{"as_of":"2026-08-09T14:36:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:458e100a5ed56224347cc5bea213accf568475e7d03d12bcf5af123df24c089e","coverage":[{"denominator":99,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":99,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-07T14:33:01.360877Z","state":"measured"},{"denominator":108,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":108,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-09T06:31:02.800959+00:00","state":"measured"},{"denominator":9,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":9,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-05T15:18:36.938530Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":1,"source":"arxiv_reference","source_observed_at":"2026-08-05T02:28:24.338817Z","state":"measured"}],"external_citation_measurements":[{"count":0,"observed_at":"2026-08-05T02:28:24.338817Z","source":"arxiv_reference"}],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.18543","snapshot_observed_at":"2026-08-05T15:18:36.938530Z","title":"Benchmarking poi- soning attacks against retrieval-augmented generation","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2508.20083","last_updated":"2026-07-19T08:24:06Z","snapshot_observed_at":"2026-08-06T12:59:49.846974Z","submitted_at":"2025-08-27T17:49:28Z","title":"DisarmRAG: Stealthy Retriever-Centric Poisoning to Disable Self-Correction in Retrieval-Augmented Generation (Extended Version)","version":2},"reference_index":81,"source":"pdf_text","source_observed_at":"2026-08-05T15:18:36.938530Z"},"links":{"cited_paper":"/paper/2505.18543","citing_paper":"/paper/2508.20083"},"observation_digest":"sha256:577800f8a1c019c67576ef967705593ef496fda1619dfd471b8dccc85dc8bfeb","observation_id":"ad58ddcf-7096-454f-a151-4e085f27729b","resolution":{"observed_at":"2026-08-05T15:18:36.938530Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.18543","snapshot_observed_at":"2026-08-04T14:43:56.610925Z","title":"Benchmarking poisoning attacks against retrieval-augmented generation","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.23694","last_updated":"2026-06-03T04:13:57Z","snapshot_observed_at":"2026-08-04T14:43:33.365212Z","submitted_at":"2025-09-28T07:05:17Z","title":"SafeSearch: Automated Red-Teaming of LLM-Based Search Agents","version":6},"reference_index":69,"source":"arxiv_source","source_observed_at":"2026-08-04T14:43:56.610925Z"},"links":{"cited_paper":"/paper/2505.18543","citing_paper":"/paper/2509.23694"},"observation_digest":"sha256:b82944011097b5029de542dd50061fc6eb98fe98854d2b8dea292fa29e202fa4","observation_id":"ab14dd36-08ab-453a-9f47-4b60ddb3c842","resolution":{"observed_at":"2026-08-04T14:43:56.610925Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.18543","snapshot_observed_at":"2026-08-03T03:04:47.779862Z","title":"Benchmarking poisoning attacks against retrieval- augmented generation.arXiv preprint arXiv:2505.18543, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2602.09319","last_updated":"2026-06-08T20:08:22Z","snapshot_observed_at":"2026-08-09T10:44:09.914768Z","submitted_at":"2026-02-10T01:27:46Z","title":"Benchmarking Knowledge-Extraction Attack and Defense on Retrieval-Augmented Generation","version":3},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-03T03:04:47.779862Z"},"links":{"cited_paper":"/paper/2505.18543","citing_paper":"/paper/2602.09319"},"observation_digest":"sha256:8f8f1fe79d37e3d87389d049d206ad78f5e5e7ee3e58b1f4b518c78ddba66cd3","observation_id":"1717e7d8-6ee6-49d4-8634-cf2877b4504e","resolution":{"observed_at":"2026-08-03T03:04:47.779862Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"cited_work":{"arxiv_id":"2505.18543","doi":"10.48550/arxiv.2505.18543","metadata_source":"arxiv_reference","pith_arxiv_id":"2505.18543","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Benchmarking poisoning attacks against retrieval- augmented generation","venue":"ArXiv.org","work_id":"ed956317-f245-44d0-b530-4f127e4f452d","year":2025},"citing_paper":{"arxiv_id":"2604.00387","last_updated":"2026-04-04T07:18:50Z","snapshot_observed_at":"2026-08-04T09:28:38.404006Z","submitted_at":"2026-04-01T02:16:42Z","title":"RAGShield: Detecting Numerical Claim Manipulation in Government RAG Systems","version":2},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-05-13T23:14:47.704353Z"},"links":{"cited_paper":"/paper/2505.18543","citing_paper":"/paper/2604.00387"},"observation_digest":"sha256:b6f5d5b920a828c78c1dc9eb7ad1310ef49de6c154ea64b36ce3407279bbd488","observation_id":"d62086f3-1289-4a9d-9122-28d30bf569f6","resolution":{"observed_at":"2026-05-13T23:18:25.905684Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"cited_work":{"arxiv_id":"2505.18543","doi":"10.48550/arxiv.2505.18543","metadata_source":"arxiv_reference","pith_arxiv_id":"2505.18543","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Benchmarking poisoning attacks against retrieval- augmented generation","venue":"ArXiv.org","work_id":"ed956317-f245-44d0-b530-4f127e4f452d","year":2025},"citing_paper":{"arxiv_id":"2604.18663","last_updated":"2026-04-20T12:33:52Z","snapshot_observed_at":"2026-07-06T23:05:30.879164Z","submitted_at":"2026-04-20T12:33:52Z","title":"Beyond Explicit Refusals: Soft-Failure Attacks on Retrieval-Augmented Generation","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-05-10T04:56:37.758533Z"},"links":{"cited_paper":"/paper/2505.18543","citing_paper":"/paper/2604.18663"},"observation_digest":"sha256:8d36ac93542f8d89cbce33c4c83e272b8b908d2f33483b40144fec63138887cd","observation_id":"34db4841-77b2-405e-9cc4-9e5b2f3cae30","resolution":{"observed_at":"2026-05-10T11:05:08.995921Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"cited_work":{"arxiv_id":"2505.18543","doi":"10.48550/arxiv.2505.18543","metadata_source":"arxiv_reference","pith_arxiv_id":"2505.18543","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Benchmarking poisoning attacks against retrieval- augmented generation","venue":"ArXiv.org","work_id":"ed956317-f245-44d0-b530-4f127e4f452d","year":2025},"citing_paper":{"arxiv_id":"2605.01782","last_updated":"2026-05-03T08:42:29Z","snapshot_observed_at":"2026-07-31T09:19:52.528360Z","submitted_at":"2026-05-03T08:42:29Z","title":"Needle-in-RAG: Prompt-Conditioned Character-Level Traceback of Poisoned Spans in Retrieved Evidence","version":1},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-05-10T14:52:32.202125Z"},"links":{"cited_paper":"/paper/2505.18543","citing_paper":"/paper/2605.01782"},"observation_digest":"sha256:decd9babc1436865580122298104de2810faa0d8c91a448bf7dce08aecb80aec","observation_id":"1a48d20e-4d14-47e9-8eec-0afedf1b35b6","resolution":{"observed_at":"2026-05-11T11:31:00.568084Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"cited_work":{"arxiv_id":"2505.18543","doi":"10.48550/arxiv.2505.18543","metadata_source":"arxiv_reference","pith_arxiv_id":"2505.18543","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Benchmarking poisoning attacks against retrieval- augmented generation","venue":"ArXiv.org","work_id":"ed956317-f245-44d0-b530-4f127e4f452d","year":2025},"citing_paper":{"arxiv_id":"2605.09822","last_updated":"2026-05-10T23:55:13Z","snapshot_observed_at":"2026-08-05T13:34:08.474381Z","submitted_at":"2026-05-10T23:55:13Z","title":"Oracle Poisoning: Corrupting Knowledge Graphs to Weaponise AI Agent Reasoning","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-05-12T02:27:06.805794Z"},"links":{"cited_paper":"/paper/2505.18543","citing_paper":"/paper/2605.09822"},"observation_digest":"sha256:95c5f88d00c8e4ffc8ce85147201be1f6bef16443f7a039af81b20cebef86668","observation_id":"83afcb06-1e9c-4027-a6cc-d3f14ce00e72","resolution":{"observed_at":"2026-05-12T07:37:03.462355Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"cited_work":{"arxiv_id":"2505.18543","doi":"10.48550/arxiv.2505.18543","metadata_source":"arxiv_reference","pith_arxiv_id":"2505.18543","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Benchmarking poisoning attacks against retrieval- augmented generation","venue":"ArXiv.org","work_id":"ed956317-f245-44d0-b530-4f127e4f452d","year":2025},"citing_paper":{"arxiv_id":"2605.28074","last_updated":"2026-05-27T07:30:30Z","snapshot_observed_at":"2026-08-02T21:44:55.814873Z","submitted_at":"2026-05-27T07:30:30Z","title":"SilentRetrieval: Hijacking Retrieval-Augmented Generation via Semantically-Preserving Adversarial Data Poisoning","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-06-29T11:49:32.880569Z"},"links":{"cited_paper":"/paper/2505.18543","citing_paper":"/paper/2605.28074"},"observation_digest":"sha256:2cf767ce175f56e024cdd5fad3de68df00d00a7d92193df055f5196e3ee8b676","observation_id":"d41c560b-076f-4b89-bed5-7b7230de202b","resolution":{"observed_at":"2026-06-29T11:53:23.247611Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.18543","snapshot_observed_at":"2026-07-30T10:56:48.116996Z","title":"Benchmarking poisoning attacks against retrieval- augmented generation,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.23838","last_updated":"2026-07-26T20:52:23Z","snapshot_observed_at":"2026-08-05T00:15:21.105413Z","submitted_at":"2026-07-26T20:52:23Z","title":"TriShieldRAG: A Three-Ring Defense-in-Depth Framework Against Knowledge Corruption in Retrieval-Augmented Generation","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-07-30T10:56:48.116996Z"},"links":{"cited_paper":"/paper/2505.18543","citing_paper":"/paper/2607.23838"},"observation_digest":"sha256:603a604ad8085745ca8dd5bb0c51cdd837881abc31e03e32658d5e9825ec2a92","observation_id":"61e0e649-2c5d-45e0-ba93-81d2ba35811d","resolution":{"observed_at":"2026-07-30T10:56:48.116996Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2505.18543/citation-record","integrity":"/paper/2505.18543/integrity","json":"/paper/2505.18543/citation-record.json","paper":"/paper/2505.18543"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:54.584518Z","title":"https://www.anthropic.com/news/claude-3-7-sonnet","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:54.584518Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:15a103f710a3dbc3ed250d6a2ce0e982a162f7e1f89df6a7c3a5514d1bf71e17","observation_id":"eb515526-36eb-4ddb-ac1d-6403d158fcc6","resolution":{"observed_at":"2026-08-07T14:32:54.584518Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:54.611951Z","title":"https://blog.google/ technology/google-deepmind/google-gemini-ai-update-december-2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:54.611951Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:116661a0222498a9aa091c30167bd7c82fe8847fb746d81b141f4d25ccd46420","observation_id":"ae8db373-cc3f-40cb-a7de-59a73978ca30","resolution":{"observed_at":"2026-08-07T14:32:54.611951Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:54.633958Z","title":"https://openai.com/index/gpt-4-1","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:54.633958Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:272552200e67fe124522ea26703d287e33da8cef6ba438d6569159967e501e3b","observation_id":"0857b61f-942c-4c97-bef6-67570aa588ab","resolution":{"observed_at":"2026-08-07T14:32:54.633958Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:54.681873Z","title":"https://modelcontextprotocol.io/ introduction","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:54.681873Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:ecb33b96614b7f863d424d770a49f2686ed643a2266b09f56adb22568e07492e","observation_id":"643ff895-629f-499f-ac38-a81905bcf1a5","resolution":{"observed_at":"2026-08-07T14:32:54.681873Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:54.740720Z","title":"https://www.llama.com/models/llama-4","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:54.740720Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:c7638f589b4cfadb3346f00cb0d66a37c71afc7f8a813e977594403d4236c122","observation_id":"58c03155-f4a8-40ac-9815-68c44326f6db","resolution":{"observed_at":"2026-08-07T14:32:54.740720Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:54.758341Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:54.758341Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:3be22c6bbcb4be2f90b9f825eda08bf7c963c4d673af9c321c51974c903699cc","observation_id":"6e4f394b-0e7b-49e4-93df-4e9fc216083a","resolution":{"observed_at":"2026-08-07T14:32:54.758341Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2303.08774","last_updated":"2024-03-04T06:01:33Z","snapshot_observed_at":"2026-08-07T07:30:12.213965Z","submitted_at":"2023-03-15T17:15:04Z","title":"GPT-4 Technical Report","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.08774","snapshot_observed_at":"2026-08-07T14:32:54.807646Z","title":"Gpt-4 technical report","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:54.807646Z"},"links":{"cited_paper":"/paper/2303.08774","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:da5de00ff291aa58bb300644961559f7598e19926c590d9a7ae5698c9c7f3282","observation_id":"7023bea6-c370-4cc5-a31c-916988a544f6","resolution":{"observed_at":"2026-08-07T14:32:54.807646Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:54.846051Z","title":"Trec ikat 2023: A test collection for evaluating conversational and interactive knowledge assistants","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:54.846051Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:7b6d5e2c8e40c37d64edb318d94ef14d3e090e60818e8369a32d5def6275ebca","observation_id":"64299fff-671c-49d4-aaf4-19f231b63137","resolution":{"observed_at":"2026-08-07T14:32:54.846051Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.10403","last_updated":"2023-09-13T20:35:45Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-05-17T17:46:53Z","title":"PaLM 2 Technical Report","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.10403","snapshot_observed_at":"2026-08-07T14:32:54.871001Z","title":"Palm 2 technical report","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:54.871001Z"},"links":{"cited_paper":"/paper/2305.10403","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:8ede1e4d8fd72f326b8a11d3302b8030c3cdae28d8572ba8adfb1dbafcbc1e8a","observation_id":"aba5cffd-0f26-43ef-92b9-ea45c14f564c","resolution":{"observed_at":"2026-08-07T14:32:54.871001Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:54.920453Z","title":"Improving language models by retrieving from trillions of tokens","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:54.920453Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:af6df7a5d182667c163ecfc7d93a55e0d8cd59af23810ebcc1e4222dcc343653","observation_id":"c43278b2-fc8d-4757-b363-d31da86312d4","resolution":{"observed_at":"2026-08-07T14:32:54.920453Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:55.070616Z","title":"Language models are few-shot learners","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:55.070616Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:cf2d65979a0c9074be43f89472924cbd66cdeb4efb4678d7fb724871c7415278","observation_id":"23918784-0ac5-4ee5-b537-342b8cfdf8ea","resolution":{"observed_at":"2026-08-07T14:32:55.070616Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:55.208722Z","title":"Poisoning web-scale training datasets is practical","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:55.208722Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:891546e0ddbcfb08b261c83b1f2088c0058602e338189fce64d75406e40e07f9","observation_id":"38dc0dc6-1b9b-4457-8321-342623c23181","resolution":{"observed_at":"2026-08-07T14:32:55.208722Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.00610","last_updated":"2024-03-31T08:58:54Z","snapshot_observed_at":"2026-08-09T13:15:07.647793Z","submitted_at":"2024-03-31T08:58:54Z","title":"RQ-RAG: Learning to Refine Queries for Retrieval Augmented Generation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.00610","snapshot_observed_at":"2026-08-07T14:32:55.354259Z","title":"Rq-rag: Learning to refine queries for retrieval augmented generation","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:55.354259Z"},"links":{"cited_paper":"/paper/2404.00610","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:712ddbdf3647b3ca98ad080a8d4b352262286ea4df2a7182f308653bc37a5ea8","observation_id":"fa32781c-72a6-42de-83ed-2a3ed211942f","resolution":{"observed_at":"2026-08-07T14:32:55.354259Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.11548","last_updated":"2026-04-09T01:58:59Z","snapshot_observed_at":"2026-07-06T21:25:13.481613Z","submitted_at":"2025-05-15T08:14:58Z","title":"One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.11548","snapshot_observed_at":"2026-08-07T14:32:55.442214Z","title":"One shot dominance: Knowledge poisoning attack on retrieval-augmented generation systems","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:55.442214Z"},"links":{"cited_paper":"/paper/2505.11548","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:bb0bf500a45d77bf9c542cbabe29c62188de66475efec44e12e7fcfecff60a09","observation_id":"64cfae5a-c39a-413e-966f-63f4d9274ef6","resolution":{"observed_at":"2026-08-07T14:32:55.442214Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:55.545101Z","title":"Phantom: General trigger attacks on retrieval augmented language generation","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:55.545101Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:8a8420526348927ce7c3eae5e702129b98770ab0e63d1cf631522a75049b8b03","observation_id":"4c67b0c5-ddc2-4d7f-acf8-be75083c4300","resolution":{"observed_at":"2026-08-07T14:32:55.545101Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:55.637930Z","title":"Benchmarking large language mod- els in retrieval-augmented generation","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:55.637930Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:feeb4a8703f4f49fded206a47e3e87d18e283b06b5472c752296e5e20bdbbb06","observation_id":"50c12053-cd4b-4c95-ba21-572ceb7fb9e2","resolution":{"observed_at":"2026-08-07T14:32:55.637930Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2210.02928","last_updated":"2022-10-20T17:16:27Z","snapshot_observed_at":"2026-08-06T23:46:49.824788Z","submitted_at":"2022-10-06T13:58:03Z","title":"MuRAG: Multimodal Retrieval-Augmented Generator for Open Question Answering over Images and Text","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2210.02928","snapshot_observed_at":"2026-08-07T14:32:55.658464Z","title":"Murag: Multimodal retrieval-augmented generator for open question answering over images and text","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:55.658464Z"},"links":{"cited_paper":"/paper/2210.02928","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:a328c245d539e1f19061f07f6c7b26d4c0e41feb96d00cbbe7aad8860c660b2d","observation_id":"cc5f52d0-1f83-43f5-b11b-3be84cc33e1f","resolution":{"observed_at":"2026-08-07T14:32:55.658464Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2302.11713","last_updated":"2023-10-17T14:19:13Z","snapshot_observed_at":"2026-08-09T12:57:27.007641Z","submitted_at":"2023-02-23T00:33:54Z","title":"Can Pre-trained Vision and Language Models Answer Visual Information-Seeking Questions?","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2302.11713","snapshot_observed_at":"2026-08-07T14:32:55.697518Z","title":"Can pre-trained vision and language models answer visual information-seeking questions? arXiv preprint arXiv:2302.11713, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:55.697518Z"},"links":{"cited_paper":"/paper/2302.11713","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:f7201dfb318382642b88519227eba2abe5df8e3d4f6529d627589cad8dca70d2","observation_id":"c1780cfb-b22e-4278-807b-4b7dcdd9248a","resolution":{"observed_at":"2026-08-07T14:32:55.697518Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:55.773914Z","title":"Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:55.773914Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:a9263345e35ad4281d4f8b4c5b5ab0b57d4e44778e90bfc4a14328c68fe8ba53","observation_id":"cd8320f5-4d1a-443a-9a54-047f25fc888a","resolution":{"observed_at":"2026-08-07T14:32:55.773914Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:55.887118Z","title":"Flipedrag: Black-box opinion manipulation attacks to retrieval- augmented generation of large language models","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:55.887118Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:c117ae1d379221363eac097b0057e82defff33c59ff9a8fefba8dbdfde1a284e","observation_id":"d4bf530a-d7be-4bf1-8238-a5dbb768c4b2","resolution":{"observed_at":"2026-08-07T14:32:55.887118Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.13401","last_updated":"2024-07-07T05:03:53Z","snapshot_observed_at":"2026-07-06T18:17:46.369537Z","submitted_at":"2024-05-22T07:21:32Z","title":"TrojanRAG: Retrieval-Augmented Generation Can Be Backdoor Driver in Large Language Models","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.13401","snapshot_observed_at":"2026-08-07T14:32:55.989945Z","title":"Trojanrag: Retrieval-augmented generation can be backdoor driver in large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:55.989945Z"},"links":{"cited_paper":"/paper/2405.13401","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:36138974545207ce091bcafeaebfec445943626e90711930c3933247b62e96d9","observation_id":"c6a40ba3-7413-49b3-ba06-8121ceb5ab82","resolution":{"observed_at":"2026-08-07T14:32:55.989945Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.23090","last_updated":"2024-10-30T15:06:32Z","snapshot_observed_at":"2026-08-09T01:16:08.616783Z","submitted_at":"2024-10-30T15:06:32Z","title":"CORAL: Benchmarking Multi-turn Conversational Retrieval-Augmentation Generation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.23090","snapshot_observed_at":"2026-08-07T14:32:56.150927Z","title":"Coral: Benchmarking multi-turn conversational retrieval-augmentation generation","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.150927Z"},"links":{"cited_paper":"/paper/2410.23090","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:8554aa67ffc84e1a2463be245407f34ed1b140a4d31b2260070dc8c85ce4f051","observation_id":"c2dcd335-ad68-4fca-a280-e63feeea52f7","resolution":{"observed_at":"2026-08-07T14:32:56.150927Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.13948","last_updated":"2024-10-22T14:07:57Z","snapshot_observed_at":"2026-07-06T18:03:33.406287Z","submitted_at":"2024-04-22T07:49:36Z","title":"Typos that Broke the RAG's Back: Genetic Attack on RAG Pipeline by Simulating Documents in the Wild via Low-level Perturbations","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.13948","snapshot_observed_at":"2026-08-07T14:32:56.319699Z","title":"Typos that broke the rag’s back: Genetic attack on rag pipeline by simulating documents in the wild via low-level perturbations","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.319699Z"},"links":{"cited_paper":"/paper/2404.13948","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:f2b72328963af7727b2a8b058981f1d1cdac28d5a34e5e6f44a94ed055cec9d6","observation_id":"5e4051a2-0940-449c-bbcc-940cfc2150f4","resolution":{"observed_at":"2026-08-07T14:32:56.319699Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:56.452133Z","title":"The rag paradox: A black-box attack exploiting unintentional vulnerabilities in retrieval-augmented generation systems","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.452133Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:29bac165a9fde64a6ca07ba00243603af1a082dc1629a439dd8b507c095e7249","observation_id":"af08a444-e465-442d-913d-d06fea622b93","resolution":{"observed_at":"2026-08-07T14:32:56.452133Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1905.10044","last_updated":"2019-05-24T05:48:49Z","snapshot_observed_at":"2026-07-06T07:55:12.121264Z","submitted_at":"2019-05-24T05:48:49Z","title":"BoolQ: Exploring the Surprising Difficulty of Natural Yes/No Questions","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1905.10044","snapshot_observed_at":"2026-08-07T14:32:56.493361Z","title":"Boolq: Exploring the surprising difficulty of natural yes/no questions","venue":null,"work_id":null,"year":1905},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.493361Z"},"links":{"cited_paper":"/paper/1905.10044","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:3e737b8010407e51703a1511c5dac2124872fc14e1e8832c212f2b25289bec3a","observation_id":"0cd633ec-05aa-4362-ab10-094ec0fb47af","resolution":{"observed_at":"2026-08-07T14:32:56.493361Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:56.531007Z","title":"The power of noise: Redefining retrieval for rag systems","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.531007Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:7f731476957d1c6619f8757e2f0fce6333165990e5c3a0cb586ca3cd48b1e37f","observation_id":"2e4aeb03-d6d5-4a7a-92dc-0872acf117ef","resolution":{"observed_at":"2026-08-07T14:32:56.531007Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.10997","last_updated":"2024-03-27T09:16:57Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-12-18T07:47:33Z","title":"Retrieval-Augmented Generation for Large Language Models: A Survey","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.10997","snapshot_observed_at":"2026-08-07T14:32:56.573813Z","title":"Retrieval-augmented generation for large language models: A survey","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.573813Z"},"links":{"cited_paper":"/paper/2312.10997","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:28e35901ac8ae6debb7768aeba0c69e7473258e872cbbda81a60a01458b65307","observation_id":"9d2fd507-02b2-4ea7-b9a0-48579515f91d","resolution":{"observed_at":"2026-08-07T14:32:56.573813Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:56.680823Z","title":"Did aristotle use a laptop? a question answering benchmark with implicit reasoning strategies","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.680823Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:3ce337b1b6646bf326cc840f90da9cc0205abbfc1a4599501a8e120008859f6e","observation_id":"3a2643ec-c27c-4d98-971e-af52f1cc1db8","resolution":{"observed_at":"2026-08-07T14:32:56.680823Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:56.692225Z","title":"Topic-fliprag: Topic-orientated adversarial opinion manipulation attacks to retrieval-augmented generation models","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.692225Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:491d94067bf3bba12dd477e12d21f90fb8313ab33fd6976b77cee7ddd724e995","observation_id":"e8743175-d732-43ce-b914-a907cefe0218","resolution":{"observed_at":"2026-08-07T14:32:56.692225Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2501.12948","last_updated":"2026-01-04T03:57:36Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-01-22T15:19:35Z","title":"DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2501.12948","snapshot_observed_at":"2026-08-07T14:32:56.696425Z","title":"Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.696425Z"},"links":{"cited_paper":"/paper/2501.12948","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:3810d3e96bdedb1af6a1414d7e7a65d62c809cd5c9d9882f7d47007561ca8676","observation_id":"c0b00558-31dd-4191-a7ce-c8bbc7b5da10","resolution":{"observed_at":"2026-08-07T14:32:56.696425Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.21276","last_updated":"2024-10-25T17:43:01Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-10-25T17:43:01Z","title":"GPT-4o System Card","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.21276","snapshot_observed_at":"2026-08-07T14:32:56.786445Z","title":"Gpt-4o system card","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.786445Z"},"links":{"cited_paper":"/paper/2410.21276","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:774520906cf4fa010fe536b9decccbd31fe181a52ebfdd21fc67cffd3a5e1c1f","observation_id":"da75b75a-9208-4cc9-a5a5-c2e6981ba25d","resolution":{"observed_at":"2026-08-07T14:32:56.786445Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2112.09118","last_updated":"2022-08-29T12:17:32Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2021-12-16T18:57:37Z","title":"Unsupervised Dense Information Retrieval with Contrastive Learning","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2112.09118","snapshot_observed_at":"2026-08-07T14:32:56.815949Z","title":"Unsupervised dense information retrieval with contrastive learning","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.815949Z"},"links":{"cited_paper":"/paper/2112.09118","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:c10470269fb944666d9d998792113f48116d9fd44213dec18cbb6b64276b1004","observation_id":"fbd9e164-e37c-4b57-956f-3305db231dda","resolution":{"observed_at":"2026-08-07T14:32:56.815949Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.00614","last_updated":"2023-09-04T17:47:36Z","snapshot_observed_at":"2026-07-06T16:13:23.343694Z","submitted_at":"2023-09-01T17:59:44Z","title":"Baseline Defenses for Adversarial Attacks Against Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.00614","snapshot_observed_at":"2026-08-07T14:32:56.855487Z","title":"Baseline de- fenses for adversarial attacks against aligned language models.arXiv preprint arXiv:2309.00614, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.855487Z"},"links":{"cited_paper":"/paper/2309.00614","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:a7158e65b4b869f3d5c7ea9b8debb8e5178f07ac8d9cc2a9a59319c77d5005ea","observation_id":"f16bfc5d-3549-4832-ab58-81d609ddc017","resolution":{"observed_at":"2026-08-07T14:32:56.855487Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:56.885628Z","title":"Interpolated estimation of markov source parameters from sparse data","venue":null,"work_id":null,"year":1980},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.885628Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:ecdb809a3670c547a3f5c8cdd3b8eab86872b05f9f344e5ec58217f8c8eb9c3f","observation_id":"b5043607-4dc8-4f12-bf13-abc547788d41","resolution":{"observed_at":"2026-08-07T14:32:56.885628Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.14403","last_updated":"2024-03-28T06:45:11Z","snapshot_observed_at":"2026-08-04T09:23:59.079378Z","submitted_at":"2024-03-21T13:52:30Z","title":"Adaptive-RAG: Learning to Adapt Retrieval-Augmented Large Language Models through Question Complexity","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.14403","snapshot_observed_at":"2026-08-07T14:32:56.955402Z","title":"Adaptive-rag: Learning to adapt retrieval-augmented large language models through question complexity","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.955402Z"},"links":{"cited_paper":"/paper/2403.14403","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:dd3a889a15012aeb77bb4379d4f58ec5764285a32b3d8d0c31fdb36119d7c527","observation_id":"00b2ce9f-8a68-46c1-9a83-0d7152b1a3bf","resolution":{"observed_at":"2026-08-07T14:32:56.955402Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.14110","last_updated":"2025-08-08T11:56:30Z","snapshot_observed_at":"2026-08-02T10:24:11.927887Z","submitted_at":"2024-11-21T13:18:03Z","title":"Feedback-Guided Extraction of Knowledge Base from Retrieval-Augmented LLM Applications","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2411.14110","snapshot_observed_at":"2026-08-07T14:32:57.001435Z","title":"Rag-thief: Scalable extraction of private data from retrieval-augmented generation applications with agent-based attacks","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.001435Z"},"links":{"cited_paper":"/paper/2411.14110","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:f6a6762c9dcca4c5cb6bf5fd0ce6b0544c2079532549613c6ec2e7f1135f521a","observation_id":"11ef88db-0564-4add-aea8-30e540ca2488","resolution":{"observed_at":"2026-08-07T14:32:57.001435Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.06983","last_updated":"2023-10-22T00:11:13Z","snapshot_observed_at":"2026-07-06T15:26:06.998516Z","submitted_at":"2023-05-11T17:13:40Z","title":"Active Retrieval Augmented Generation","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.06983","snapshot_observed_at":"2026-08-07T14:32:57.036232Z","title":"Active retrieval augmented generation","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.036232Z"},"links":{"cited_paper":"/paper/2305.06983","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:88aa93dcbe9da49aa1cfee659c8ed8a836c1b8e03a77c5450fede69ee591c896","observation_id":"ce9e1479-6608-4898-b3ed-06f61f811288","resolution":{"observed_at":"2026-08-07T14:32:57.036232Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.07717","last_updated":"2025-06-20T10:23:40Z","snapshot_observed_at":"2026-08-07T16:06:52.667333Z","submitted_at":"2025-04-10T13:09:50Z","title":"PR-Attack: Coordinated Prompt-RAG Attacks on Retrieval-Augmented Generation in Large Language Models via Bilevel Optimization","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.07717","snapshot_observed_at":"2026-08-07T14:32:57.110743Z","title":"Pr-attack: Coordinated prompt-rag attacks on retrieval-augmented generation in large language models via bilevel optimization","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.110743Z"},"links":{"cited_paper":"/paper/2504.07717","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:d82d74945d39386f809d3bcd6def7ded58920be3a9ba3c17f6fa88aa185042c5","observation_id":"78610109-bc3a-4a30-a63e-a61d16299297","resolution":{"observed_at":"2026-08-07T14:32:57.110743Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.13576","last_updated":"2025-02-24T02:46:52Z","snapshot_observed_at":"2026-08-08T09:22:36.004067Z","submitted_at":"2024-05-22T12:12:40Z","title":"FlashRAG: A Modular Toolkit for Efficient Retrieval-Augmented Generation Research","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.13576","snapshot_observed_at":"2026-08-07T14:32:57.144351Z","title":"Flashrag: A modular toolkit for efficient retrieval-augmented generation research","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.144351Z"},"links":{"cited_paper":"/paper/2405.13576","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:f1f3c13e8873a628894278ba843e908bddaabbb18029c580215bcc534bab4e7f","observation_id":"e3930e9d-7551-46ad-b14b-e66ab494071f","resolution":{"observed_at":"2026-08-07T14:32:57.144351Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2004.04906","last_updated":"2020-09-30T21:27:13Z","snapshot_observed_at":"2026-07-06T09:11:26.109763Z","submitted_at":"2020-04-10T04:53:17Z","title":"Dense Passage Retrieval for Open-Domain Question Answering","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2004.04906","snapshot_observed_at":"2026-08-07T14:32:57.180310Z","title":"Dense passage retrieval for open-domain question answering","venue":null,"work_id":null,"year":2004},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.180310Z"},"links":{"cited_paper":"/paper/2004.04906","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:b9c00168b1de541ea97d1000163791e49a121481e4f2bb01879983b55def84e1","observation_id":"759c364f-7a02-4b20-9ba5-983c77c6b480","resolution":{"observed_at":"2026-08-07T14:32:57.180310Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2501.03468","last_updated":"2025-01-07T01:52:56Z","snapshot_observed_at":"2026-07-06T20:17:24.683086Z","submitted_at":"2025-01-07T01:52:56Z","title":"MTRAG: A Multi-Turn Conversational Benchmark for Evaluating Retrieval-Augmented Generation Systems","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2501.03468","snapshot_observed_at":"2026-08-07T14:32:57.233051Z","title":"Mtrag: A multi-turn conversational benchmark for evaluating retrieval-augmented generation systems.arXiv preprint arXiv:2501.03468, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.233051Z"},"links":{"cited_paper":"/paper/2501.03468","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:e1f299f6bb9f4be2e2bc8947b2d09687806c8f287242ad3acbf65dca360bc75f","observation_id":"b814be3e-e3fc-48e9-8bed-c17ed713b0eb","resolution":{"observed_at":"2026-08-07T14:32:57.233051Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.13081","last_updated":"2024-04-17T01:15:54Z","snapshot_observed_at":"2026-07-06T18:02:53.240463Z","submitted_at":"2024-04-17T01:15:54Z","title":"SuRe: Summarizing Retrievals using Answer Candidates for Open-domain QA of LLMs","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.13081","snapshot_observed_at":"2026-08-07T14:32:57.295105Z","title":"Sure: Summarizing retrievals using answer candidates for open-domain qa of llms","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.295105Z"},"links":{"cited_paper":"/paper/2404.13081","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:e21ac409d16200bd5e00f68603c48cf688d7dde11aa40286c025719768f2974e","observation_id":"752c2593-87c5-4ba8-a28c-f27132dbc365","resolution":{"observed_at":"2026-08-07T14:32:57.295105Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2409.12558","last_updated":"2025-02-21T19:04:28Z","snapshot_observed_at":"2026-07-06T19:18:04.618039Z","submitted_at":"2024-09-19T08:26:45Z","title":"RAD-Bench: Evaluating Large Language Models Capabilities in Retrieval Augmented Dialogues","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.12558","snapshot_observed_at":"2026-08-07T14:32:57.345015Z","title":"Rad-bench: Evaluating large language models capabilities in retrieval augmented dia- logues","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.345015Z"},"links":{"cited_paper":"/paper/2409.12558","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:ee2e492d71163a6b89a6744e0235bd0f8e66ae767b8207f34ff02750cf41423d","observation_id":"3748f086-724c-41fd-a4f5-1bb7ec0b7c11","resolution":{"observed_at":"2026-08-07T14:32:57.345015Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:57.398975Z","title":"Natural questions: a benchmark for question answering research","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.398975Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:11467971870e874a83584f32308881f8137dddbdae3e21c60e112117fb108668","observation_id":"f386655e-c817-471e-9fe2-c9f55c3f2ae5","resolution":{"observed_at":"2026-08-07T14:32:57.398975Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.16701","last_updated":"2025-08-30T16:41:13Z","snapshot_observed_at":"2026-08-04T23:45:22.277732Z","submitted_at":"2024-12-21T16:59:00Z","title":"AlzheimerRAG: Multimodal Retrieval Augmented Generation for Clinical Use Cases using PubMed articles","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.16701","snapshot_observed_at":"2026-08-07T14:32:57.426171Z","title":"Alzheimerrag: Multimodal retrieval augmented generation for pubmed articles","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.426171Z"},"links":{"cited_paper":"/paper/2412.16701","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:08166761ffe1152c99c5927d24b2fe07d985151475a085121d4b67a701d5137d","observation_id":"0edb92d7-7eee-4ece-8bd8-34a34f868674","resolution":{"observed_at":"2026-08-07T14:32:57.426171Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:57.461562Z","title":"Retrieval-augmented generation for knowledge-intensive nlp tasks","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.461562Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:e1a3be4cd0f97f8a16e7252747ec7b838a30703080490473b72b98158e585923","observation_id":"894c6faf-ea8b-46d8-b131-31dafac7bfc8","resolution":{"observed_at":"2026-08-07T14:32:57.461562Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:57.498679Z","title":"Seeing is believing: Black-box member- ship inference attacks against retrieval augmented generation","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.498679Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:92c73053ba8127952f83b15a130bf1e5966e0b5bb41fdc9518a80ef027c00d3c","observation_id":"729a7a0f-0f24-42ec-a575-6b483fbbb14c","resolution":{"observed_at":"2026-08-07T14:32:57.498679Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2501.18636","last_updated":"2025-02-23T10:46:28Z","snapshot_observed_at":"2026-07-06T20:28:38.345613Z","submitted_at":"2025-01-28T17:01:31Z","title":"SafeRAG: Benchmarking Security in Retrieval-Augmented Generation of Large Language Model","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2501.18636","snapshot_observed_at":"2026-08-07T14:32:57.580657Z","title":"Saferag: Benchmarking security in retrieval-augmented generation of large language model","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.580657Z"},"links":{"cited_paper":"/paper/2501.18636","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:cf5cb739aa4ad57330f1f6b90c80d5245ededa4d8b65118d7b2c0592ae958d0c","observation_id":"68520974-af71-4bd0-88a9-2bde47f4dfa4","resolution":{"observed_at":"2026-08-07T14:32:57.580657Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.19437","last_updated":"2025-02-18T17:26:38Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-12-27T04:03:16Z","title":"DeepSeek-V3 Technical Report","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.19437","snapshot_observed_at":"2026-08-07T14:32:57.638696Z","title":"Deepseek-v3 technical report","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.638696Z"},"links":{"cited_paper":"/paper/2412.19437","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:64580a5c6698d4f9a124eed2e1c33611179325bc9df410a3a446848b367569cc","observation_id":"d958df5b-73a0-4c35-8156-ce0fa693c920","resolution":{"observed_at":"2026-08-07T14:32:57.638696Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.06254","last_updated":"2025-03-14T04:16:23Z","snapshot_observed_at":"2026-08-07T17:20:04.863802Z","submitted_at":"2025-03-08T15:46:38Z","title":"Poisoned-MRAG: Knowledge Poisoning Attacks to Multimodal Retrieval Augmented Generation","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.06254","snapshot_observed_at":"2026-08-07T14:32:57.726747Z","title":"Poisoned-mrag: Knowledge poisoning attacks to multimodal retrieval augmented generation","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.726747Z"},"links":{"cited_paper":"/paper/2503.06254","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:608e3c0c1dd855db68eb58f48f1b67da8315bf93da2113787fd15f8d2f12e195","observation_id":"a97f2a88-7634-424f-851f-340b3af38c68","resolution":{"observed_at":"2026-08-07T14:32:57.726747Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:57.761534Z","title":"Formalizing and benchmarking prompt injection attacks and defenses","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.761534Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:fb3fbaa24a1605a22a06b1e2c1ae94dbd6f3d7b2c567b0add4f8db6db6c90ee6","observation_id":"4a77545b-7d76-4a18-9cbe-493bd037948d","resolution":{"observed_at":"2026-08-07T14:32:57.761534Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:05.100454Z","title":"Backdoor attacks on dense passage retrievers for disseminating misinformation","venue":null,"work_id":"b0d83c49-f580-4dea-809d-8ac1df58589e","year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.811453Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:9710d503c366983c6078d96636968df7a4e43b89fda1bf363c5f00df08cbe320","observation_id":"33ab162c-ddc5-420f-8af4-294eeee17022","resolution":{"observed_at":"2026-08-07T14:33:05.173215Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:04.904600Z","title":"Making llms worth every penny: Resource-limited text classification in banking","venue":null,"work_id":"90fde44f-d627-4d9c-9052-0cfb37e14059","year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.873477Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:ecf2f6b6f03e425cb5b5d206e42f151fd21b7cf29b1018637dc9c274b52abe9a","observation_id":"5e2d1d09-bd51-4d8c-b069-5f0ea0f5f0ef","resolution":{"observed_at":"2026-08-07T14:33:04.999994Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2311.10813","last_updated":"2024-07-28T23:37:51Z","snapshot_observed_at":"2026-08-09T11:49:35.152299Z","submitted_at":"2023-11-17T18:59:56Z","title":"A Language Agent for Autonomous Driving","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.10813","snapshot_observed_at":"2026-08-07T14:32:57.939867Z","title":"A language agent for autonomous driving","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.939867Z"},"links":{"cited_paper":"/paper/2311.10813","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:eaa846d260bcc2c3a9dee5222a8484e2b1a4c961b638093323a8895d02c6a890","observation_id":"9f49b828-256e-4597-8975-7a03c49259bd","resolution":{"observed_at":"2026-08-07T14:32:57.939867Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.15576","last_updated":"2025-08-05T18:18:07Z","snapshot_observed_at":"2026-08-03T13:22:50.970205Z","submitted_at":"2024-10-21T01:54:46Z","title":"A Survey of Conversational Search","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.15576","snapshot_observed_at":"2026-08-07T14:32:58.003425Z","title":"A survey of conversational search","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.003425Z"},"links":{"cited_paper":"/paper/2410.15576","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:e8a45b1a199973b4e97124bf53d3f4164c8e014c3aa204d8cd5eac15e6ae6ef6","observation_id":"a66ddbce-4b21-4dfe-bb4f-fcc24468d40a","resolution":{"observed_at":"2026-08-07T14:32:58.003425Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.00306","last_updated":"2025-06-30T16:37:59Z","snapshot_observed_at":"2026-08-09T13:08:17.959330Z","submitted_at":"2025-02-01T04:01:18Z","title":"Riddle Me This! Stealthy Membership Inference for Retrieval-Augmented Generation","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.00306","snapshot_observed_at":"2026-08-07T14:32:58.039510Z","title":"Riddle me this! stealthy membership inference for retrieval-augmented generation","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.039510Z"},"links":{"cited_paper":"/paper/2502.00306","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:72407f69c27e3992162b3417ecdce16642696337e117b47c59d3dcfdae71fb0a","observation_id":"ef56b0a2-998e-459a-8780-63760ddd077d","resolution":{"observed_at":"2026-08-07T14:32:58.039510Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:58.065588Z","title":"Ms marco: A human-generated machine reading comprehension dataset","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.065588Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:f28bffbd7d1477c394565c73e99f0efbee76c8f5be3d4f1b1969cc8a93e321d0","observation_id":"088a6e46-0538-449b-a100-58205d8fc4ba","resolution":{"observed_at":"2026-08-07T14:32:58.065588Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1606.05250","last_updated":"2016-10-11T02:42:36Z","snapshot_observed_at":"2026-08-08T11:05:45.903773Z","submitted_at":"2016-06-16T16:36:00Z","title":"SQuAD: 100,000+ Questions for Machine Comprehension of Text","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1606.05250","snapshot_observed_at":"2026-08-07T14:32:58.087928Z","title":"Squad: 100,000+ questions for machine comprehension of text","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.087928Z"},"links":{"cited_paper":"/paper/1606.05250","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:38f45c042e4b966a25703406adc872290cdb26c9124ee6aab4a3db7f2cbb96d2","observation_id":"6fe3f7de-d08f-40df-b732-c9742e05cb1b","resolution":{"observed_at":"2026-08-07T14:32:58.087928Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.04870","last_updated":"2024-10-23T05:55:31Z","snapshot_observed_at":"2026-07-06T18:58:43.349175Z","submitted_at":"2024-08-09T05:20:05Z","title":"ConfusedPilot: Confused Deputy Risks in RAG-based LLMs","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.04870","snapshot_observed_at":"2026-08-07T14:32:58.142259Z","title":"Confusedpilot: Confused deputy risks in rag-based llms","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.142259Z"},"links":{"cited_paper":"/paper/2408.04870","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:02329d9c068e7c9638c10531ac814d1459e516a76d9cb78edce469cbfc84ec63","observation_id":"cb8b98b8-0102-46c7-8d13-1c1f8179ec3a","resolution":{"observed_at":"2026-08-07T14:32:58.142259Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:04.747171Z","title":"Ragchecker: A fine-grained framework for diagnosing retrieval-augmented generation","venue":null,"work_id":"182185d4-0439-40a5-94ca-60fb1cb308ea","year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.217110Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:181be9f886cbeefaf89eb431319f04806a431fcdc464f8efbbeb963ca5e573a6","observation_id":"949958ee-935c-452c-af47-0e47b10c7c1a","resolution":{"observed_at":"2026-08-07T14:33:04.834256Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:04.574010Z","title":"Evaluating retrieval quality in retrieval-augmented gen- eration","venue":null,"work_id":"08775735-f02a-4d07-a3ac-be2d26e3133c","year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.286145Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:8bfa63194e767b930fd24d6c95b6dae3433b5d42350c4ece1e9e25046a04541d","observation_id":"61cde023-59f1-48aa-91e2-9cd438cb00ab","resolution":{"observed_at":"2026-08-07T14:33:04.673482Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.05870","last_updated":"2025-03-10T12:56:54Z","snapshot_observed_at":"2026-07-06T18:27:50.189771Z","submitted_at":"2024-06-09T17:55:55Z","title":"Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.05870","snapshot_observed_at":"2026-08-07T14:32:58.335827Z","title":"Machine against the rag: Jamming retrieval-augmented generation with blocker documents","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.335827Z"},"links":{"cited_paper":"/paper/2406.05870","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:551011bc39a3c36cafa9bfc9f05935818223cf96795d41a4ebb6ae8e00fd4c97","observation_id":"280d1d1c-91cd-405a-b6ca-2e22dfb36e5c","resolution":{"observed_at":"2026-08-07T14:32:58.335827Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.07128","last_updated":"2024-10-04T05:56:56Z","snapshot_observed_at":"2026-08-08T00:41:08.811604Z","submitted_at":"2024-01-13T18:09:05Z","title":"EHRAgent: Code Empowers Large Language Models for Few-shot Complex Tabular Reasoning on Electronic Health Records","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.07128","snapshot_observed_at":"2026-08-07T14:32:58.376475Z","title":"Ehragent: Code empowers large language models for few-shot complex tabular reasoning on electronic health records","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.376475Z"},"links":{"cited_paper":"/paper/2401.07128","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:548b272ec829a5c244f186dfccc9d307e037e0edc9cc1bc2c5bc0a5d903f4462","observation_id":"44637546-37a4-45af-9f19-36450d15649f","resolution":{"observed_at":"2026-08-07T14:32:58.376475Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:04.405754Z","title":"Trec 2019 news track overview","venue":null,"work_id":"1f6303f6-bd06-4feb-9f54-aa0fc4f76bde","year":2019},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.417532Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:4bf1b6493ad8ef365c854567ff4be836bed289bcc3a0ce0b992c4fc461ed7afb","observation_id":"1e7a13bf-88d0-4fc8-b588-1283af6c392b","resolution":{"observed_at":"2026-08-07T14:33:04.479907Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.05087","last_updated":"2024-10-25T03:57:07Z","snapshot_observed_at":"2026-08-07T19:09:35.400977Z","submitted_at":"2024-06-07T17:02:35Z","title":"Corpus Poisoning via Approximate Greedy Gradient Descent","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.05087","snapshot_observed_at":"2026-08-07T14:32:58.465950Z","title":"Corpus poisoning via approximate greedy gradient descent","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.465950Z"},"links":{"cited_paper":"/paper/2406.05087","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:f122476e5d799fc784fce1c5c5eea489dcae1750219c55e00f2f68066c5c2cfb","observation_id":"01b51a31-8c53-41c4-82da-36c89d5806a2","resolution":{"observed_at":"2026-08-07T14:32:58.465950Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.21680","last_updated":"2025-04-30T14:18:11Z","snapshot_observed_at":"2026-08-07T15:57:39.217854Z","submitted_at":"2025-04-30T14:18:11Z","title":"Hoist with His Own Petard: Inducing Guardrails to Facilitate Denial-of-Service Attacks on Retrieval-Augmented Generation of LLMs","version":1},"cited_work":{"arxiv_id":"2504.21680","doi":null,"metadata_source":"pith","pith_arxiv_id":"2504.21680","snapshot_observed_at":"2026-08-07T14:33:02.104918Z","title":"Hoist with His Own Petard: Inducing Guardrails to Facilitate Denial-of-Service Attacks on Retrieval-Augmented Generation of LLMs","venue":"cs.CR","work_id":"0084bcc6-eea2-45b2-adaa-693bb61664c1","year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.527972Z"},"links":{"cited_paper":"/paper/2504.21680","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:efbc7c1c3694a9c2b2421662059300ebbb9d1c1c8e0c911639278559ca9d85a9","observation_id":"cbad8f2e-2d8e-4b62-bb0a-ba33a3ec1543","resolution":{"observed_at":"2026-08-07T14:33:02.217503Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.19417","last_updated":"2024-06-26T05:36:23Z","snapshot_observed_at":"2026-08-07T17:25:16.874120Z","submitted_at":"2024-06-26T05:36:23Z","title":"\"Glue pizza and eat rocks\" -- Exploiting Vulnerabilities in Retrieval-Augmented Generative Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.19417","snapshot_observed_at":"2026-08-07T14:32:58.562417Z","title":"glue pizza and eat rocks","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.562417Z"},"links":{"cited_paper":"/paper/2406.19417","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:48d3a61d8b0186def23508aba0aa264b6a75f33bd2299db0d713db17cad0f7f9","observation_id":"75222880-261e-4c65-8a19-c9aa0d4cc94e","resolution":{"observed_at":"2026-08-07T14:32:58.562417Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:04.234151Z","title":"Beir: A heterogeneous benchmark for zero-shot evaluation of information retrieval models","venue":null,"work_id":"519d86c8-0e18-4ecb-ae9e-e40fe40de779","year":2021},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.621428Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:8ac1c5c4f6364e7bf73cfe53e681edb297a2ffc7db94ac85a1678d6af761668c","observation_id":"bcd31753-1910-4442-a9b9-d4de92e25569","resolution":{"observed_at":"2026-08-07T14:33:04.330229Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2201.08239","last_updated":"2022-02-10T16:30:11Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-01-20T15:44:37Z","title":"LaMDA: Language Models for Dialog Applications","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2201.08239","snapshot_observed_at":"2026-08-07T14:32:58.663864Z","title":"Lamda: Language models for dialog applications","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":69,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.663864Z"},"links":{"cited_paper":"/paper/2201.08239","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:e1dc126dd89e3a7a40577cad8e990c111bf9396637ed6f75c244782234868c9c","observation_id":"917588d1-f70d-4afd-8621-b167c17b6a8e","resolution":{"observed_at":"2026-08-07T14:32:58.663864Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2212.10509","last_updated":"2023-06-23T00:59:13Z","snapshot_observed_at":"2026-07-06T14:33:08.041820Z","submitted_at":"2022-12-20T18:26:34Z","title":"Interleaving Retrieval with Chain-of-Thought Reasoning for Knowledge-Intensive Multi-Step Questions","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2212.10509","snapshot_observed_at":"2026-08-07T14:32:58.713934Z","title":"Interleaving retrieval with chain-of-thought reasoning for knowledge-intensive multi-step questions","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":70,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.713934Z"},"links":{"cited_paper":"/paper/2212.10509","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:5da925b5db11403c3d2da7ef078e57f3c1419c842c08ba83c234d1cf53c4033d","observation_id":"49dde00f-fef8-4e05-8ceb-a73949af8933","resolution":{"observed_at":"2026-08-07T14:32:58.713934Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.07176","last_updated":"2025-05-31T04:07:21Z","snapshot_observed_at":"2026-08-08T23:47:25.246943Z","submitted_at":"2024-10-09T17:59:58Z","title":"Astute RAG: Overcoming Imperfect Retrieval Augmentation and Knowledge Conflicts for Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.07176","snapshot_observed_at":"2026-08-07T14:32:58.813809Z","title":"Astute rag: Overcoming imperfect retrieval augmentation and knowledge conflicts for large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":71,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.813809Z"},"links":{"cited_paper":"/paper/2410.07176","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:459f9b908120751cd5860c8cf97ada92d80e6f503a54b132bc1a1b2febf5b72f","observation_id":"b094a397-d9c0-48d4-9396-90462ab27fff","resolution":{"observed_at":"2026-08-07T14:32:58.813809Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:04.061410Z","title":"Instructrag: Instructing retrieval-augmented genera- tion with explicit denoising","venue":null,"work_id":"0fe3f5d3-d682-44f5-aef4-bf5ae7a78188","year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":72,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.883795Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:9dd54066bbff1bda48bc61ebc9d1ef6c88859fdd1bf663739bed950702f5f6a1","observation_id":"bab4faa9-f060-4f28-8b19-f0627f7af40a","resolution":{"observed_at":"2026-08-07T14:33:04.155188Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.13085","last_updated":"2025-03-03T03:08:28Z","snapshot_observed_at":"2026-08-02T03:49:38.796672Z","submitted_at":"2024-10-16T23:03:27Z","title":"MMed-RAG: Versatile Multimodal RAG System for Medical Vision Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.13085","snapshot_observed_at":"2026-08-07T14:32:58.946846Z","title":"Mmed-rag: Versatile multimodal rag system for medical vision language models","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":73,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.946846Z"},"links":{"cited_paper":"/paper/2410.13085","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:cb16d031896427bbe1b93698e6f3dae1e5ab61c87d95cca1ec184fdd68dbc5e6","observation_id":"69e9cec2-5a46-42f0-af9d-c514275dfb14","resolution":{"observed_at":"2026-08-07T14:32:58.946846Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:03.888134Z","title":"Rule: Reliable multimodal rag for factuality in medical vision language models","venue":null,"work_id":"bf85c523-338b-4494-98b9-195d677aad68","year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":74,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.983915Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:a8a59229aed5db907b8bf3d12a0841187894b3c37c08b02bbdb16d50f77035e9","observation_id":"aad991db-5542-4be9-84e5-a84ddb59b9d6","resolution":{"observed_at":"2026-08-07T14:33:03.986860Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:59.042846Z","title":"Certifiably robust rag against retrieval corruption","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:59.042846Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:14f836b6ae68b5270bf359ad3268f2640fefca07bd77764f6dffd651f6a9fd24","observation_id":"36f41795-19dd-4f66-a508-f3d77d94cd33","resolution":{"observed_at":"2026-08-07T14:32:59.042846Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2007.00808","last_updated":"2020-10-20T22:17:19Z","snapshot_observed_at":"2026-08-06T15:45:53.027828Z","submitted_at":"2020-07-01T23:15:56Z","title":"Approximate Nearest Neighbor Negative Contrastive Learning for Dense Text Retrieval","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2007.00808","snapshot_observed_at":"2026-08-07T14:32:59.112188Z","title":"Approximate nearest neighbor negative contrastive learning for dense text retrieval","venue":null,"work_id":null,"year":2007},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":76,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:59.112188Z"},"links":{"cited_paper":"/paper/2007.00808","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:6b7af4660c1c15eec86064f9ee45688a4bd2245bb64505105b9a021af91f5b8b","observation_id":"35dd4be1-c704-4bc1-ac10-5a8f157b14a0","resolution":{"observed_at":"2026-08-07T14:32:59.112188Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.04408","last_updated":"2023-10-06T17:55:36Z","snapshot_observed_at":"2026-08-05T10:28:11.033488Z","submitted_at":"2023-10-06T17:55:36Z","title":"RECOMP: Improving Retrieval-Augmented LMs with Compression and Selective Augmentation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.04408","snapshot_observed_at":"2026-08-07T14:32:59.202577Z","title":"Recomp: Improving retrieval-augmented lms with compression and selective augmentation","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":77,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:59.202577Z"},"links":{"cited_paper":"/paper/2310.04408","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:49516a3143e6321a73b86881eef4947a9282ca2448b376261d2a9a09c2e047ba","observation_id":"9dfdf5fe-7b53-4217-8534-df99030e04b0","resolution":{"observed_at":"2026-08-07T14:32:59.202577Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.00083","last_updated":"2024-06-06T13:38:42Z","snapshot_observed_at":"2026-08-06T22:05:18.163179Z","submitted_at":"2024-06-03T02:25:33Z","title":"BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.00083","snapshot_observed_at":"2026-08-07T14:32:59.243279Z","title":"Badrag: Identifying vulnerabilities in retrieval augmented generation of large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":78,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:59.243279Z"},"links":{"cited_paper":"/paper/2406.00083","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:43d6b6d5f1ab58896e58d0876e26348ec7fb895b199fa5fe10b1de96efa29bf3","observation_id":"328b8b7c-44b9-4a1d-b583-a54246d7c18b","resolution":{"observed_at":"2026-08-07T14:32:59.243279Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.20927","last_updated":"2024-12-30T13:16:08Z","snapshot_observed_at":"2026-07-06T20:14:40.579474Z","submitted_at":"2024-12-30T13:16:08Z","title":"Enhanced Multimodal RAG-LLM for Accurate Visual Question Answering","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.20927","snapshot_observed_at":"2026-08-07T14:32:59.328846Z","title":"Enhanced multimodal rag-llm for accurate visual question answering","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":79,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:59.328846Z"},"links":{"cited_paper":"/paper/2412.20927","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:3263b5b8dba161bd78f685a67f85d569238922f8365aca0f3a2a815b14d0dbd3","observation_id":"5fb72a77-095b-4c06-bc10-d5c4256a4135","resolution":{"observed_at":"2026-08-07T14:32:59.328846Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:03.721252Z","title":"Crag-comprehensive rag benchmark","venue":null,"work_id":"d2fb585f-1ee3-47d2-88e5-ffb11fa719f9","year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":80,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:59.436766Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:bbba22183ed874649d69bea56393f85db2d9577da3bda800693add2a75f9edfa","observation_id":"3c9dd4a4-71a5-4be1-9b76-4be3947826da","resolution":{"observed_at":"2026-08-07T14:33:03.785713Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"1809.09600","last_updated":"2018-09-25T17:28:20Z","snapshot_observed_at":"2026-08-09T10:11:58.541007Z","submitted_at":"2018-09-25T17:28:20Z","title":"HotpotQA: A Dataset for Diverse, Explainable Multi-hop Question Answering","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1809.09600","snapshot_observed_at":"2026-08-07T14:32:59.543585Z","title":"Hotpotqa: A dataset for diverse, explainable multi-hop question answering","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":81,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:59.543585Z"},"links":{"cited_paper":"/paper/1809.09600","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:db0dc6a4ec6413fba45499435a5c716e7bb5a26190974b7f7efc85e0d813781f","observation_id":"3da186e8-03a7-42e3-a4fc-11b50ab9f50f","resolution":{"observed_at":"2026-08-07T14:32:59.543585Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.13506","last_updated":"2025-05-16T11:40:32Z","snapshot_observed_at":"2026-08-07T15:44:43.526387Z","submitted_at":"2025-05-16T11:40:32Z","title":"EcoSafeRAG: Efficient Security through Context Analysis in Retrieval-Augmented Generation","version":1},"cited_work":{"arxiv_id":"2505.13506","doi":null,"metadata_source":"pith","pith_arxiv_id":"2505.13506","snapshot_observed_at":"2026-08-07T14:33:01.757663Z","title":"EcoSafeRAG: Efficient Security through Context Analysis in Retrieval-Augmented Generation","venue":"cs.CL","work_id":"127d786e-f35b-465c-a67d-0f23fd4361a8","year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":82,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:59.652064Z"},"links":{"cited_paper":"/paper/2505.13506","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:efbf56673aa8a7af077e459e0a4e4f8b2f5de483f3066a43a9346da5d1b6e742","observation_id":"a24b545a-b500-4a86-ba09-7fe218373904","resolution":{"observed_at":"2026-08-07T14:33:01.824614Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:59.762327Z","title":"React: Synergizing reasoning and acting in language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":83,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:59.762327Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:a6be9df4553eb3558a689c284d347afe26a636ee5bd02f9ab52d4b1c259b2722","observation_id":"3c3dd768-3858-4b86-a3ae-64f0cbae3c84","resolution":{"observed_at":"2026-08-07T14:32:59.762327Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.10594","last_updated":"2025-03-02T01:19:51Z","snapshot_observed_at":"2026-08-02T13:24:00.339129Z","submitted_at":"2024-10-14T15:04:18Z","title":"VisRAG: Vision-based Retrieval-augmented Generation on Multi-modality Documents","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.10594","snapshot_observed_at":"2026-08-07T14:32:59.883563Z","title":"Visrag: Vision-based retrieval-augmented generation on multi-modality documents","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":84,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:59.883563Z"},"links":{"cited_paper":"/paper/2410.10594","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:bfb9d54a1c2f642d50ab036da7cae206d7e86867bf62e78443d991aa8dc1ddf5","observation_id":"4abb05db-97fe-44d8-8124-7054cf98dd77","resolution":{"observed_at":"2026-08-07T14:32:59.883563Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.17331","last_updated":"2023-05-27T02:26:52Z","snapshot_observed_at":"2026-08-09T00:19:42.406647Z","submitted_at":"2023-05-27T02:26:52Z","title":"Augmentation-Adapted Retriever Improves Generalization of Language Models as Generic Plug-In","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.17331","snapshot_observed_at":"2026-08-07T14:33:00.003486Z","title":"Augmentation-adapted retriever improves generalization of language models as generic plug-in","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":85,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:00.003486Z"},"links":{"cited_paper":"/paper/2305.17331","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:e5ee99fac1f57d8ce5687a7fdfc119b20dcc22588692eff2fa14c4ec5a2c69db","observation_id":"126e37ed-acf7-4ace-89db-519f13d9ed63","resolution":{"observed_at":"2026-08-07T14:33:00.003486Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:00.106610Z","title":"Rag-driver: Generalisable driving explanations with retrieval-augmented in-context learning in multi-modal large language model","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":86,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:00.106610Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:d7e14f1a9e323a7bb08d60fdd5740c2dfed6fe731f7652d9a02b9584456d0b11","observation_id":"82062636-8a73-4d13-bf89-ec7da18732a9","resolution":{"observed_at":"2026-08-07T14:33:00.106610Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:00.174389Z","title":"Worse than zero-shot? a fact-checking dataset for evaluating the robustness of rag against misleading retrievals","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":87,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:00.174389Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:ee16573beba38eaecb6cc7f33e9e999c1412dd9f68af08a6f14f4b7cedf65399","observation_id":"5807f233-d77a-478e-9990-9eda9eb5250e","resolution":{"observed_at":"2026-08-07T14:33:00.174389Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:00.291225Z","title":"Prac- tical poisoning attacks against retrieval-augmented generation.arXiv preprint arXiv:2504.03957, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":88,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:00.291225Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:6d4875b9c73db5a422339b59d48bced52e51fd00d90b57eefe28d063083330b3","observation_id":"5405aeb7-8c82-41ac-afbe-09cf504416b0","resolution":{"observed_at":"2026-08-07T14:33:00.291225Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:03.568234Z","title":"Traceback of poisoning attacks to retrieval-augmented generation","venue":null,"work_id":"aca3d760-30a7-4eb4-a241-2f100eedd5d9","year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":89,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:00.401057Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:859d428b0b2c0e222bb1a2b8554fbd90ab6ad4dff1a1868679930067882a7c59","observation_id":"43ee4f78-7ab8-46b4-b85b-c2fe9fa0e5e6","resolution":{"observed_at":"2026-08-07T14:33:03.643093Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.22832","last_updated":"2024-10-30T09:15:51Z","snapshot_observed_at":"2026-08-08T06:11:31.040933Z","submitted_at":"2024-10-30T09:15:51Z","title":"HijackRAG: Hijacking Attacks against Retrieval-Augmented Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.22832","snapshot_observed_at":"2026-08-07T14:33:00.474010Z","title":"Hijackrag: Hijacking attacks against retrieval-augmented large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":90,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:00.474010Z"},"links":{"cited_paper":"/paper/2410.22832","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:d87a5f2234e792350e0bdc9c0af7e88176fb7fa16fd2e1a5756aa5ff4fac2828","observation_id":"762e2534-1435-43ae-8809-1f94fcf01c5a","resolution":{"observed_at":"2026-08-07T14:33:00.474010Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18016","last_updated":"2025-03-23T10:33:28Z","snapshot_observed_at":"2026-08-07T16:43:26.281359Z","submitted_at":"2025-03-23T10:33:28Z","title":"Retrieval Augmented Generation and Understanding in Vision: A Survey and New Outlook","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18016","snapshot_observed_at":"2026-08-07T14:33:00.592379Z","title":"Retrieval augmented generation and understanding in vision: A survey and new outlook","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":91,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:00.592379Z"},"links":{"cited_paper":"/paper/2503.18016","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:9765805b6779c91f4e7809a32b5df8653334ef4e9855bbb336b4825347e92b88","observation_id":"3039fba3-61c1-4592-a67f-e6dc240e32cb","resolution":{"observed_at":"2026-08-07T14:33:00.592379Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.19156","last_updated":"2023-10-29T21:13:31Z","snapshot_observed_at":"2026-07-06T16:40:12.014275Z","submitted_at":"2023-10-29T21:13:31Z","title":"Poisoning Retrieval Corpora by Injecting Adversarial Passages","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.19156","snapshot_observed_at":"2026-08-07T14:33:00.710112Z","title":"Poisoning retrieval corpora by injecting adversarial passages","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":92,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:00.710112Z"},"links":{"cited_paper":"/paper/2310.19156","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:2fab436e3e85a2309daa7c45c0565f39814c71d95b8c29bab656de132286f279","observation_id":"98309379-6233-4c3a-a018-9a47b5a839bd","resolution":{"observed_at":"2026-08-07T14:33:00.710112Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2501.00879","last_updated":"2025-05-22T22:00:19Z","snapshot_observed_at":"2026-07-06T20:15:31.955797Z","submitted_at":"2025-01-01T15:57:34Z","title":"TrustRAG: Enhancing Robustness and Trustworthiness in Retrieval-Augmented Generation","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2501.00879","snapshot_observed_at":"2026-08-07T14:33:00.835351Z","title":"Trustrag: Enhancing robustness and trustworthiness in rag","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":93,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:00.835351Z"},"links":{"cited_paper":"/paper/2501.00879","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:d5d09a3042ead62f9da5d434239750d64666efc66a6aad1d25d36d1e4326c6ef","observation_id":"ff9632c2-972f-46cc-9595-ad9beed8f68c","resolution":{"observed_at":"2026-08-07T14:33:00.835351Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2409.10102","last_updated":"2026-05-16T07:15:07Z","snapshot_observed_at":"2026-08-04T19:12:49.508911Z","submitted_at":"2024-09-16T09:06:44Z","title":"Trustworthiness in Retrieval-Augmented Generation Systems: A Survey","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.10102","snapshot_observed_at":"2026-08-07T14:33:00.919539Z","title":"Trustworthiness in retrieval-augmented generation systems: A survey","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":94,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:00.919539Z"},"links":{"cited_paper":"/paper/2409.10102","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:e10595b5aab4c54ea795ed030723b432a2e63d62876ae939da79de34b1fd0c53","observation_id":"326fd7ad-7c2b-4b08-8ad2-78965bd338d8","resolution":{"observed_at":"2026-08-07T14:33:00.919539Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:03.424225Z","title":"Black-Box Opinion Manipulation Attacks to Retrieval- Augmented Generation of Large Language Models","venue":null,"work_id":"874888fb-5128-433f-a8f1-61eb039a3d82","year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":95,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:00.983684Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:e0c4bae542d26eac6084181d6e7ebe4eea1495e3e35d4b6ca19829a9df27dbc2","observation_id":"bb8f74b6-d050-4ddb-90ca-f43407a4faae","resolution":{"observed_at":"2026-08-07T14:33:03.498516Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:03.254961Z","title":null,"venue":null,"work_id":"1c865bd8-d3ee-4769-be3d-724d43d75176","year":null},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":96,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:01.071775Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:2f0420af01382049ce567a58a178297918842ce274225d2c80afb5c44b327f6c","observation_id":"5d67b7c0-c373-4489-9c4d-1f2d00a4253b","resolution":{"observed_at":"2026-08-07T14:33:03.346808Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:03.079576Z","title":null,"venue":null,"work_id":"e7cc3c44-cffd-49c4-b7a1-d0e0197a646e","year":null},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":97,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:01.170470Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:00fc8e67538b88d97640218086f29d583475d58d42cfad07fd70edc4af2fa9b0","observation_id":"6951ad8d-3dae-4e5f-8580-95152a033014","resolution":{"observed_at":"2026-08-07T14:33:03.171172Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:02.903391Z","title":null,"venue":null,"work_id":"a3551035-7eef-49a7-99f5-02565c45da44","year":null},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":98,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:01.247518Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:9ccb825c151d825ad63761e26ec7939598ba37123fbe351b5a5b7770b5c4b7db","observation_id":"35d8ab91-5b40-4207-8dea-15bfd4730770","resolution":{"observed_at":"2026-08-07T14:33:03.009966Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:02.765628Z","title":"class\" (standalone or non-standalone) and the","venue":null,"work_id":"dcd0c581-dbec-4b3c-aaa9-470621cdd518","year":null},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":99,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:01.360877Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:9591cebe4e5f3390cb789c8f7f1a9228073a134dbb2b9399ae9700fbf0fcb315","observation_id":"9a6c75c7-028d-4474-94b1-d707242aa2c3","resolution":{"observed_at":"2026-08-07T14:33:02.825102Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-09T13:15:45.915554Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation"},"reference_resolution":{"displayed":99,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":85,"verified_exact":2,"verified_fuzzy":12},"total_outbound_references":99},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"thesis":"As of 9 August 2026, this Paper Citation Record lists 99 of 99 outbound references and 9 inbound Pith citation observations for arXiv:2505.18543."}