file probes. Attacks are non-adaptive, cross-family pilots are smaller than the main grid, and the defenses are lightweight baselines, not state-of-the-art.
  • The optional Claude reference uses a separate non-local harness, is excluded from the local aggregate, and requires your own API access.
  • Cite as a workshop presentation, not an ICML main-conference/PMLR paper.

Technologies named here

Techniques named here

  • Repository-borne prompt injection
  • Inert payloads

Related in AI Security