Pith. sign in

REVIEW 10 cited by

TrojanRAG: Retrieval-Augmented Generation Can Be Backdoor Driver in Large Language Models

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2405.13401 v4 pith:GZIPAPTE submitted 2024-05-22 cs.CR cs.CL

Pengzhou Cheng , Yidong Ding , Tianjie Ju , Zongru Wu , Wei Du , Ping Yi , Zhuosheng Zhang , Gongshen Liu This is my paper · ORCID
classification cs.CRcs.CL
keywords backdoorllmslanguagemodelstrojanragattackbackdoorscontexts
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
read the original abstract

Large language models (LLMs) have raised concerns about potential security threats despite performing significantly in Natural Language Processing (NLP). Backdoor attacks initially verified that LLM is doing substantial harm at all stages, but the cost and robustness have been criticized. Attacking LLMs is inherently risky in security review, while prohibitively expensive. Besides, the continuous iteration of LLMs will degrade the robustness of backdoors. In this paper, we propose TrojanRAG, which employs a joint backdoor attack in the Retrieval-Augmented Generation, thereby manipulating LLMs in universal attack scenarios. Specifically, the adversary constructs elaborate target contexts and trigger sets. Multiple pairs of backdoor shortcuts are orthogonally optimized by contrastive learning, thus constraining the triggering conditions to a parameter subspace to improve the matching. To improve the recall of the RAG for the target contexts, we introduce a knowledge graph to construct structured data to achieve hard matching at a fine-grained level. Moreover, we normalize the backdoor scenarios in LLMs to analyze the real harm caused by backdoors from both attackers' and users' perspectives and further verify whether the context is a favorable tool for jailbreaking models. Extensive experimental results on truthfulness, language understanding, and harmfulness show that TrojanRAG exhibits versatility threats while maintaining retrieval capabilities on normal queries.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 10 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Salience Induction against Multi-Hop RAG Agents: Threat and Defense

    cs.CR 2026-07 conditional novelty 7.0 of 10

    A new class of attack on retrieval-augmented AI: reordering and rephrasing true facts in documents flips an agent's reasoning steps, reaching 83.3% attack success with no false claims injected.

  2. Early Detection of Distributed Backdoors in Multi-Agent LLM Systems: A Characterization Study

    cs.CR 2026-07 conditional novelty 6.0 of 10

    Prefix detectors catch 99.3% of successful distributed multi-agent backdoors with a median of five steps left, but the warning largely depends on removable payload surface cues.

  3. LLM in the Middle: A Systematic Review of Threats and Mitigations to Real-World LLM-based Systems

    cs.CR 2025-09 conditional novelty 6.0 of 10

    A systematic review that categorizes LLM threats, severity scores, and mitigations across development and operation life cycles and multiple deployment scenarios.

  4. ImportSnare: Directed "Code Manual" Hijacking in Retrieval-Augmented Code Generation

    cs.CR 2025-09 conditional novelty 6.0 of 10

    Documentation poisoning with hidden ranking and suggestion sequences can make RAG-based code generators confidently recommend malicious dependencies, even at 0.01% poisoning ratios.

  5. Evaluating the Robustness of Retrieval-Augmented Generation to Adversarial Evidence in the Health Domain

    cs.IR 2025-09 conditional novelty 6.0 of 10

    Misleading health documents in RAG context sharply lower LLM accuracy, and heavily helpful-biased retrieval pools restore it.

  6. Bias Amplification in RAG: Poisoning Knowledge Retrieval to Steer LLMs

    cs.LG 2025-06 reject novelty 6.0 of 10

    A retrieval-augmented generation system can be poisoned with reward-optimized biased documents and vector-space manipulation to substantially increase biased LLM outputs.

  7. Towards Copyright Protection for Knowledge Bases of Retrieval-augmented Language Models via Reasoning

    cs.CR 2025-02 reject novelty 6.0 of 10

    RAGC⃝ watermarks RAG knowledge bases by injecting benign chain-of-thought passages that only watermarked queries retrieve, enabling ownership verification via a Wilcoxon test on whether the generated reasoning contain...

  8. Large Language Models in Misinformation Ecosystems: Misuse, Defense, and Vulnerability

    cs.CR 2026-07 conditional novelty 5.0 of 10

    A role-layer survey unifies LLM misuse, LLM-based defense, and LLM-centric verification vulnerabilities across content, social, evidence, and workflow layers, then lists three open challenges.

  9. Lexical Hints of Accuracy in LLM Reasoning Chains

    cs.CL 2025-08 reject novelty 5.0 of 10

    Hesitation words in reasoning chains are claimed to flag incorrect LLM answers, but the manuscript body is a different paper and contains no such study.

  10. Benchmarking Poisoning Attacks against Retrieval-Augmented Generation

    cs.CR 2025-05 conditional novelty 5.0 of 10

    A unified benchmark evaluation finds that existing RAG poisoning attacks remain effective on standard QA datasets, drop on expanded knowledge bases, and are only partially mitigated by current defenses.

Pith tools