RAG Poisoning Attacks

RAG: Retrieval-Augmented Generation

Follow this topic Ask about this topic

Momentum

3 papers in the last four weeks, down 40% on the four weeks before. 0.0% of all new papers.

Jul 13Week of Sep 28

Latest papers 40

All topics

SilentRetrieval: Hijacking Retrieval-Augmented Generation via Semantically-Preserving Adversarial Data Poisoning
May 27, 2026Jiachen QianRetrieval-Augmented Generation RAG Poisoning Attacks
City University of Hong Kong · Hong Kong, Hong Kong
Cordon-MAS: Defending RAG against Knowledge Poisoning via Information-Flow Control
May 26, 2026Zhe Yu, Wenpeng Xing, Gaolei Li +4RAG Poisoning Attacks Information Flow Control
Binjiang Institute of Zhejiang University · Zhejiang University · Shanghai Jiao Tong University +3
Mental Damage: Caption Poisoning Attacks on Retrieval-Augmented Text-to-Music Generation
May 18, 2026Yizhu Wen, Shuhao Zhang, Nan Zhang +2Text-to-Music Generation RAG Poisoning Attacks
University of Hawai'i at M¯anoa · Clemson University · Michigan State University
Knowledge Poisoning Attacks on Medical Multi-Modal Retrieval-Augmented Generation
May 11, 2026Peiru Yang, Haoran Zheng, Tong Ju +6Multimodal RAG Adversarial Attacks on VLMs
1Tsinghua University · 2Beijing University of Posts and Telecommunications · 3Northwestern Polytechnical University +1
PRA-RAG: Provably Robust Aggregation in Retrieval-Augmented Generation against Retrieval Corruption
May 8, 2026Xue Tan, Yi Zheng, Chang Huo +7Retrieval-Augmented Generation RAG Poisoning Attacks
School of Computer Science, Fudan University, Shanghai, China · Institute of Big Data, Fudan University, Shanghai, China · Department of Computer Science, Worcester Polytechnic Institute, MA, USA
Architecture Matters: Comparing RAG Systems under Knowledge Base Poisoning
May 7, 2026Samuel KornRetrieval-Augmented Generation RAG Poisoning Attacks
MEMSAD: Gradient-Coupled Anomaly Detection for Memory Poisoning in Retrieval-Augmented Agents
May 5, 2026Ishrith GowdaRAG Poisoning Attacks Agent Memory Poisoning
University of California, Berkeley · Department of Electrical Engineering and Computer Sciences University of California, Berkeley · Work conducted at the Song Lab, Berkeley AI Research, University of California, Berkeley.
CleanBase: Detecting Malicious Documents in RAG Knowledge Databases
May 1, 2026Weifei Jin, Xilong Wang, Wei Zou +2RAG Poisoning Attacks RAG Security
Duke University · The Pennsylvania State University
Eyes-on-Me: Scalable RAG Poisoning through Transferable Attention-Steering Attractors
Oct 1, 2025Yen-Shan Chen, Sian-Yao Huang, Cheng-Lin Yang +1Language Model Steering RAG Poisoning Attacks
CyCraft AI Lab, Taiwan · National Taiwan University
BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models
Jun 3, 2024Jiaqi Xue, Mengxin Zheng, Yebowen Hu +3LLM Backdoor Attacks RAG Poisoning Attacks
University of Central Florida · Emory University · Samsung Research America

May 27, 2026, cs.CRJ/K move · Enter open · S save

SilentRetrieval: Hijacking Retrieval-Augmented Generation via Semantically-Preserving Adversarial Data Poisoning

Jiachen Qian

City University of Hong Kong · Hong Kong, Hong Kong

Retrieval-Augmented Generation RAG Poisoning Attacks Retrieval Robustness RAG Security RAG Robustness Adversarial Text Attacks

Open paper AskPDF arXiv

Retrieval-Augmented Generation (RAG) mitigates LLM hallucinations but introduces a critical vulnerability: corpus integrity. We present SilentRetrieval, a two-stage data poisoning attack that hijacks RAG systems through adversarially crafted yet fluent documents. Stage 1 uses Coordinated Beam Search, a multi-token joint optimization method with a fluency-similarity objective, to keep a poisoned host document retrievable while constraining perplexity. Stage 2 uses Context-Adaptive Trigger Generation, a lightweight trigger-fusion step driven by a frozen LLM, to integrate manipulation triggers into document content. Under a one-poisoned-document-per-query evaluation with synthetic target answers, SilentRetrieval achieves 84.6%/81.3% HR@10 and 57.5%/54.8% ASR-LLM on Natural Questions and MS MARCO, while maintaining near-benign perplexity. Cross-model evaluation across four target LLMs shows nontrivial effectiveness under a fixed trigger generator, and transfer tests against unseen retrievers, including ColBERT and commercial embedding models, yield 64.7% average HR@10 under the same injected-corpus protocol. In a sampled Wikipedia-scale evaluation, SilentRetrieval retains 74.2% HR@10 at a 0.016% poisoning ratio. Combined retrieval-side and generation-side defenses reduce attack success substantially but incur a latency trade-off. Human evaluation shows substantially lower flag rates than disfluent baselines, while remaining numerically more suspicious than benign content at the current sample size.

Momentum

Related topics

Latest papers 40