Generative backdoor attacks pose a growing threat to the instruction tuning of large language models (LLMs), where attackers poison a few training samples to induce malicious payloads on triggered inputs while preserving normal behavior on clean ones. However, existing backdoor-poisoned sample filtering methods typically rely on global sample representations and clustering-based separation, and such global signals can become fragile when heterogeneous target-side malicious payloads scatter poisoned samples or low poisoning rates prevent poisoned samples from forming stable clusters. This motivates us to move beyond cross-sample separability and instead exploit localized token-level target-side anomalies induced by malicious payload tokens under teacher forcing. Building on this intuition, we propose TTAF, a Teacher-forcing Token-level Anomaly Filtering framework which introduces a token-level anomaly score under teacher forcing and aggregates localized evidence to filter suspicious poisoned samples before fine-tuning. Experiments across multiple datasets, representative backdoor attacks, and different LLMs show that TTAF consistently achieves strong filtering performance within this payload-injection setting, with efficient runtime and no external dependencies. Code is available at https://github.com/Sam-Han2020/TTAF.

Coding agents are increasingly used for software engineering tasks, including bootstrapping projects from third-party repositories whose integrity cannot be assumed. Prior work on repository poisoning largely focuses on attacker-controlled injection and disguise, but developers also shape risk through everyday invocation choices: what task to delegate, how to phrase the request, and which skills or rules to supply. We term these user-side choices Prompt-Level Configurations (PLCs) and introduce CIPR (Coding In Poisoned Repos), the first benchmark that systematically varies PLCs in poisoned real-world repositories. CIPR comprises 1,920 instances across 20 repositories, four task types, three social-media-grounded prompt styles, and three skill/rule conditions, and measures attack success rate (ASR) and agent alert rate (AR) using automated runtime and trace-based oracles. Our evaluation reveals two key insights: (1) Vulnerability is highly context-dependent, with task type creating up to a 4.5-fold difference in ASR, with test-execution task forming a silent attack surface (high ASR, low AR). (2) Prompt expression shifts risk indirectly: underspecified prompts reduce ASR by truncating execution depth; noisy prompts exhibit a directional trend toward suppressing alerts by making malicious content less conspicuous. These findings highlight that coding agent vulnerability is not a static property, but a dynamic outcome shaped by everyday user configurations.