Pith. sign in

REVIEW 5 major objections 6 minor 4 cited by

CPA-RAG:Covert Poisoning Attacks on Retrieval-Augmented Generation in Large Language Models

T0 review · 5 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims CPA-RAG, a fully black-box poisoning framework, can steer a retrieval-augmented generation system to emit chosen answers over 90% of the time at top-$k=5$, matching white-box attacks, and can transfer to a commercial…

desk verdict Plausible RAG poisoning attack with a genuinely new unified optimization loop, but the headline 90% transferability claim is not supported by the experiments as written. read the letter →

arxiv 2505.19864 v1 pith:PEEJPTG3 submitted 2025-05-26 cs.CR

Chunyang Li , Junwei Zhang , Anda Cheng , Zhuo Ma , Xinghua Li , Jianfeng Ma This is my paper · ORCID
classification cs.CR
keywords retrieval-augmentedgenerationpoisoningattackblack-boxadversarialtextRAGsecurityretriever-basedscoringlanguagemodelattacksconcealment
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

CPA-RAG targets retrieval-augmented generation systems, where a retriever pulls external documents and an LLM answers from them. The paper tries to show that a remote attacker who can inject text into the knowledge base (forums, blogs, web pages) can force a RAG system to output an attacker-chosen answer without knowing the retriever or LLM internals. The framework's central move is to generate query-relevant, natural-sounding poisoned passages, then keep only the ones that score high under a hybrid of three open-source retrievers and that make a black-box LLM say the target answer while avoiding the true one. Experiments claim over 90% attack success at top-$k=5$, a steady margin of roughly 5 percentage points over a strong baseline, and successful compromise of a commercial platform. If the claim holds, current defenses—perplexity filtering, duplicate removal, paraphrasing, and knowledge expansion—do not stop this class of attack.

What carries the argument

The load-bearing mechanism is a two-stage optimization loop around a hybrid retriever evaluator. First, prompt templates seeded with the query and target answer are fed to several LLMs to produce an initial pool of fluent candidate passages. Then each candidate is rewritten repeatedly by randomly chosen LLMs and prompts, and after each rewrite it is scored by a weighted combination of cosine similarities from three open-source dense retrievers—Contriever, ANCE, and DPR—against the target query. A candidate is kept only when that score clears a query-dependent threshold and when a black-box LLM check confirms the target answer appears and the correct answer does not. This loop is what unifies the retriever condition, the generation condition, and the concealment condition in a single text.

What would settle it

Run CPA-RAG against a RAG system whose retriever is a cross-encoder reranker or an embedding model absent from the evaluator set, keep the retriever black-box, and record whether poisoned passages appear in top-$k$ and whether attack success stays near 90%. An attack success rate at chance with no poisoned passages retrieved would falsify the claimed black-box transferability.

Watch

Extended reading notes

Core claim

The central claim is that retrieval and generation adversarial texts should not be built separately and concatenated, as prior black-box attacks do, but optimized as one object. CPA-RAG asserts that a three-condition test—the poisoned passage must be retrieved, must induce the target answer, and must look natural enough to evade filtering—is the right target, and that its pipeline meets all three simultaneously. The paper reports achieving over 90% attack success with top-$k=5$ across multiple datasets and LLMs, outperforming black-box baselines by 14.5 percentage points under defenses, and it reports a real-world transfer to a commercial RAG system whose retriever and generator were both unseen at attack time.

Load-bearing premise

The attack assumes that the unknown target retriever ranks passages roughly the way three open-source retrievers (Contriever, ANCE, DPR) do, because candidates are selected only when those proxy scores are high; with a sufficiently different embedding or reranker, the poisoned passages may never be retrieved and the whole attack fails.

Editorial extensions

If this is right

  • Perplexity-based filtering, which defeats existing white-box and black-box attacks, is ineffective against CPA-RAG because the generated passages are fluent by construction.
  • Duplicate-text defenses lose their teeth: the attack keeps repetition low by varying prompts and LLMs, so poisoned entries look distinct from one another.
  • Raising top-$k$ or expanding the knowledge base dilutes but does not neutralize the attack; CPA-RAG retains roughly a five-point attack-success margin over the strongest baseline.
  • Because the attack transfers to a commercial system with an unseen retriever and LLM, deployed RAG pipelines should assume that public corpora can contain adversarial entries targeting their answers.
  • The three conditions—retrievability, generation, and concealment—offer a concrete checklist for designing RAG-specific defenses.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Going beyond the paper: the hybrid evaluator is the true bottleneck; if a target retriever's ranking behavior diverges from Contriever, ANCE, and DPR, the attack should lose transferability, so a stress test with a deliberately different embedding model would bound the claimed universality.
  • Going beyond the paper: the LLM-as-judge verification step implicitly assumes the unavailable target generator is similar to the evaluating LLMs in following the poisoned context; failure cases the paper itself reports—models that memorize the correct answer—suggest strong factual priors in the generator are a natural defense.
  • Going beyond the paper: the same three-condition formulation could be inverted to build a detection tool, flagging corpus entries that simultaneously score high on retrieval similarity, carry a conflicting answer, and remain fluent under paraphrasing.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes CPA-RAG, a black-box poisoning attack against retrieval-augmented generation (RAG) systems. The method generates adversarial passages via prompt-based multi-LLM generation and rewrites them using a hybrid retriever evaluator (Contriever, ANCE, DPR) plus a generation filter on a target model. The authors evaluate on NQ, HotpotQA, and MS-MARCO across multiple LLMs and retrievers, report attack success and concealment metrics, test against four defenses, and present a case study on Alibaba's BaiLian commercial RAG system. The central claim is that CPA-RAG achieves over 90% attack success at top-k=5, matching white-box attacks, and transfers to a fully unknown commercial system.

Significance. The formalization of the three attack conditions (retriever interference, generation manipulation, textual concealment) and the unified optimization pipeline are useful contributions to the study of RAG poisoning. The attempt to evaluate on a commercial platform is also valuable and goes beyond typical academic setups. If the headline claims were supported, the work would demonstrate a practically serious threat. However, the current quantitative support is insufficient, and several experiments suffer from a selection-bias problem that undermines the claim of black-box transferability to unseen systems. The paper would be strengthened by a genuinely held-out retriever and generator evaluation, confidence intervals, and a more careful statement of the threat model's query access.

major comments (5)
  1. [Abstract and Section 5.2, Tables 1-2] The abstract's claim of 'over 90% attack success when the top-k retrieval setting is 5' is contradicted by Table 1, where MS-MARCO ASR@5 is 0.86 for CPA-RAG, and by Table 2, where the GPT-4o column for MS-MARCO is 0.86. The claim should be restricted to the datasets where it holds, or reported per-dataset rather than as a universal result.
  2. [Section 4.4, Eq. (4) and Algorithm 2] The candidate-selection procedure retains a candidate only if its weighted similarity from Contriever/ANCE/DPR exceeds a threshold and if the TargetModel's answer contains the target R and not the correct answer O. The controlled evaluations in Tables 1-3 then measure success on exactly these same retrievers and on the same LLM families used for filtering. This makes the 'black-box transferability' claim circular in the controlled setting. The only genuinely held-out system is BaiLian, and Appendix C reports only qualitative examples with no aggregate ASR or F1. A held-out retriever and a held-out generator, with aggregate metrics, are needed before the abstract's transferability claim can be supported.
  3. [Appendix B.2] The evaluation uses only 10 closed-ended target questions per dataset, and no error bars, standard deviations, or random seeds are reported anywhere in the paper. The point estimates in Tables 1-6 are therefore compatible with high variance. The authors should report confidence intervals (e.g., bootstrap) or at least multiple independent question sets and random seeds, and clarify whether the '10 questions repeated 10 times' procedure yields 10 or 100 unique queries.
  4. [Section 4.2 and Algorithm 2] The method is not a purely passive poisoning attack; it requires querying the TargetModel in Algorithm 2 line 11 to filter candidates. The paper should state this query requirement explicitly, report the number of target-model queries per question, and discuss whether the threat model permits this level of interaction. The current text in Section 4.2 ('fully effective under standard black-box settings, without relying on system-specific assumptions') overstates the access requirements.
  5. [Section 5.3.2 and Table 5] The 'transfer across retrievers' ablation is performed only among the three retrievers that appear in the hybrid evaluator. Using only DPR for filtering and testing on Contriever is closer to a held-out test, but this single configuration is not sufficient to support the general claim that the generated texts are retriever-agnostic. A genuinely held-out retriever, such as a different dense retriever or a sparse/dense hybrid, should be included to establish the claim.
minor comments (6)
  1. [Table 6] The column header 'TOP-K ASR F1-Score' is confusing because the subsequent columns mix ASR values for different LLMs; the table should be reorganized so that ASR and F1 are clearly separated per model.
  2. [Tables 3 and 5] There are typos in the tables: 'Contriever-ms Ance' should be 'Contriever-ms, ANCE' and '2,71' in Table 5 should be '2.71'.
  3. [Appendix A.4] The AG-3 template begins mid-sentence ('type, and introduce scenarios...'), suggesting a missing prefix; the template should be completed so that it is usable.
  4. [Section 6 and Figure 13] Section 5.2 states that CPA-RAG 'outperforms existing black-box baselines by 14.5 percentage points under various defense strategies,' but Section 6 presents only figures without numerical support. A table reporting the improvement margins and the defense configurations would make this concrete.
  5. [Appendix B.2] The statement that target answers were 'scientifically verified by GPT-4' is vague; the verification procedure (e.g., prompts, criteria) should be described.
  6. [Appendix B.4] The CASR definition weights ASR by k without justification; the paper should explain why this weighting is appropriate and how it relates to practical deployments.

Circularity Check

2 steps flagged · score 6.0 of 10

The reported ASR and F1 are partially enforced by the same filters used to select poisoned texts: Algorithm 2 keeps only candidates that already make TargetModel output R and not O, and Eq. (4) keeps only candidates scoring above threshold on the same Contriever/ANCE/DPR evaluators later reported as target retrievers. Genuine held-out transfer evidence is limited and largely qualitative.

  1. fitted input called prediction [Appendix A.3, Algorithm 2 (lines 10-13); Appendix B.4 (ASR definition)]
    "10:s←Evaluator(p′,Q) 11:A←TargetModel(Q,p′) 12:if s>τ and R∈A and O∉A then 13:Popt←Popt∪{p′}. ... Attack Success Rate (ASR): Percentage of queries for which the LLM outputs the predefined target answer R, using substring match."

    The retention test in Algorithm 2 is exactly the definition of ASR: a rewritten passage is kept only when the queried model already outputs R and does not output O. ASR is then measured as the fraction of queries whose LLM output contains R by substring match. Thus, for any LLM used as TargetModel during optimization, the reported ASR on that model is an inclusion criterion, not an independent prediction. Table 1's headline 92% ASR@5 is measured on GPT-4o, which is in the optimizer's LLM set, and Table 2 repeats this for Qwen-Max and DeepSeek. Only LLMs never used as TargetModel provide genuinely held-out generation evidence, but the headline averages mix these with the filter models.

  2. fitted input called prediction [Section 4.4, Eq. (4); Section 5.1 Default setting; Table 3]
    "p′i=Rewrite(pi, LLMj, Qi, Pj), and Σ wj·Sim(p′i, Qi, LLMj) ≥ Sim(Qi+pi, Qi). Only candidates that meet the similarity threshold are retained for the next stage. The evaluator adopts a hybrid of Contriever, ANCE and DPR with similarity scores from each retriever normalized and equally weighted."

    The optimization retains a candidate only when the weighted cosine similarity from Contriever, ANCE, and DPR exceeds a threshold, and the default evaluator is exactly this same hybrid. Table 3 then reports F1, ASR, and TES with Contriever, Contriever-ms, and ANCE as the target retrievers. Because each target retriever contributed to the filtering score in Eq. (4), high retrieval success on those same retrievers is partially forced by construction rather than measured on a held-out retriever. Table 5's single-retriever variants do provide some cross-retriever transfer evidence, but the headline cross-retriever table does not use a retriever outside the filtering set; the only truly held-out commercial retriever is reported via qualitative examples, not aggregate ASR/F1.

full rationale

CPA-RAG is a poisoning attack whose candidate filtering is part of the attack pipeline, so filtering alone is not circular. The circularity is in presenting metrics that are identical to the filters used to build the corpus as evidence of predictive attack success. The generation ASR is the clearest case: selected passages are those that already made the filter model emit the target answer, so the >90% ASR on models used as TargetModel is overfit by construction. The retrieval F1 is similarly inflated for the same Contriever/ANCE/DPR families used in Eq. (4). The paper does contain genuinely non-circular components: evaluation on LLMs not used as TargetModel (e.g., LLaMA2/Vicuna/InternLM in Table 2), single-retriever transfer tests in Table 5, and a qualitative commercial-system demonstration on Alibaba BaiLian. No load-bearing self-citation or imported uniqueness theorem is present. The score of 6 reflects partial, not total, circularity: the central headline numbers are partly enforced by selection, while some held-out evidence and external validation exist.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central claims rest on hand-picked experimental choices (N=5 injections, T=5 iterations, equal retriever weights, an ad hoc similarity threshold) plus domain assumptions about the attacker's ability to inject text and about open-source retrievers being good proxies. No new physical or conceptual entities are introduced.

free parameters (5)
  • N (number of injected texts per query) = 5
    Chosen by hand; the attack success rate depends on how many poisoned documents are injected.
  • T (maximum optimization iterations) = 5
    Chosen by hand in Algorithm 2; more iterations could improve or change results.
  • w_j (hybrid evaluator weights) = equal (1/3 each)
    Assigned equally without tuning; affects which candidates pass the similarity threshold in Eq. (4).
  • tau (similarity threshold) = similarity of a random sample minus variance across samples
    Ad hoc threshold defined in Section 5.1; controls how many candidates pass retriever filtering.
  • Set of generation LLMs and prompt templates = GPT-4o, Claude, Qwen, DeepSeek; multiple prompt templates
    The choice of models and prompts is a design decision; Table 6 shows results vary substantially with this choice.
assumptions (5)
  • domain assumption The attacker can inject text into the knowledge base and have it indexed.
    Threat model in Section 3; if the target system requires authenticated or vetted sources, the attack does not apply.
  • domain assumption Retrieval is based on semantic similarity that is reasonably approximated by Contriever, ANCE, and DPR.
    Section 4.4 uses these open-source retrievers as the evaluator; the transfer to the unknown target retriever is assumed.
  • domain assumption Attack success can be measured by substring match of the target answer in the model output.
    Appendix B.4 defines ASR as substring match, which may over-count trivial collocations or partial matches.
  • domain assumption The language model follows the system prompt and answers from the retrieved context alone.
    Appendix B.3 sets the evaluation prompt; actual RAG systems may have different instruction hierarchies or refusal behaviors.
  • ad hoc to paper A set of 10 target questions per dataset is representative for measuring attack success.
    Appendix B.2 selects 10 questions per dataset, repeated 10 times; this is a small, curated sample that may not represent the dataset.

how reviews work

0 comments
Cite this review

Pith. "Pith review of CPA-RAG:Covert Poisoning Attacks on Retrieval-Augmented Generation in Large Language Models." pith.science (2026). https://pith.science/paper/PEEJPTG3

@misc{pith2026250519864,
  author       = {Pith},
  title        = {Pith review of: CPA-RAG:Covert Poisoning Attacks on Retrieval-Augmented Generation in Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PEEJPTG3}},
  note         = {Machine review of arXiv:2505.19864}
}
read the original abstract

Retrieval-Augmented Generation (RAG) enhances large language models (LLMs) by incorporating external knowledge, but its openness introduces vulnerabilities that can be exploited by poisoning attacks. Existing poisoning methods for RAG systems have limitations, such as poor generalization and lack of fluency in adversarial texts. In this paper, we propose CPA-RAG, a black-box adversarial framework that generates query-relevant texts capable of manipulating the retrieval process to induce target answers. The proposed method integrates prompt-based text generation, cross-guided optimization through multiple LLMs, and retriever-based scoring to construct high-quality adversarial samples. We conduct extensive experiments across multiple datasets and LLMs to evaluate its effectiveness. Results show that the framework achieves over 90\% attack success when the top-k retrieval setting is 5, matching white-box performance, and maintains a consistent advantage of approximately 5 percentage points across different top-k values. It also outperforms existing black-box baselines by 14.5 percentage points under various defense strategies. Furthermore, our method successfully compromises a commercial RAG system deployed on Alibaba's BaiLian platform, demonstrating its practical threat in real-world applications. These findings underscore the need for more robust and secure RAG frameworks to defend against poisoning attacks.

Figures

Figures reproduced from arXiv: 2505.19864 by the authors.

Figure 1
Figure 1. ASR performance under combined perplexity, duplication, paraphrasing, and knowledge expansion defenses. These challenges underline the need for a more prac￾tical and effective black-box attack framework. To address this, we propose CPA-RAG, a covert black￾box poisoning framework that generates high-quality adversarial texts without accessing internal model components. Unlike PoisonedRAG, which treats re￾trieval and … view at source ↗
Figure 2
Figure 2. Comparison of Adversarial Texts across Different Approaches. [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Overview of the CPA-RAG poisoning attack on RAG systems. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (10 more)
Figure 4
Figure 4. Figure 4: CPA-RAG adversarial text generation pipeline. (1) Information collection: specify the target question, answer, and supporting knowledge. (2) Text initialization: generate candidate poisons via prompt-based sampling across LLMs. (3) Iterative refinement: optimize texts …
Figure 5
Figure 5. Figure 5: Comparing readability, fluency, grammar errors, and repetition across CPA-RAG, Poisone [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Impact of top-k on attack success rate (ASR), precision, recall, and F1-score. sarial context, CPA-RAG sustains strong performance with a consistent 5% margin. Furthermore, the Cumulative Attack Success Rate (CASR) highlights its robustness, achieving relative improvem…
Figure 7
Figure 7. Figure 7: CPA-RAG Induced Answer Misdirection in a Commercial RAG System: Database Recall [PITH_FULL_IMAGE:figures/full_fig_p019_7.png]
Figure 8
Figure 8. Figure 8: CPA-RAG Induced Answer Misdirection in a Commercial RAG System: RAG Mode [PITH_FULL_IMAGE:figures/full_fig_p019_8.png]
Figure 9
Figure 9. Figure 9: CPA-RAG Induced Answer Misdirection in a Commercial RAG System: RAG Mode with [PITH_FULL_IMAGE:figures/full_fig_p020_9.png]
Figure 10
Figure 10. Figure 10: Performance under paraphrasing-based defense. [PITH_FULL_IMAGE:figures/full_fig_p020_10.png]
Figure 11
Figure 11. Figure 11: Performance under perplexity-based defense. [PITH_FULL_IMAGE:figures/full_fig_p020_11.png]
Figure 12
Figure 12. Figure 12: Performance under duplicate text filtering defense. [PITH_FULL_IMAGE:figures/full_fig_p021_12.png]
Figure 13
Figure 13. Figure 13: Performance under combined defenses. phrase-specific adversarial patterns. In our setting, we prompt an LLM to generate a paraphrased version of each user query before retrieval. However, CPA-RAG exhibits strong resilience to this strategy. Since its adversarial texts…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 4 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denial

    cs.CR 2026-08 conditional novelty 6.0 of 10

    A single poisoned document that explicitly names and refutes the correct answer can steer RAG systems toward attacker-chosen wrong answers, with effects that vary by target model.

  2. UniC-RAG: Universal Knowledge Corruption Attacks to Retrieval-Augmented Generation

    cs.CR 2025-08 conditional novelty 6.0 of 10

    A universal knowledge-corruption attack uses as few as 100 crafted texts to hijack responses to thousands of diverse user queries in retrieval-augmented generation.

  3. Large Language Models in Misinformation Ecosystems: Misuse, Defense, and Vulnerability

    cs.CR 2026-07 conditional novelty 5.0 of 10

    A role-layer survey unifies LLM misuse, LLM-based defense, and LLM-centric verification vulnerabilities across content, social, evidence, and workflow layers, then lists three open challenges.

  4. Atomic clocks and gravitational waves as probes of non-metricity

    gr-qc 2026-01 reject novelty 5.0 of 10

    The paper claims existing gravitational-wave data already bound Weyl non-metricity, α²ω̄0<10⁻⁶⁹ GeV, via backreaction of a Planck-scale Weyl field, but a dropped kinetic term numerically exceeds the assumed sensitivity.

Reference graph

Works this paper leans on

48 extracted references · 24 canonical work pages · cited by 4 Pith papers

  1. [1]

    Gpt-4 technical report.arXiv preprint arXiv:2303.08774, 2023

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report.arXiv preprint arXiv:2303.08774, 2023

    arXiv 2023

  2. [2]

    Applying generative ai with retrieval augmented generation to summarize and extract key clinical information from electronic health records

    Mohammad Alkhalaf, Ping Yu, Mengyang Yin, and Chao Deng. Applying generative ai with retrieval augmented generation to summarize and extract key clinical information from electronic health records. Journal of biomedical informatics, 2024

    work page 2024

  3. [3]

    Ms marco: A human generated machine reading comprehension dataset.arXiv preprint arXiv:1611.09268, 2016

    Payal Bajaj, Daniel Campos, Nick Craswell, Li Deng, Jianfeng Gao, Xiaodong Liu, Rangan Majumder, Andrew McNamara, Bhaskar Mitra, Tri Nguyen, et al. Ms marco: A human generated machine reading comprehension dataset.arXiv preprint arXiv:1611.09268, 2016

    arXiv 2016

  4. [4]

    Internlm2 technical report.arXiv preprint arXiv:2403.17297, 2024

    Zheng Cai, Maosong Cao, Haojiong Chen, Kai Chen, Keyu Chen, Xin Chen, Xun Chen, Zehui Chen, Zhi Chen, Pei Chu, et al. Internlm2 technical report.arXiv preprint arXiv:2403.17297, 2024

    arXiv 2024

  5. [5]

    Phantom: General trigger attacks on retrieval augmented language generation.arXiv preprint arXiv:2405.20485, 2024

    Harsh Chaudhari, Giorgio Severi, John Abascal, Matthew Jagielski, Christopher A Choquette-Choo, Milad Nasr, Cristina Nita-Rotaru, and Alina Oprea. Phantom: General trigger attacks on retrieval augmented language generation.arXiv preprint arXiv:2405.20485, 2024

    arXiv 2024

  6. [6]

    Benchmarking large language models in retrieval- augmented generation

    Jiawei Chen, Hongyu Lin, Xianpei Han, and Le Sun. Benchmarking large language models in retrieval- augmented generation. InProceedings of the AAAI Conference on Artificial Intelligence, 2024

    work page 2024

  7. [7]

    Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality.See https://vicuna

    Wei-Lin Chiang, Zhuohan Li, Ziqing Lin, Ying Sheng, Zhanghao Wu, Hao Zhang, Lianmin Zheng, Siyuan Zhuang, Yonghao Zhuang, Joseph E Gonzalez, et al. Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality.See https://vicuna. lmsys. org (accessed 14 April 2023), 2023

    work page 2023

  8. [8]

    Typos that broke the rag’s back: Genetic attack on rag pipeline by simulating documents in the wild via low-level perturbations.arXiv preprint arXiv:2404.13948, 2024

    Sukmin Cho, Soyeong Jeong, Jeongyeon Seo, Taeho Hwang, and Jong C Park. Typos that broke the rag’s back: Genetic attack on rag pipeline by simulating documents in the wild via low-level perturbations.arXiv preprint arXiv:2404.13948, 2024

    arXiv 2024

Show all 48 references
  1. [9]

    The rag paradox: A black-box attack exploiting unintentional vulnerabilities in retrieval-augmented generation systems.arXiv preprint arXiv:2502.20995, 2025

    Chanwoo Choi, Jinsoo Kim, Sukmin Cho, Soyeong Jeong, and Buru Chang. The rag paradox: A black-box attack exploiting unintentional vulnerabilities in retrieval-augmented generation systems.arXiv preprint arXiv:2502.20995, 2025

    2025

  2. [10]

    Hotflip: White-box adversarial examples for text classification.arXiv preprint arXiv:1712.06751, 2017

    Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. Hotflip: White-box adversarial examples for text classification.arXiv preprint arXiv:1712.06751, 2017

    2017 arXiv

  3. [11]

    From local to global: A graph rag approach to query-focused summarization.arXiv preprint arXiv:2404.16130, 2024

    Darren Edge, Ha Trinh, Newman Cheng, Joshua Bradley, Alex Chao, Apurva Mody, Steven Truitt, Dasha Metropolitansky, Robert Osazuwa Ness, and Jonathan Larson. From local to global: A graph rag approach to query-focused summarization.arXiv preprint arXiv:2404.16130, 2024

    2024 arXiv

  4. [12]

    A survey on rag meeting llms: Towards retrieval-augmented large language models

    Wenqi Fan, Yujuan Ding, Liangbo Ning, Shijie Wang, Hengyun Li, Dawei Yin, Tat-Seng Chua, and Qing Li. A survey on rag meeting llms: Towards retrieval-augmented large language models. InProceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2024. 10

    2024

  5. [13]

    Clerc: A dataset for legal case retrieval and retrieval-augmented analysis generation.arXiv preprint arXiv:2406.17186, 2024

    Abe Bohan Hou, Orion Weller, Guanghui Qin, Eugene Yang, Dawn Lawrie, Nils Holzenberger, Andrew Blair-Stanek, and Benjamin Van Durme. Clerc: A dataset for legal case retrieval and retrieval-augmented analysis generation.arXiv preprint arXiv:2406.17186, 2024

    2024 arXiv

  6. [14]

    Unsupervised dense information retrieval with contrastive learning.arXiv preprint arXiv:2112.09118, 2021

    Gautier Izacard, Mathilde Caron, Lucas Hosseini, Sebastian Riedel, Piotr Bojanowski, Armand Joulin, and Edouard Grave. Unsupervised dense information retrieval with contrastive learning.arXiv preprint arXiv:2112.09118, 2021

    2021 arXiv

  7. [15]

    Dense passage retrieval for open-domain question answering

    Vladimir Karpukhin, Barlas Oguz, Sewon Min, Patrick SH Lewis, Ledell Wu, Sergey Edunov, Danqi Chen, and Wen-tau Yih. Dense passage retrieval for open-domain question answering. InEMNLP, 2020

    2020

  8. [16]

    Natural questions: a benchmark for question answering research.Transactions of the Association for Computational Linguistics, 2019

    Tom Kwiatkowski, Jennimaria Palomaki, Olivia Redfield, Michael Collins, Ankur Parikh, Chris Alberti, Danielle Epstein, Illia Polosukhin, Jacob Devlin, Kenton Lee, et al. Natural questions: a benchmark for question answering research.Transactions of the Association for Computat...

    2019

  9. [17]

    Retrieval-augmented generation for knowledge- intensive nlp tasks.Advances in neural information processing systems, 33, 2020

    Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, et al. Retrieval-augmented generation for knowledge- intensive nlp tasks.Advances in neural information processing systems...

    2020

  10. [18]

    Deepseek-v3 technical report.arXiv preprint arXiv:2412.19437, 2024

    Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, et al. Deepseek-v3 technical report.arXiv preprint arXiv:2412.19437, 2024

    2024 arXiv

  11. [19]

    Backdoor attacks on dense passage retrievers for disseminating misinformation.arXiv preprint arXiv:2402.13532, 2024

    Quanyu Long, Yue Deng, LeiLei Gan, Wenya Wang, and Sinno Jialin Pan. Backdoor attacks on dense passage retrievers for disseminating misinformation.arXiv preprint arXiv:2402.13532, 2024

    2024 arXiv

  12. [20]

    Crud-rag: A comprehensive chinese benchmark for retrieval-augmented generation of large language models.ACM Transactions on Information Systems, 43(2), 2025

    Yuanjie Lyu, Zhiyu Li, Simin Niu, Feiyu Xiong, Bo Tang, Wenjin Wang, Hao Wu, Huanyong Liu, Tong Xu, and Enhong Chen. Crud-rag: A comprehensive chinese benchmark for retrieval-augmented generation of large language models.ACM Transactions on Information Systems, 43(2), 2025

    2025

  13. [21]

    Training language models to follow instructions with human feedback.Advances in neural information processing systems, 2022

    Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback.Advances in neural information processing systems, 2022

    2022

  14. [22]

    Legalbench-rag: A benchmark for retrieval-augmented genera- tion in the legal domain.arXiv preprint arXiv:2408.10343, 2024

    Nicholas Pipitone and Ghita Houir Alami. Legalbench-rag: A benchmark for retrieval-augmented genera- tion in the legal domain.arXiv preprint arXiv:2408.10343, 2024

    2024 arXiv

  15. [23]

    Evaluating retrieval quality in retrieval-augmented generation

    Alireza Salemi and Hamed Zamani. Evaluating retrieval quality in retrieval-augmented generation. In Proceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrieval, 2024

    2024

  16. [24]

    Ctrlrag: Black-box adversarial attacks based on masked language models in retrieval-augmented language generation.arXiv preprint arXiv:2503.06950, 2025

    Runqi Sui. Ctrlrag: Black-box adversarial attacks based on masked language models in retrieval-augmented language generation.arXiv preprint arXiv:2503.06950, 2025

    2025

  17. [25]

    Beir: A heteroge- nous benchmark for zero-shot evaluation of information retrieval models.arXiv preprint arXiv:2104.08663, 2021

    Nandan Thakur, Nils Reimers, Andreas Rücklé, Abhishek Srivastava, and Iryna Gurevych. Beir: A heteroge- nous benchmark for zero-shot evaluation of information retrieval models.arXiv preprint arXiv:2104.08663, 2021

    2021 arXiv

  18. [26]

    Llama 2: Open foundation and fine-tuned chat models.arXiv preprint arXiv:2307.09288, 2023

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models.arXiv preprint arXiv:2307.09288, 2023

    2023 arXiv

  19. [27]

    Potential for gpt technology to optimize future clinical decision-making using retrieval-augmented generation.Annals of biomedical engineering, 2024

    Calvin Wang, Joshua Ong, Chara Wang, Hannah Ong, Rebekah Cheng, and Dennis Ong. Potential for gpt technology to optimize future clinical decision-making using retrieval-augmented generation.Annals of biomedical engineering, 2024

    2024

  20. [28]

    Cbr-rag: case-based reasoning for retrieval augmented generation in llms for legal question answering

    Nirmalie Wiratunga, Ramitha Abeyratne, Lasal Jayawardena, Kyle Martin, Stewart Massie, Ikechukwu Nkisi-Orji, Ruvan Weerasinghe, Anne Liret, and Bruno Fleisch. Cbr-rag: case-based reasoning for retrieval augmented generation in llms for legal question answering. InInternational...

    2024

  21. [29]

    Benchmarking retrieval-augmented generation for medicine

    Guangzhi Xiong, Qiao Jin, Zhiyong Lu, and Aidong Zhang. Benchmarking retrieval-augmented generation for medicine. InFindings of the Association for Computational Linguistics ACL 2024, 2024

    2024

  22. [30]

    Approximate nearest neighbor negative contrastive learning for dense text retrieval.arXiv preprint arXiv:2007.00808, 2020

    Lee Xiong, Chenyan Xiong, Ye Li, Kwok-Fung Tang, Jialin Liu, Paul Bennett, Junaid Ahmed, and Arnold Overwijk. Approximate nearest neighbor negative contrastive learning for dense text retrieval.arXiv preprint arXiv:2007.00808, 2020. 11

    2007 arXiv

  23. [31]

    An llm can fool itself: A prompt-based adversarial attack.arXiv preprint arXiv:2310.13345, 2023

    Xilie Xu, Keyi Kong, Ning Liu, Lizhen Cui, Di Wang, Jingfeng Zhang, and Mohan Kankanhalli. An llm can fool itself: A prompt-based adversarial attack.arXiv preprint arXiv:2310.13345, 2023

    2023 arXiv

  24. [32]

    An llm- assisted easy-to-trigger backdoor attack on code completion models: Injecting disguised vulnerabilities against strong detection

    Shenao Yan, Shen Wang, Yue Duan, Hanbin Hong, Kiho Lee, Doowon Kim, and Yuan Hong. An llm- assisted easy-to-trigger backdoor attack on code completion models: Injecting disguised vulnerabilities against strong detection. In33rd USENIX Security Symposium (USENIX Security 24), 2024

    2024

  25. [33]

    An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, et al. Qwen2. 5 technical report.arXiv preprint arXiv:2412.15115, 2024

    2024 arXiv

  26. [34]

    Hotpotqa: A dataset for diverse, explainable multi-hop question answering.arXiv preprint arXiv:1809.09600, 2018

    Zhilin Yang, Peng Qi, Saizheng Zhang, Yoshua Bengio, William W Cohen, Ruslan Salakhutdinov, and Christopher D Manning. Hotpotqa: A dataset for diverse, explainable multi-hop question answering.arXiv preprint arXiv:1809.09600, 2018

    2018 arXiv

  27. [35]

    Financial report chunking for effective retrieval augmented generation.arXiv preprint arXiv:2402.05131, 2024

    Antonio Jimeno Yepes, Yao You, Jan Milczek, Sebastian Laverde, and Renyu Li. Financial report chunking for effective retrieval augmented generation.arXiv preprint arXiv:2402.05131, 2024

    2024 arXiv

  28. [36]

    Enhancing financial sentiment analysis via retrieval augmented large language models

    Boyu Zhang, Hongyang Yang, Tianyu Zhou, Muhammad Ali Babar, and Xiao-Yang Liu. Enhancing financial sentiment analysis via retrieval augmented large language models. InProceedings of the fourth ACM international conference on AI in finance, 2023

    2023

  29. [37]

    Medrag: Enhancing retrieval-augmented generation with knowledge graph-elicited reasoning for healthcare copilot

    Xuejiao Zhao, Siyan Liu, Su-Yin Yang, and Chunyan Miao. Medrag: Enhancing retrieval-augmented generation with knowledge graph-elicited reasoning for healthcare copilot. InProceedings of the ACM on Web Conference 2025, 2025

    2025

  30. [38]

    Optimizing llm based retrieval augmented generation pipelines in the financial domain

    Yiyun Zhao, Prateek Singh, Hanoz Bhathena, Bernardo Ramos, Aviral Joshi, Swaroop Gadiyaram, and Saket Sharma. Optimizing llm based retrieval augmented generation pipelines in the financial domain. In Proceedings of the 2024 Conference of the North American Chapter of the Assoc...

    2024

  31. [39]

    Poisoning retrieval corpora by injecting adversarial passages.arXiv preprint arXiv:2310.19156, 2023

    Zexuan Zhong, Ziqing Huang, Alexander Wettig, and Danqi Chen. Poisoning retrieval corpora by injecting adversarial passages.arXiv preprint arXiv:2310.19156, 2023

    2023 arXiv

  32. [40]

    Universal and transferable adversarial attacks on aligned language models.arXiv preprint arXiv:2307.15043, 2023

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models.arXiv preprint arXiv:2307.15043, 2023

    2023 arXiv

  33. [41]

    [Q]”. Here is the desired answer: “[R]

    Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. Poisonedrag: Knowledge poisoning attacks to retrieval-augmented generation of large language models. In34th USENIX Security Symposium (USENIX Security 25), 2025. 12 A Implementation Details of CPA-RAG A.1 Algorithm: Initial...

    2025

  34. [42]

    The semantic meaning of the sentence remains unchanged

  35. [43]

    The answer to the question based on the sentence is [incorrect_answer]

  36. [44]

    I don’t know

    The semantic similarity between the sentence and the question is sufficiently high. Attack Guidance (AG)AG provides precise rewriting instructions to guide the LLM in naturally embedding the target question into the original sentence without altering its overall semantics. Unl...

  37. [45]

    •Comprehensive ASR (CASR): A weighted average of ASR across top-kvalues: CASR= Pn k=1 k·ASR kPn k=1 k

    Generation Effectiveness: • Attack Success Rate (ASR): Percentage of queries for which the LLM outputs the prede- fined target answerR, using substring match. •Comprehensive ASR (CASR): A weighted average of ASR across top-kvalues: CASR= Pn k=1 k·ASR kPn k=1 k

  38. [46]

    F1 = 2·Precision·Recall Precision+Recall 16 •Toxicity Efficiency Score (TES): Captures the ratio of attack success to retrievability: T ES= ASR F1

    Retriever Alignment: • Precision / Recall / F1-Score: Measures how often adversarial texts appear in the top- k retrieval results. F1 = 2·Precision·Recall Precision+Recall 16 •Toxicity Efficiency Score (TES): Captures the ratio of attack success to retrievability: T ES= ASR F1

  39. [47]

    When asked... please output

    Concealment and Naturalness: • Readability Metrics:We evaluate the readability of generated texts using four standard indices: – Flesch Reading Ease (FRE).This metric evaluates overall ease of reading. Higher FRE scores indicate simpler, more readable text: FRE= 206.835−1.015×...

  40. [48]

    To Make You Feel My Love

    Place the slide on the microscope’s eyepiece for viewing, as where is the slide placed on the microscope? Ensure it’s correctly positioned on the eyepiece to see the specimen clearly, since the eyepiece is where you place the slide to observe under the microscope. 3. To observ...

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.