RAG Security

RAG: Retrieval-Augmented Generation

Follow this topic Ask about this topic

Momentum

7 papers in the last four weeks, up 17% on the four weeks before. 0.1% of all new papers.

Jul 13Week of Sep 28

Latest papers 74

All topics

Conflict-Aware Retriever Editing for Knowledge Injection Attacks on LLM-Based RAG Systems
Jun 16, 2026Xinru Liu, Xianglong Zhang, Di Cai +3Knowledge Editing RAG Poisoning Attacks
Shandong University, China · Tsinghua University, China
PARSE: Provenance-Aware Retrieval Sanitization for Professional Domain LLM Agents
Jun 16, 2026Aaditya PaiAI Agent Security Benchmarks Prompt Injection Defense
Data Science Institute Columbia University
One Polluted Page Is Enough: Evaluating Web Content Pollution in Generative Recommenders
Jun 11, 2026Minghao Luo, Liang ChenLLM Evaluation RAG Security
The Chinese University of Hong Kong
SMSR: Certified Defence Against Runtime Memory Poisoning in Persistent LLM Agent Systems
Jun 10, 2026Tarun SharmaRAG Poisoning Attacks Agent Memory Poisoning
Independent Researcher
When Poison Fails After Retrieval: Revisiting Corpus Poisoning under Chunking and Reranking Pipelines
Jun 9, 2026Xi Nie, Hongwei Li, Shenghao Wu +3RAG Poisoning Attacks RAG Security
School of Computer Science and Engineering, University of Electronic Science and Technology of China, China · School of Criminal Investigation, People’s Public Security University of China, China · School of Computer Science and Artificial Intelligence, Wuhan University of Technology, China
Document-Authored Control-Signal Impersonation: A Low-Cost Indirect Prompt Attack on RAG Safety Boundaries
Jun 8, 2026Jianguo ZhuAdversarial Attacks on LLMs Indirect Prompt Injection
Chengdu University of Information Technology, Chengdu, China
Answer Presence Drives RAG Rewriting Gains
Jun 4, 2026Yuejie Li, Yueying Hua, Ke Yang +8Multi-Hop QA RAG Security
Ant Group
Inference Cost Attacks for Retrieval-Augmented Large Language Models
May 31, 2026Chengliang Liu, Liangbo Ning, Yujuan Ding +1Retrieval-Augmented Generation Adversarial Attacks
The Hong Kong Polytechnic University Hong Kong, Hong Kong
DiscourseFlip: An Oblique Discourse-Level Opinion Manipulation Attack against Black-box Retrieval-Augmented Generation
May 31, 2026Yuyang Gong, Miaokun Chen, Jiawei Liu +5RAG Poisoning Attacks RAG Security
Wuhan University · East China Normal University · Nanyang Technological University +1
Relevance as a Vulnerability: How Web Retrieval Degrades Safety Alignment in LLM Agents
May 28, 2026Aditya Nawal, Manit Baser, Mohan GurusamyAI Agent Security Benchmarks LLM Safety Evaluation
Department of Electrical and Computer Engineering · National University of Singapore
GraphSteal: Structural Knowledge Stealing from Graph RAG via Traversal Reconstruction
May 27, 2026Jinze Gu, Qinghua Mao, Xi Lin +1Model Extraction Attacks Graph Retrieval-Augmented Generation
School of Computer Science, Shanghai Jiao Tong University
A Wolf in Sheep's Clothing: Targeted Routing Hijacking in Federated RAG
May 27, 2026Junjie Mu, Qiongxiu LiRetrieval-Augmented Generation Cybersecurity
Politecnico di Milano Milan, Italy · Aalborg University Aalborg, Denmark
SilentRetrieval: Hijacking Retrieval-Augmented Generation via Semantically-Preserving Adversarial Data Poisoning
May 27, 2026Jiachen QianRetrieval-Augmented Generation RAG Poisoning Attacks
City University of Hong Kong · Hong Kong, Hong Kong
Grounded Cache Routing for Retrieval-Augmented Generation: When Is It Safe to Reuse an Answer?
May 26, 2026Syed Huma ShahRetrieval-Augmented Generation RAG Security
Duke University · Syed Huma Shah$^*$
Detecting Is Not Resolving: The Monitoring Control Gap in Retrieval Augmented LLMs
May 26, 2026Zhe Yu, Wenpeng Xing, Chen Ye +4Language Model Safety Evaluation Knowledge Conflicts in Language Models
Binjiang Institute of Zhejiang University · Zhejiang University · Hangzhou Dianzi University +1
Cordon-MAS: Defending RAG against Knowledge Poisoning via Information-Flow Control
May 26, 2026Zhe Yu, Wenpeng Xing, Gaolei Li +4RAG Poisoning Attacks Information Flow Control
Binjiang Institute of Zhejiang University · Zhejiang University · Shanghai Jiao Tong University +3
Intelligent Detection and Mitigation of Carpet-Bombing DDoS Attacks in SDN Using Retrieval-Augmented Generation and Large Language Models
May 25, 2026Mohammed N. Swileh, Shengli Zhang, Kai LeiNetwork Intrusion Detection Cybersecurity
College of Electronics and Information Engineering, Shenzhen University, Shenzhen, 518060, China · ICNLab, Shenzhen Graduate School, Peking University, Shenzhen, People’s Republic of China
Auditing Privacy in Multi-Tenant RAG under Account Collusion
May 19, 2026Florian A. D. BurnatData Leakage Privacy Auditing
University of Bath, Bath, UK.
Mental Damage: Caption Poisoning Attacks on Retrieval-Augmented Text-to-Music Generation
May 18, 2026Yizhu Wen, Shuhao Zhang, Nan Zhang +2Text-to-Music Generation RAG Poisoning Attacks
University of Hawai'i at M¯anoa · Clemson University · Michigan State University
Privacy Policy Enforcement Guardrails for Data-Sensitive Retrieval-Augmented Generation
May 16, 2026Osama Zafar, Alexander Nemecek, Yiqian Zhang +5Data Leakage RAG Security
Dept. of Computer and Data Sciences Case Western Reserve University Cleveland, USA
VectorSmuggle: Steganographic Exfiltration in Embedding Stores and a Cryptographic Provenance Defense
May 13, 2026Jascha WangerData Provenance Information Retrieval
ThirdKey / Tarnover, LLC
RUBEN: Rule-Based Explanations for Retrieval-Augmented LLM Systems
May 11, 2026Joel Rorseth, Parke Godfrey, Lukasz Golab +2Retrieval-Augmented Generation Language Model Safety Evaluation
University of Waterloo · York University · AT&T Chief Data Office
Knowledge Poisoning Attacks on Medical Multi-Modal Retrieval-Augmented Generation
May 11, 2026Peiru Yang, Haoran Zheng, Tong Ju +6Multimodal RAG Adversarial Attacks on VLMs
1Tsinghua University · 2Beijing University of Posts and Telecommunications · 3Northwestern Polytechnical University +1
Defense effectiveness across architectural layers: a mechanistic evaluation of persistent memory attacks on stateful LLM agents
May 8, 2026Jun Wen LeongLanguage Model Safety Evaluation AI Agent Security
PRA-RAG: Provably Robust Aggregation in Retrieval-Augmented Generation against Retrieval Corruption
May 8, 2026Xue Tan, Yi Zheng, Chang Huo +7Retrieval-Augmented Generation RAG Poisoning Attacks
School of Computer Science, Fudan University, Shanghai, China · Institute of Big Data, Fudan University, Shanghai, China · Department of Computer Science, Worcester Polytechnic Institute, MA, USA
LeakDojo: Decoding the Leakage Threats of RAG Systems
May 7, 2026Maosen Zhang, Jianshuo Dong, Boting Lu +4Data Leakage Privacy Leakage in Language Models
Tsinghua University, China · Ant International, China · Nanyang Technological University, Singapore
Architecture Matters: Comparing RAG Systems under Knowledge Base Poisoning
May 7, 2026Samuel KornRetrieval-Augmented Generation RAG Poisoning Attacks
Privacy Without Losing Place: A Paradigm for Private Retrieval in Spatial RAGs
May 6, 2026Kennedy Edemacu, Mohammad Mahdi Shokri, Vinay M. Shashidhar +1Retrieval-Augmented Generation Privacy-Preserving ML
The City University of New York, College of Staten Island and Graduate Center · The City University of New York, Graduate Center · Northern Michigan University +1
Securing the Agent: Vendor-Neutral, Multitenant Enterprise Retrieval and Tool Use
May 6, 2026Francisco Javier Arceo, Varsha Prasad NarsingLLM Agent Orchestration AI Agent Security
Red Hat AI · Boston, USA
MEMSAD: Gradient-Coupled Anomaly Detection for Memory Poisoning in Retrieval-Augmented Agents
May 5, 2026Ishrith GowdaRAG Poisoning Attacks Agent Memory Poisoning
University of California, Berkeley · Department of Electrical Engineering and Computer Sciences University of California, Berkeley · Work conducted at the Song Lab, Berkeley AI Research, University of California, Berkeley.

Jun 16, 2026, cs.CRJ/K move · Enter open · S save

Conflict-Aware Retriever Editing for Knowledge Injection Attacks on LLM-Based RAG Systems

Xinru Liu, Xianglong Zhang, Di Cai, Zhumin Chen+2

Shandong University, China · Tsinghua University, China

Knowledge Editing RAG Poisoning Attacks RAG Security

Open paper AskPDF arXiv

Injecting malicious knowledge into retrieval-augmented generation (RAG) systems can manipulate retrieved evidence and mislead downstream generation, posing a serious security threat for AI applications. Existing RAG injection attacks mainly rely on manipulating external knowledge bases, such as crafting malicious corpus. However, the synthetic text crafted by such data-centric methods could be detectable, leading to the failure of attacks. Beyond corpus manipulation, open-source retrievers are increasingly exposing RAG systems to model-centric attacks. In this paper, we propose conflict-aware retriever editing, i.e., CAREATTACK, a model-centric retriever attack framework for malicious knowledge injection in RAG. Specifically, CAREATTACK consists two stages of conflict-aware retriever editing and attack-preserving anchor repair. Conflict-aware retriever editing adapts efficient closed-form parameter editing to the dense retrieval model, promoting malicious knowledge above benign competing passages and resolving potential parameter conflicts through graph-based conflict detection and parameter editing projection. Then, attack-preserving anchor repair performs lightweight calibration on the edited retriever to further eliminate the impact on non-target prompts while preserving the attack effectiveness for target prompts. We instantiate CAREATTACK on Qwen3-Embedding-0.6B and BGE-M3, and conduct evaluation on three benchmark datasets. Experimental results demonstrate our method substantially promote malicious passages into the retrieved knowledge of RAG systems and can perform attacks for batches of target prompts and passages, given the access of retrieval model parameters. Since most RAG systems are built upon open-source retrieval models, this work reveals a practical attack surface in RAG systems. Codes are public accessible at https://anonymous.4open.science/r/CareAttack-3F1C.

Momentum

Related topics

Latest papers 74