Poisoning

Follow this topic Ask about this topic

Momentum

19 papers in the last four weeks, up 111% on the four weeks before. 0.2% of all new papers.

Jul 13Week of Sep 28

Latest papers 154

All topics

Knowledge Poisoning Attacks on Medical Multi-Modal Retrieval-Augmented Generation
May 11, 2026Peiru Yang, Haoran Zheng, Tong Ju +6Multimodal Retrieval Augmented Generation Multimodal Clinical Data
1Tsinghua University · 2Beijing University of Posts and Telecommunications · 3Northwestern Polytechnical University +1
Oracle Poisoning: Corrupting Knowledge Graphs to Weaponise AI Agent Reasoning
May 10, 2026Ben Kereopa-Yorke, Guillermo Diaz, Holly Wright +3Poisoning Knowledge Graphs
1Microsoft · 2UNSW Canberra · 3SAP +1
ShadowMerge: A Novel Poisoning Attack on Graph-Based Agent Memory via Relation-Channel Conflicts
May 9, 2026Yang Luo, Zifeng Kang, Tiantian Ji +4Graph-Structured Memories Poisoning
Key Laboratory of Trustworthy Distributed Computing and Service (MoE), Beijing University of Posts and Telecommunications · Beijing University of Posts and Telecommunications · Zhongguancun Laboratory
Narrow Secret Loyalty Dodges Black-Box Audits
May 7, 2026Alfie Lamerton, Fabien RogerRealistic Threat Model Poisoning
Formation Research
Towards Security-Auditable LLM Agents: A Unified Graph Representation
May 7, 2026Chaofan Li, Lyuye Zhang, Jintao Zhai +9Security Evaluation Production Agentic Systems
Huazhong University of Science and Technology, China · Nanyang Technological University, Singapore, Singapore · Chongqing University of Posts and Telecommunications, China +2
When Routine Chats Turn Toxic: Unintended Long-Term State Poisoning in Personalized Agents
May 7, 2026Xiaoyu Xu, Minxin Du, Qipeng Xie +3Poisoning Personalized Large Language Model Agents
†The Hong Kong Polytechnic University · ⋄Hong Kong University of Science and Technology, HKUST (Guangzhou)
LoopTrap: Termination Poisoning Attacks on LLM Agents
May 7, 2026Huiyu Xu, Zhibo Wang, Wenhui Zhang +4Large Language Model Agents Poisoning
The State Key Laboratory of Blockchain and Data Security Zhejiang University Hangzhou, Zhejiang, P. R. China · School of Cyber Science and Engineering Southeast University Nanjing, Jiangsu, P. R. China
Architecture Matters: Comparing RAG Systems under Knowledge Base Poisoning
May 7, 2026Samuel KornPoisoning Adversarial Evaluation
Gray-Box Poisoning of Continuous Malware Ingestion Pipelines
May 6, 2026Jan Dolejš, Martin Jureček, Róbert LórenczMalware Poisoning
Faculty of Information Technology, Czech Technical University in Prague, Thákurova 9, Prague, 16000, Czech Republic
MEMSAD: Gradient-Coupled Anomaly Detection for Memory Poisoning in Retrieval-Augmented Agents
May 5, 2026Ishrith GowdaPoisoning LLM Defense Mechanisms
University of California, Berkeley · Department of Electrical Engineering and Computer Sciences University of California, Berkeley · Work conducted at the Song Lab, Berkeley AI Research, University of California, Berkeley.
When Agents Handle Secrets: A Survey of Confidential Computing for Agentic AI
May 4, 2026Javad Forough, Marios Kogias, Hamed HaddadiPoisoning AI Trustworthiness
Department of Computing Imperial College London London, United Kingdom
Efficient Preference Poisoning Attack on Offline RLHF
May 4, 2026Chenye Yang, Weiyu Xu, Lifeng LaiBacktranslation Augmented Direct Preference Optimization Reinforcement Learning From Human Feedback
Department of Electrical and Computer Engineering, University of California, Davis, Davis, CA, USA · Department of Electrical and Computer Engineering, University of Iowa, Iowa City, IA, USA.
Fight Poison with Poison: Enhancing Robustness in Few-shot Machine-Generated Text Detection with Adversarial Training
May 4, 2026Wenjing Duan, Qi Zhou, Yuanfan LiMachine-Generated Text Detection Adversarial Training
Faculty of Electronic and Information Engineering, Xi’an Jiaotong University
Adversarial Update-Based Federated Unlearning for Poisoned Model Recovery
May 4, 2026Wenwei Zhao, Xiaowen Li, Yao Liu +1Federated Learning Adversarial Training
Department of Electrical Engineering, University of South Florida,Tampa, FL, USA · Bellini College, University of South Florida, Tampa, FL, USA
Repurposing and Evaluating the (In)Feasibility of Dataset Poisoning enabled Watermarking for Contrastive Learning
May 3, 2026Zhiyang Dai, Yansong Gao, Boyu Kuang +5Contrastive Learning Watermarking
School of Cyber Science and Engineering, Nanjing University of Science and Technology, Nanjing 210094, China · University of Western Australia, Perth, Australia · College of Electronics and Information Engineering, Shenzhen University, Shenzhen, China +3
Toward Polymorphic Backdoor against Semantic Communication via Intensity-Based Poisoning
Apr 25, 2026Xiao Yang, Yuni Lai, Gaolei Li +4Fewer Surprising Backdoors White-Box Spectral-Subspace-Guided Attack
School of Computer Science, Shanghai Jiao Tong University, and Shanghai Key Laboratory of Integrated Administration Technologies for Information Security, Shanghai, China · Department of Computing, Hong Kong Polytechnic University, Hung Hom, Kowloon, Hong Kong · Department of Electrical and Computer Engineering and Frost Institute for Data Science and Computing, University of Miami, Coral Gables, Florida 33146, USA
RouteGuard: Internal-Signal Detection of Skill Poisoning in LLM Agents
Apr 24, 2026Wenjie Xiao, Xuehai Tang, Biyu Zhou +2Malicious Agents Poisoning
University of Chinese Academy of Sciences · Institute of Information Engineering, Chinese Academy of Sciences
Sharpness-Aware Poisoning: Enhancing Transferability of Injective Attacks on Recommender Systems
Apr 24, 2026Junsong Xie, Yonghui Yang, Pengyang Shao +1Poisoning
Key Laboratory of Knowledge Engineering with Big Data, Hefei University of Technology, Hefei 230009, China · Intelligent Interconnected Systems Laboratory of Anhui Province, Hefei University of Technology, Hefei 230009, China · Laboratory of NExT++, National University of Singapore, Singapore
PermaFrost-Attack: Stealth Pretraining Seeding(SPS) for planting Logic Landmines During LLM Training
Apr 23, 2026Harsh Kumar, Rahul Maity, Tanmay Joshi +4Attacker Large Language Model Poisoning
1Manipal University Jaipur · 2NIT, Karnataka · 3Pragya Lab, BITS Pilani Goa, India +2
CSC: Turning the Adversary's Poison against Itself
Apr 23, 2026Yuchen Shi, Xin Guo, Huajie Chen +3Clean Label Backdoor Attack Model-Agnostic Defense
Faculty of Data Science, City University of Macau, Taipa, Macau. · Faculty of Engineering and Information Technology, University of Technology Sydney, New South Wales, Australia.
Visual Inception: Compromising Long-term Planning in Agentic Recommenders via Multimodal Memory Poisoning
Apr 18, 2026Jiachen QianPoisoning Long-Term Memory
City University of Hong Kong
PoInit-of-View: Poisoning Initialization of Views Transfers Across Multiple 3D Reconstruction Systems
Apr 17, 2026Weijie Wang, Songlong Xing, Zhengyu Zhao +23D Reconstruction Keypoint Detection
University of Trento, Italy · Xi’an Jiaotong University, China · Fondazione Bruno Kessler, Italy
When Can You Poison Rewards? A Tight Characterization of Reward Poisoning in Linear MDPs
Apr 11, 2026Jose Efraim Aguilar Escamilla, Haoyang Hong, Jiawei Li +4Markov Decision Processes Poisoning
Oregon State University, OR, USA · University of Illinois Urbana–Champaign, IL, USA · Princeton University, NJ, USA +1
Detecting Data Poisoning in Code Generation LLMs via Black-Box, Vulnerability-Oriented Scanning
Mar 17, 2026Shenao Yan, Shan Jin, Shimaa Ahmed +4Vulnerable Code Attacker Large Language Model
University of Connecticut · Visa Research
Communication-Efficient Byzantine-Robust Federated Conformal Prediction via Partial Sharing
Feb 20, 2026Ehsan Lari, Reza Arablouei, Stefan WernerOnline Conformal Prediction Federated Learning
Department of Electronic Systems, Norwegian University of Science and Technology, 7491 Trondheim, Norway · Commonwealth Scientific and Industrial Research Organisation, Pullenvale, QLD 4069, Australia · Department of Information and Communications Engineering, Aalto University, 00076, Finland
Hidden State Poisoning Attacks against Mamba-based Language Models
Jan 5, 2026Alexandre Le Mercier, Chris Develder, Thomas DemeesterHybrid Mamba-Transformer Model Attacker Large Language Model
IDLab–T2K, Ghent University–imec
Eyes-on-Me: Scalable RAG Poisoning through Transferable Attention-Steering Attractors
Oct 1, 2025Yen-Shan Chen, Sian-Yao Huang, Cheng-Lin Yang +1Agentic Retrieval-Augmented Generation Systems Poisoning
CyCraft AI Lab, Taiwan · National Taiwan University
Are Targeted Data Poisoning Attacks as Effective as We Think?
Sep 8, 2025William Xu, Chenyu Zhang, Yihan Wang +5Poisoning Hard
Waabi AI · University of Waterloo · Carnegie Mellon University +3
Tight Stability Bounds for Robust Distributed Learning: Byzantine Failures Hurt Generalization More than Data Poisoning
Jun 22, 2025Thomas Boudou, Batiste Le Bars, Nirupam Gupta +1Byzantine Attacks Learnability
PreMeDICaL team, Inria, Idesp, Inserm, Université de Montpellier, Montpellier, France · Univ. Lille, Inria, CNRS, Centrale Lille, UMR 9189, CRIStAL, F-59000 Lille, France · Department of Computer Science, University of Copenhagen, Copenhagen, Danemark
How to Backdoor Image Knowledge Distillation
Apr 30, 2025Qian Ma, Chen Wu, Prasenjit Mitra +1Knowledge Distillation Fewer Surprising Backdoors
The Pennsylvania State University State College, USA · Carnegie Mellon University Africa Kigali, Rwanda
FedNIA: Noise-Induced Activation Analysis for Mitigating Data Poisoning in Federated Learning
Feb 23, 2025Ehsan Hallaji, Roozbeh Razavi-Far, Mehrdad SaifFederated Learning Poisoning
Department of Electrical and Computer Engineering, University of Windsor, Windsor ON, Canada · Faculty of Computer Science, University of New Brunswick, Fredericton NB, Canada
SynGhost: Invisible and Universal Task-agnostic Backdoor Attack via Syntactic Transfer
Feb 29, 2024Pengzhou Cheng, Wei Du, Zongru Wu +4Clean Label Backdoor Attack Attacker Large Language Model
School of Electronic Information and Electrical Engineering Shanghai Jiao Tong University · Department of Computer Science and Engineering Southern University of Science and Technology
FedReview: Review and Dispose Poisoned Updates without Validation Datasets or Historic Knowledge
Feb 26, 2024Tianhang Zheng, Yanlu Li, Bohan Deng +1Federated Learning Poisoning
University of Missouri-Kansas City · University of Toronto
Kick Bad Guys Out! Conditionally Activated Anomaly Detection in Federated Learning with Zero-Knowledge Proof Verification
Oct 6, 2023Shanshan Han, Wenxuan Wu, Baturalp Buyukates +4Federated Learning Model-Agnostic Defense
University of California, Irvine · Texas A&M University · University of Birmingham +3

May 11, 2026, cs.CRJ/K move · Enter open · S save

Knowledge Poisoning Attacks on Medical Multi-Modal Retrieval-Augmented Generation

Peiru Yang, Haoran Zheng, Tong Ju, Shiting Wang+5

1Tsinghua University · 2Beijing University of Posts and Telecommunications · 3Northwestern Polytechnical University+1

Multimodal Retrieval Augmented Generation Multimodal Clinical Data Poisoning Adversarial Robustness

Open paper AskPDF arXiv

Retrieval-augmented generation (RAG) is a widely adopted paradigm for enhancing LLMs in medical applications by incorporating expert multimodal knowledge during generation. However, the underlying retrieval databases may naturally contain, or be intentionally injected with, adversarial knowledge, which can perturb model outputs and undermine system reliability. To investigate this risk, prior studies have explored knowledge poisoning attacks in medical RAG systems. Nevertheless, most of them rely on the strong assumption that adversaries possess prior knowledge of user queries, which is unrealistic in deployments and substantially limits their practical applicability. In this paper, we propose M\textsuperscript{3}Att, a knowledge-poisoning framework designed for medical multimodal RAG systems, assuming only limited distribution knowledge of the underlying database. Our core idea is to inject covert misinformation into textual data while using paired visual data as a query-agnostic trigger to promote retrieval. We first propose a unified framework that introduces imperceptible perturbations to visual inputs to manipulate retrieval probabilities. Besides, due to the prior medical knowledge in LLMs, naively poisoned medical content with explicit factual errors can be corrected during generation. Thus, we leverage the inherent ambiguity of medical diagnosis and design a covert misinformation injection strategy that degrades diagnostic accuracy while evading model self-correction. Experiments on five LLMs and datasets demonstrate that M\textsuperscript{3}Att consistently produces clinically plausible yet incorrect generations. Codes: https://github.com/ypr17/M3Att.

Momentum

Related topics

Latest papers 154