---
title: "Train in Vain — paper by Xiao et al. (2026) — summary and ideas"
description: "To build these fragments, it extracts statements from real-world Java code, repairs them until they compile on their own… 27 references."
authors: ["Yuan Xiao", "Jiaming Wang", "Yuchen Chen", "Wei Song", "Jun Sun", "Shiqing Ma", "Yanzhou Mu", "Juan Zhai", "Chunrong Fang", "Jin Song Dong", "Zhenyu Chen"]
year: 2026
venue: "Findings of the Association for Computational Linguistics: ACL 2026"
source: "https://aclanthology.org/2026.findings-acl.1564/"
doi: "10.18653/v1/2026.findings-acl.1564"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/xiao-2026-train-vain-functionality-preserving-poisoning/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/xiao-2026-train-vain-functionality-preserving-poisoning/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/54/) / Train in Vain: Functionality-Preserving Poisoning to Prevent Unauthorized Use of Code Datasets

# Train in Vain: Functionality-Preserving Poisoning to Prevent Unauthorized Use of Code Datasets

**Authors:** Yuan Xiao, [Jiaming Wang](https://md.research.elamur.ai/free/en/authors/jiaming-wang/), Yuchen Chen, [Wei Song](https://md.research.elamur.ai/free/en/authors/wei-song/), [Jun Sun](https://md.research.elamur.ai/free/en/authors/jun-sun/), [Shiqing Ma](https://md.research.elamur.ai/free/en/authors/shiqing-ma/), Yanzhou Mu, [Juan Zhai](https://md.research.elamur.ai/free/en/authors/juan-zhai/), [Chunrong Fang](https://md.research.elamur.ai/free/en/authors/chunrong-fang/), [Jin Song Dong](https://md.research.elamur.ai/free/en/authors/jin-song-dong/) and [Zhenyu Chen](https://md.research.elamur.ai/free/en/authors/zhenyu-chen/) · **Year:** 2026 · **Venue:** [Findings of the Association for Computational Linguistics: ACL 2026](https://md.research.elamur.ai/free/en/venues/findings/) ([Findings of the Association for Computational Linguistics 2026](https://md.research.elamur.ai/free/en/venues/findings/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.findings-acl.1564/) · [PDF](https://aclanthology.org/2026.findings-acl.1564.pdf) · [DOI 10.18653/v1/2026.findings-acl.1564](https://doi.org/10.18653/v1/2026.findings-acl.1564) · [OpenAlex](https://openalex.org/W7166834471)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
Public code corpora are often used to fine-tune code LLMs without their authors' consent. Dataset poisoning can discourage this by making such training unprofitable. The only earlier untargeted method for code, CoProtector, has two main weaknesses. Its edits either break compilation or only touch comments, and it works only when the entire dataset is poisoned. FunPoison addresses this by inserting short, compilable "weak-use" fragments into code paths that actually execute, while leaving program behavior unchanged. To build these fragments, it extracts statements from real-world Java code, repairs them until they compile on their own (checked with javac) and anonymizes their variables. A conservative filter then discards fragments that could cause side effects. At injection time, a type-aware synthesis step adds statements that keep types correct and stop static analyzers from flagging or removing the inserts. Poisoning just 10% of a dataset is enough to cancel the gains of unauthorized fine-tuning, with 100% compilability and functional correctness. The method also holds up against detection, purification, rewriting, static-analysis and formatting defenses. This makes poisoning a usable, technically enforceable way to protect code datasets.

## Key points
- CoProtector uses four transformations: code corruption (CC), code splicing (CS), code renaming (CR) and comment semantic reversal (CSR). CC, CS and CR leave nearly no code compilable, and the method stops deterring once poisoning is partial.
- FunPoison works in two stages:
  - **Template generation:** statement extraction, compilation repair and conflict-aware name handling.
  - **Controlled injection:** safety filtering, choice of execution-safe insertion sites and weak-use synthesis.
- Quality preservation was compared on fully poisoned inputs: 984 samples, made by duplicating the 164-task Java subset of HumanEval-X six times.
- A controlled DeadBranchInsertion ablation indicates the damage comes from supervision on execution paths, not from the templates merely appearing in the data.
- Scope limits:
  - The evaluation covers only Java and only code generation.
  - Not every function can be poisoned: 80.3% of CodeSearchNet Java functions offer valid insertion sites.
  - The authors claim practical rather than theoretical resistance to removal.
  - They advise against using the method by default on open collaborative datasets.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [National University of Singapore](https://md.research.elamur.ai/free/en/universities/national-university-of-singapore/) — University, Singapore, Singapore · 207 works · 39,576 citations
- [University of Massachusetts Amherst](https://md.research.elamur.ai/free/en/universities/university-of-massachusetts-amherst/) — University, Amherst Center, United States · 114 works · 68,731 citations
- [Nanjing University](https://md.research.elamur.ai/free/en/universities/nanjing-university/) — University, Nanjing, China · 99 works · 8,510 citations
- [Singapore Management University](https://md.research.elamur.ai/free/en/universities/singapore-management-university/) — University, Singapore, Singapore · 35 works · 2,457 citations
- [UNSW Sydney](https://md.research.elamur.ai/free/en/universities/unsw-sydney/) — University, Sydney, Australia · 36 works · 1,509 citations

📚 Shelves (3): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [🗄️ Information Systems](https://md.research.elamur.ai/free/en/shelves/computer-science/information-systems/) · 1,730 works

## Cite

Cite as: Yuan Xiao, Jiaming Wang, Yuchen Chen, Wei Song, Jun Sun, Shiqing Ma, Yanzhou Mu, Juan Zhai, Chunrong Fang, Jin Song Dong and Zhenyu Chen. 2026. Train in Vain: Functionality-Preserving Poisoning to Prevent Unauthorized Use of Code Datasets. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{xiao2026train,
  title = {{Train in Vain: Functionality-Preserving Poisoning to Prevent Unauthorized Use of Code Datasets}},
  author = {Yuan Xiao, Jiaming Wang, Yuchen Chen, Wei Song, Jun Sun, Shiqing Ma, Yanzhou Mu, Juan Zhai, Chunrong Fang, Jin Song Dong and Zhenyu Chen},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.1564},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.1564}
}
```

- [← previous Tracking the Evolution of Foresight Signals in News Data: The Case of the European Electric Vehicle Market](https://md.research.elamur.ai/free/en/papers/navasartian-2026-tracking-evolution-foresight-signals-news/)
- [next → Training Biomedical Retrievers From Large-Scale Citation Contexts](https://md.research.elamur.ai/free/en/papers/wang-2026-training-biomedical-retrievers-large-scale/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/54/)

## References

27 references, 7 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. GitHub Inc. 2025. Codeql: Code analysis engine. [https://codeql.github.com/](https://codeql.github.com/). Accessed: 2025. [↗](https://codeql.github.com/)
2. Inc. Amazon Web Services. 2023. CodeWhisperer. site: [https://aws.amazon.com/codewhisperer/](https://aws.amazon.com/codewhisperer/). [↗](https://aws.amazon.com/codewhisperer/)
3. Daya Guo, Qihao Zhu, Dejian Yang, Zhenda Xie, Kai Dong, Wentao Zhang, Guanting Chen, Xiao Bi, Y. Wu, Y. K. Li, Fuli Luo, Yingfei Xiong, and Wenfeng Liang. 2024. Deepseek-coder: When the large language model meets programming - the rise of code intelligence. arXiv, abs/2401.14196. [find](https://scholar.google.com/scholar?q=Daya+Guo%2C+Qihao+Zhu%2C+Dejian+Yang%2C+Zhenda+Xie%2C+Kai+Dong%2C+Wentao+Zhang%2C+Guanting+Chen%2C+Xiao+Bi%2C+Y%2E+Wu%2C+Y%2E+K%2E+Li%2C+Fuli+Luo%2C+Yingfei+Xiong%2C+and+Wenfeng+Liang%2E+2024%2E+Deepseek%2Dcoder%3A+When+the+large+language)
4. Hamel Husain, Ho-Hsiang Wu, Tiferet Gazit, Miltiadis Allamanis, and Marc Brockschmidt. 2019. [Codesearchnet challenge: Evaluating the state of semantic code search](https://md.research.elamur.ai/free/en/papers/husain-2020-codesearchnet-challenge-evaluating-state-semantic/). arXiv, abs/1909.09436.
5. JaCoCo. 2025. Jacoco java code coverage library. [https://www.jacoco.org/jacoco/](https://www.jacoco.org/jacoco/). Version 0.8.11, Accessed: 2025-09-11. [↗](https://www.jacoco.org/jacoco/)
6. Legal.io. 2024. Judge throws out majority of claims in github copilot lawsuit. Accessed: 2025-09-04. [find](https://scholar.google.com/scholar?q=Legal%2Eio%2E+2024%2E+Judge+throws+out+majority+of+claims+in+github+copilot+lawsuit%2E+Accessed%3A+2025%2D09%2D04%2E)
7. Raymond Li, Loubna Ben Allal, Yangtian Zi, Niklas Muennighoff, Denis Kocetkov, Chenghao Mou, Marc Marone, Christopher Akiki, Jia Li, Jenny Chim, and 1 others. 2023. Starcoder: may the source be with you! Transactions on Machine Learning Research, 2023. [find](https://scholar.google.com/scholar?q=Raymond+Li%2C+Loubna+Ben+Allal%2C+Yangtian+Zi%2C+Niklas+Muennighoff%2C+Denis+Kocetkov%2C+Chenghao+Mou%2C+Marc+Marone%2C+Christopher+Akiki%2C+Jia+Li%2C+Jenny+Chim%2C+and+1+others%2E+2023%2E+Starcoder%3A+may+the+source+be+with+y)
8. LLVM Project. 2023. Clang-format style options. [https://clang.llvm.org/docs/](https://clang.llvm.org/docs/) ClangFormatStyleOptions.html. Accessed: 2025-01. [↗](https://clang.llvm.org/docs/)
9. InfoQ News. 2022. Class action lawsuit filed against github copilot. Accessed: 2025-09-04. [find](https://scholar.google.com/scholar?q=InfoQ+News%2E+2022%2E+Class+action+lawsuit+filed+against+github+copilot%2E+Accessed%3A+2025%2D09%2D04%2E)
10. Erik Nijkamp, Bo Pang, Hiroaki Hayashi, Lifu Tu, Huan Wang, Yingbo Zhou, Silvio Savarese, and Caiming Xiong. 2022. Codegen: An open large language model for code with multi-turn program synthesis. arXiv preprint arXiv:2203.13474. [find](https://scholar.google.com/scholar?q=Erik+Nijkamp%2C+Bo+Pang%2C+Hiroaki+Hayashi%2C+Lifu+Tu%2C+Huan+Wang%2C+Yingbo+Zhou%2C+Silvio+Savarese%2C+and+Caiming+Xiong%2E+2022%2E+Codegen%3A+An+open+large+language+model+for+code+with+multi%2Dturn+program+synthesis%2E+arX)
11. OpenAI. 2023. [Gpt-4 technical report](https://md.research.elamur.ai/free/en/papers/openai-2023-gpt-4-technical-report/). Available at https://arxiv.org/abs/2303.08774. [↗](https://arxiv.org/abs/2303.08774)
12. Oracle Corporation. 2025. javac - The Java Compiler. Accessed: 2025-09-06. [find](https://scholar.google.com/scholar?q=Oracle+Corporation%2E+2025%2E+javac+%2D+The+Java+Compiler%2E+Accessed%3A+2025%2D09%2D06%2E)
13. Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu. 2002. [Bleu: a method for automatic evaluation of machine translation](https://md.research.elamur.ai/free/en/papers/papineni-2002-bleu-method-automatic-evaluation-machine/). In Proceedings of the 40th Annual Meeting of the Association for Computational Linguistics, pages 311–318. ACL.
14. Python Software Foundation. 2025a. difflib — helpers for computing deltas. [https://docs.python.org/](https://docs.python.org/) 3/library/difflib.html. Accessed: 2025-09-11. [↗](https://docs.python.org/)
15. Python Software Foundation. 2025b. Python programming language, version 3.8.20. [https://www.python.org/](https://www.python.org/). Accessed: 2025-09-11. [↗](https://www.python.org/)
16. Pranav Rajpurkar, Jian Zhang, Konstantin Lopyrev, and Percy Liang. 2016. [Squad: 100,000+ questions for machine comprehension of text](https://md.research.elamur.ai/free/en/papers/rajpurkar-2016-squad-100-000-questions-machine/). In Proceedings of the 2016 Conference on Empirical Methods in Natural Language Processing.
17. Shuo Ren, Daya Guo, Shuai Lu, Long Zhou, Shujie Liu, Duyu Tang, Neel Sundaresan, Ming Zhou, Ambrosio Blanco, and Shuai Ma. 2020. Codebleu: a method for automatic evaluation of code synthesis. arXiv preprint arXiv:2009.10297. [find](https://scholar.google.com/scholar?q=Shuo+Ren%2C+Daya+Guo%2C+Shuai+Lu%2C+Long+Zhou%2C+Shujie+Liu%2C+Duyu+Tang%2C+Neel+Sundaresan%2C+Ming+Zhou%2C+Ambrosio+Blanco%2C+and+Shuai+Ma%2E+2020%2E+Codebleu%3A+a+method+for+automatic+evaluation+of+code+synthesis%2E+arXiv+pr)
18. Baptiste Rozière, Jonas Gehring, Fabian Gloeckle, Sten Sootla, Itai Gat, Xiaoqing Ellen Tan, Yossi Adi, Jingyu Liu, Romain Sauvestre, Tal Remez, Jérémy Rapin, Artyom Kozhevnikov, Ivan Evtimov, Joanna Bitton, Manish Bhatt, Cristian Canton-Ferrer, Aaron Grattafiori, Wenhan Xiong, Alexandre Défossez, a… — [Code Llama: Open Foundation Models for Code](https://md.research.elamur.ai/free/en/papers/roziere-2024-code-llama-open-foundation-models/)
19. Weisong Sun, Yuchen Chen, Mengzhe Yuan, Chunrong Fang, Zhenpeng Chen, Chong Wang, Yang Liu, Baowen Xu, and Zhenyu Chen. 2025. Show me your code! kill code poisoning: A lightweight method based on code naturalness. In 2025 IEEE/ACM 47th International Conference on Software Engineering (ICSE), pages 2… [find](https://scholar.google.com/scholar?q=Weisong+Sun%2C+Yuchen+Chen%2C+Mengzhe+Yuan%2C+Chunrong+Fang%2C+Zhenpeng+Chen%2C+Chong+Wang%2C+Yang+Liu%2C+Baowen+Xu%2C+and+Zhenyu+Chen%2E+2025%2E+Show+me+your+code%21+kill+code+poisoning%3A+A+lightweight+method+based+on+code)
20. Zhensu Sun, Xiaoning Du, Fu Song, and Li Li. 2023. Codemark: Imperceptible watermarking for code datasets against neural code completion models. In Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pages 1561– 1572, S… [find](https://scholar.google.com/scholar?q=Zhensu+Sun%2C+Xiaoning+Du%2C+Fu+Song%2C+and+Li+Li%2E+2023%2E+Codemark%3A+Imperceptible+watermarking+for+code+datasets+against+neural+code+completion+models%2E+In+Proceedings+of+the+31st+ACM+Joint+European+Software+)
21. Zhensu Sun, Xiaoning Du, Fu Song, Mingze Ni, and Li Li. 2022. Coprotector: Protect open-source code against unauthorized training usage with data poisoning. In Proceedings of the ACM Web Conference 2022, pages 652–660. [find](https://scholar.google.com/scholar?q=Zhensu+Sun%2C+Xiaoning+Du%2C+Fu+Song%2C+Mingze+Ni%2C+and+Li+Li%2E+2022%2E+Coprotector%3A+Protect+open%2Dsource+code+against+unauthorized+training+usage+with+data+poisoning%2E+In+Proceedings+of+the+ACM+Web+Conference+20)
22. Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, Dan Bikel, Lukas Blecher, Cristian Canton Ferrer, Moya Chen, Guillem Cucurull, David Esiobu, Jude Fernandes, Jeremy Fu, Wenyin Fu, and 49 others… — [Llama 2: Open Foundation and Fine-Tuned Chat Models](https://md.research.elamur.ai/free/en/papers/touvron-2023-llama-2-open-foundation-fine/)
23. Brandon Tran, Jerry Li, and Aleksander Madry. 2018. Spectral signatures in backdoor attacks. In Advances in Neural Information Processing Systems 31: Annual Conference on Neural Information Processing Systems, pages 8011–8021, Montréal, Canada. [find](https://scholar.google.com/scholar?q=Brandon+Tran%2C+Jerry+Li%2C+and+Aleksander+Madry%2E+2018%2E+Spectral+signatures+in+backdoor+attacks%2E+In+Advances+in+Neural+Information+Processing+Systems+31%3A+Annual+Conference+on+Neural+Information+Processing)
24. Yuan Xiao, Yuchen Chen, Shiqing Ma, Haocheng Huang, Chunrong Fang, Yanwei Chen, Weisong Sun, Yunfeng Zhu, Xiaofang Zhang, and Zhenyu Chen. 2025. Decoma: Detecting and purifying code dataset watermarks through dual channel code abstraction. In Proceedings of the ACM on Software Engineering, pages 170… [find](https://scholar.google.com/scholar?q=Yuan+Xiao%2C+Yuchen+Chen%2C+Shiqing+Ma%2C+Haocheng+Huang%2C+Chunrong+Fang%2C+Yanwei+Chen%2C+Weisong+Sun%2C+Yunfeng+Zhu%2C+Xiaofang+Zhang%2C+and+Zhenyu+Chen%2E+2025%2E+Decoma%3A+Detecting+and+purifying+code+dataset+watermarks)
25. Yuan Xiao, Yuchen Chen, Jiaming Wang, Wei Song, Jun Sun, Shiqing Ma, Yanzhou Mu, Juan Zhai, Chunrong Fang, Jin Song Dong, and Zhenyu Chen. 2026. [find](https://scholar.google.com/scholar?q=Yuan+Xiao%2C+Yuchen+Chen%2C+Jiaming+Wang%2C+Wei+Song%2C+Jun+Sun%2C+Shiqing+Ma%2C+Yanzhou+Mu%2C+Juan+Zhai%2C+Chunrong+Fang%2C+Jin+Song+Dong%2C+and+Zhenyu+Chen%2E+2026%2E)
26. Funpoison. [https://github.com/xiaoyuanpigo/](https://github.com/xiaoyuanpigo/) FunPoison. [↗](https://github.com/xiaoyuanpigo/)
27. Qinkai Zheng, Xiao Xia, Xu Zou, Yuxiao Dong, Shan Wang, Yufei Xue, Lei Shen, Zihan Wang, Andi Wang, Yang Li, Teng Su, Zhilin Yang, and Jie Tang. 2023. [Codegeex: A pre-trained model for code generation with multilingual benchmarking on humaneval-x](https://md.research.elamur.ai/free/en/papers/zheng-2023-codegeex-pre-trained-model-code/). In Proceedings of the 29th ACM SIGKDD Conference on…

*Updated 2 November 2026*