Pith. sign in

REVIEW 5 major objections 6 minor 1 cited by

DeRAG: Black-box Adversarial Attacks on Multiple Retrieval-Augmented Generation Applications via Prompt Injection

T0 review · 5 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A black-box attacker can redirect a retrieval-augmented generation system to a chosen document by appending a five-token adversarial suffix, using Differential Evolution with no gradient access.

desk verdict Plausible DE-based RAG attack with real code, but the black-box claim is contradicted by the embedding-based mutation and the evaluation has internal inconsistencies; worth peer review, not desk reject. read the letter →

arxiv 2507.15042 v1 pith:D65LYFG3 submitted 2025-07-20 cs.AI cs.IR

Jerry Wang , Fang Yu This is my paper
classification cs.AIcs.IR
keywords adversarialpromptinjectionretrieval-augmentedgenerationdifferentialevolutionblack-boxattackretrievalrankingmanipulationoptimizationRAGsecuritysuffix
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to show that a black-box attacker can redirect a retrieval-augmented generation (RAG) system to a chosen wrong document by appending a very short adversarial suffix, five tokens or fewer, to the user's query. The method, DeRAG, treats the retriever as an opaque scoring function and uses Differential Evolution, a population-based search, to evolve suffixes that maximize the target document's retrieval rank. On four BEIR question-answering datasets, the authors report that DeRAG matches or beats the gradient-guided attack GGPP against dense retrievers and the PRADA attack against sparse retrievers, while using fewer tokens on average. They further claim that a readability-aware candidate-pool strategy lowers the perplexity-like negative log-likelihood of suffixes significantly, and that a RoBERTa-based detector cannot distinguish DeRAG suffixes from clean queries. If these results hold, closed RAG APIs with no gradient access remain practical targets for prompt-injection attacks that corrupt the evidence the generator sees.

What carries the argument

Differential Evolution (DE) over discrete token sequences, guided by a hinge-loss fitness that measures the gap between the top-$k$ similarity threshold and the target document's similarity to the suffixed query. The algorithm maintains a population of candidate suffixes, performs mutation by adding a scaled difference of two population members' token embeddings and projecting back to the nearest vocabulary token, applies binomial crossover, and keeps the fitter of parent and trial. Two variants are used: DE_seq_stop grows the suffix length one token at a time and returns the shortest successful suffix, while DE_fixed_stop stays at a fixed length to reduce iterations. The hinge loss $L(s)=\max\{0,\tau_k(e_{q\|s})-\text{Sim}(e_{q\|s},e_t)\}$ is the load-bearing objective: it is zero exactly when the target document reaches top-$k$, so the success rule and plateau rule can halt evolution early.

What would settle it

Rerun GGPP and PRADA on the paper's exact 1,000-document, 100-query BEIR subsets with the same target selection and report iteration counts; if either baseline then equals or exceeds DeRAG's success rates, the paper's competitive-equivalence claim is not established. A second check: generate DeRAG suffixes against a retriever outside the BERT-base family, such as an instruction-tuned embedding model; if top-K success drops to near chance, the attack does not generalize to the broader RAG applications the title claims.

Watch

Extended reading notes

Core claim

The paper's central discovery is that the discrete problem of choosing an adversarial suffix can be solved by Differential Evolution operating in the retriever's embedding space, needing only forward calls and cosine similarities. Each candidate suffix is a token sequence; mutation creates a donor vector by embedding arithmetic between three random population members and projects the result to the nearest token, crossover mixes tokens, and selection keeps the suffix with lower hinge loss $L(s)=\max(0,\tau_k(e_{q\|s})-\text{Sim}(e_{q\|s},e_t))$, which reaches zero exactly when the target document's rank is at most $k$. With an early-stopping rule that grows suffixes one token at a time (DE_seq_stop), the authors report that 2–3 tokens on average suffice to lift a randomly chosen wrong document into the top 10 on dense retrievers, and that the same procedure adapted to BM25 scores works on sparse retrievers. They interpret the attack's success through a local-geometry analysis showing the query–target similarity surface rises almost monotonically along one dominant direction, which DE can climb without gradients. A secondary claim is that suffixes chosen from an MLM-derived candidate pool are more fluent, with a significantly lower MLM negative log-likelihood by Welch's t-test, without sacrificing attack success, and that the resulting suffixes evade a trained detector at near-chance accuracy.

Load-bearing premise

The comparison against GGPP and PRADA assumes those baselines were run under exactly the same conditions as DeRAG, meaning the same 1,000-document and 100-query subsets and the same target-document sampling, but the paper does not report rerunning them on those subsets.

Editorial extensions

If this is right

  • DeRAG's success with at most five tokens on dense and sparse retrievers means closed, gradient-free RAG APIs can be redirected to attacker-chosen documents with only a handful of query tokens.
  • The near-chance detection accuracy of a BERT/RoBERTa-based detector suggests that existing perplexity- or classifier-based prompt defenses will not reliably catch these suffixes.
  • The early-stopping variant cuts average query cost by about 40% compared to vanilla DE while matching success, making the attack cheaper to run at scale.
  • A staged attack that first pushes a target into the top 10 and then to rank 1 reduces downstream answer quality (EM, F1, ROUGE-L, BERTScore) on SQuAD and NQ-Open, so even partial retrieval hijacking degrades the generator's output.
  • The hinge-loss objective outperforms naive cosine alignment in success rate and avoids the semantic drift that makes cosine-trained suffixes easier to spot.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Implicit in the paper: if embedding models share the latent geometry the paper cites, suffixes evolved against BERT-base should transfer to other dense retrievers without re-optimization; running DeRAG against an instruction-tuned encoder would test that directly and would strengthen the multi-application claim.
  • The prefix-versus-suffix complementarity result implies an attacker can spread tokens across both positions to defeat defense mechanisms that check only one end of the query; the paper does not draw this defensive implication.
  • Because the readability strategy lowers but does not eliminate the MLM negative log-likelihood gap, a detector trained specifically on DE-generated suffixes, rather than the RoBERTa classifier evaluated here, would likely raise detection rates; this arms-race next step is left implicit.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes DeRAG, a differential-evolution-based method for optimizing short adversarial suffixes that are appended to queries in Retrieval-Augmented Generation (RAG) pipelines. The method is claimed to be gradient-free and black-box, treating the retriever as an oracle and evolving suffixes that re-rank a chosen incorrect document into the top-k results. Experiments are reported on four BEIR QA subsets (MS MARCO, SciFact, FiQA, FEVER) for both dense retrievers (compared against GGPP) and sparse retrievers (compared against PRADA), along with a readability-aware candidate-pool strategy, detection-bypass measurements, and downstream answer-quality degradation on SQuAD and NQ-Open.

Significance. If the central claims held, the contribution would be practically important: a few-token, query-only attack on RAG retrieval would pose a credible threat to closed APIs, since it avoids backpropagation and requires only retrieval scores. The idea of using differential evolution with a rank-based fitness function is sensible, and the paper provides a broad experimental surface: four BEIR subsets, two retrieval paradigms, a downstream QA evaluation, detection evasion, and readability ablations, with a public code repository. However, several load-bearing claims are internally inconsistent. The mutation operator as described in §3.3.2 requires access to the target retriever's token-embedding matrix, contradicting the black-box claim in the abstract and introduction. The sparse-retriever summary in §4.2 is directly contradicted by Table 1. The baseline comparison protocol is not established, and the readability and detection-evidence claims suffer from circularity and anomalous statistics. These issues are fixable in principle, but as submitted the central claims are not supported.

major comments (5)
  1. [§3.3.2 and Abstract] The black-box claim is load-bearing but the mutation operator as described requires the target retriever's internal token-embedding matrix. The text says tokens are 'first mapping each token to a continuous representation (e.g., an embedding or an integer index)', and the worked example is explicit: it 'extract[s] their 768-dimensional embeddings using the BERT encoder', computes the donor vector in that embedding space, and selects the replacement token by L2 nearest-neighbor over the vocabulary. If the deployed MutXover uses the retriever's embedding matrix (or a distance oracle over it), DeRAG has white-box access to model internals even though it avoids backpropagation. The paper provides no ablation that restricts mutation to token IDs alone or to a public embedding API. The authors should either add such an ablation or revise the abstract and introduction to state that access to the retriever's embedding table is required.
  2. [§4.2 and Table 1] The text states that 'our sequential variant DE_seq_stop achieves the highest Top-10 and Top-20 success rates' on sparse retrievers, but Table 1 shows PRADA has higher Succ@10 on SciFact (0.980 vs 0.890) and FiQA (0.990 vs 0.810) and higher Succ@20 on both (1.000 vs 0.970 and 1.000 vs 0.890). This direct contradiction invalidates the sparse-retriever summary as written. The comparison also lacks confidence intervals or significance tests, and all values are point estimates over only 100 queries.
  3. [§4.1 and Table 2] The DeRAG evaluation uses randomly sampled subsets of 1,000 documents and 100 queries, but the manuscript does not state whether the GGPP and PRADA baselines were rerun on these same subsets with the same target-selection rule. Table 2 gives no iteration counts for GGPP, which suggests the numbers may come from external papers. If the baselines used different corpora, query samples, or target-selection procedures, the abstract's claim of 'competitive (and in some cases higher) success rates' is not established. The authors should either rerun the baselines on identical subsets or provide exact protocol provenance, and should state whether any baseline numbers were taken from prior publications.
  4. [§4.4.2 and Appendix H] The readability-aware strategy constructs the token candidate pool using the masked-language-model head of BERT and then evaluates fluency using the same BERT MLM's negative log-likelihood. Selecting candidates that minimize this objective and then reporting that the objective decreases is partly by construction. The Welch's t-test shows a statistically significant NLL difference, but a self-reported metric from the same model used for candidate generation cannot support the claim of improved human readability. The authors should report an independent fluency metric, such as perplexity from a different language model, or a human evaluation.
  5. [§4.4.1 and Table 4] The reported AUROC of 0.2023 is far below 0.5, which indicates that the detector's scores are inversely related to the adversarial/benign labels, rather than 'near-chance' performance. The paper should report the ROC curve, explain the inversion (for example, inverted labels or threshold miscalibration), and state whether the separation is statistically different from chance. As it stands, the conclusion that DeRAG suffixes 'evade detection' is not supported by the reported statistic.
minor comments (6)
  1. [§3.1] Equations (1)-(4) are not clearly connected to the DE formulation; Eq. (3) contains undefined notation such as s(i)(10), and 'ε noise = 0.2' is not defined in the surrounding text. Please clarify the notation or move this analysis to an appendix with full definitions.
  2. [§4.3] The sentence 'DE_seq_stop achieves the highest success rate at all datasets' contradicts Table 2 on several entries, for example ggpp Succ@1 = 0.830 versus 0.570 on MS MARCO and ggpp Succ@10 = 0.545 versus 0.515 on FEVER; please rephrase to a 'competitive' claim or provide exact per-entry comparisons.
  3. [Table 3] The caption says 'four datasets' but the table lists only three (FIQA, FEVER, SciFact); please correct the caption or add the missing dataset.
  4. [§4.4.1 and Table 13] The CLS attack-probability values for Q and Q∥S are nearly identical (for instance 0.399 vs 0.399 on MS MARCO), which is consistent with a detector that cannot separate the classes; the paper should explain why the AUROC is then 0.20 rather than close to 0.5.
  5. [§4.5 and Table 5] In the 'Fail' group, answer quality often improves relative to baseline (e.g., SQuAD EM from 0.322 to 0.348, +8.1%); since 'Fail' means the target chunk was not inserted into Top-10, the text should explain why failed attacks improve downstream quality.
  6. [References] Reference [25] contains an extra unmatched URL 'https://arxiv.org/abs/2011.03901' after the Lewis et al. citation; this appears to be a copy-paste artifact and should be removed.

Circularity Check

2 steps flagged · score 6.0 of 10

The attack-success numbers are empirical, but the black-box premise is redefined in the mutation operator and the readability gain is measured with the same MLM that constructs the candidate pool.

  1. self definitional [Section 1 (Introduction) vs. Section 3.3.2 Mutation and worked example; Algorithm 1 MutXover]
    ""we treat the retriever as a black box, requires no gradient access or model internals"; "the implementation usually proceeds by first mapping each token to a continuous representation (e.g., an embedding or an integer index), performing the arithmetic operation ... and then projecting or discretizing each m(d) back into the nearest valid token"; "extracting their 768-dimensional embeddings using the BERT encoder ... An L2 nearest-neighbor search over V selects phantom.""

    The paper's advertised advantage over GGPP is that DeRAG needs no model internals, only forward retrieval calls. But the only concrete mutation mechanism given maps tokens to the retriever encoder's embeddings and projects back by L2 nearest-neighbor over the vocabulary. 'Black-box' therefore reduces to 'no backpropagation' while still requiring the embedding matrix of the very model the closed-API threat model says is inaccessible. The central premise is redefined by the implementation: the claimed constraint is satisfied only because the method defines black-box to exclude gradients, not because it avoids internals.

  2. self definitional [Section 4.4.2 (readability pooling) with Appendix H, Tables 15-16]
    ""to construct the token candidate pool, we mask the last TAIL_L tokens of the query, pass the masked sequence through the MLM head, average the predicted softmax probabilities over those TAIL_L positions, and select the top k vocabulary tokens as mask-fill candidates"; "To quantify readability gains, we report the average MLM negative log-likelihood (NLL), a proxy for fluency"; "NLL clearly decreases as the pool shrinks"; "Welch's t-test ... confirming the reduction is significant across all datasets.""

    The candidate pool is built by taking the highest-probability tokens from the masked-language-model head, and the claimed readability improvement is then measured by that same model's negative log-likelihood. Restricting the vocabulary to the top softmax tokens mechanically lowers the same model's NLL, so the Welch-significant reduction in Tables 15-16 is a property of the selection rule rather than evidence about human readability. An independent language model or human fluency rating would break the circle; as presented, the metric being optimized and the metric being reported are the same function.

full rationale

The core attack-success results are empirical: DeRAG optimizes a discrete suffix against a retrieval-ranking loss and reports measured Success@K, so those numbers are not derived from the paper's assumptions and are not circular. The comparison to GGPP and PRADA may be protocol-mismatched (the paper does not state that baselines were rerun on the same 1,000-document/100-query subsets), but that is a validity risk, not circularity. There is no load-bearing self-citation: the only self-reference is the GitHub repository [34] for data and results. However, two load-bearing claims do reduce by construction. First, the black-box/no-internals premise is self-definitional: Section 3.3.2 implements mutation with the retriever's BERT token embeddings and L2-nearest-neighbor vocabulary projection, so the method is gradient-free but not free of internal representations, undermining the closed-API threat model in the abstract and introduction. Second, the readability-aware strategy selects candidates with an MLM's top-k softmax tokens and then validates the improvement with that same MLM's NLL, so the statistically significant 'readability' gain is built into the pool construction. The detector-evasion claim is under-specified rather than circular. These two steps make the paper partially circular, though the retrieval-attack success rates themselves retain independent empirical content.

Assumptions & free parameters 7 free parameters · 6 assumptions · 0 invented entities

The attack is an empirical search whose outcomes depend on hand-set DE hyperparameters, the choice of BERT and BM25 as retrievers, small subsampled corpora, and the MLM-based readability pool. The paper contributes a new attack configuration but does not establish generality beyond these settings.

free parameters (7)
  • DE population size N = not reported in experiments
    Controls exploration breadth; no ablation or stated values across runs, so the reported successes depend on an unspecified setting.
  • DE scale factor F = 0.5 in the worked example; typical [0.5, 1.0]
    Hand-set mutation strength; the paper gives typical ranges but no sensitivity analysis.
  • DE crossover rate CR = 0.5 in the worked example; typical [0.1, 0.9]
    Hand-set probability that a token position comes from the donor; no sensitivity analysis.
  • Maximum suffix length n_max = 5 tokens for fixed variants; up to 10 in encoding
    The attack's core constraint; Appendix D shows success plateaus around 5 tokens, so results are specific to this budget.
  • Plateau patience T = not reported
    Early stopping halts after T generations without improvement; T is never given, affecting reported iteration counts.
  • MLM candidate pool size = 500 to 30,522 in the ablation
    Table 6 shows Rank@1 success varies with pool size (e.g., Fever 0.19 to 0.38), so the readability-aware variant's results depend on this choice.
  • Gaussian noise scales epsilon = 0.2 and 0.4
    Used only in the local sensitivity analysis in Eqs. 3 and 4; hand-chosen and not part of the attack objective.
assumptions (6)
  • domain assumption BERT-base-uncased CLS embedding retrieval with cosine similarity represents dense RAG retrieval.
    Section 4.1 embeds all documents and queries with BERT-base-uncased; no instruction-tuned or large-scale commercial retrievers are tested.
  • domain assumption BM25 score represents sparse RAG retrieval.
    Section 3.2 adapts the attack by replacing cosine with the BM25 score; only one sparse ranking function is evaluated.
  • domain assumption Random 1000-document and 100-query BEIR subsets are sufficient for stable comparisons.
    Section 4.1 subsamples without confidence intervals or power analysis, and the MS MARCO subset is acknowledged to be small and redundant.
  • domain assumption MLM negative log-likelihood is a proxy for human readability.
    Appendix H equates lower NLL with better fluency; no human readability study is included.
  • ad hoc to paper Continuous DE operators remain effective after projection to nearest discrete tokens.
    Section 3.3.2 maps donor vectors back to the vocabulary via L2 nearest-neighbor search; convergence properties in this discrete space are not established.
  • standard math Differential evolution retains its global optimization properties on token-sequence search spaces.
    The paper relies on DE as a robust black-box optimizer, citing Storn and Price, without a formal justification for discrete token arithmetic.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DeRAG: Black-box Adversarial Attacks on Multiple Retrieval-Augmented Generation Applications via Prompt Injection." pith.science (2026). https://pith.science/paper/D65LYFG3

@misc{pith2026250715042,
  author       = {Pith},
  title        = {Pith review of: DeRAG: Black-box Adversarial Attacks on Multiple Retrieval-Augmented Generation Applications via Prompt Injection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/D65LYFG3}},
  note         = {Machine review of arXiv:2507.15042}
}
read the original abstract

Adversarial prompt attacks can significantly alter the reliability of Retrieval-Augmented Generation (RAG) systems by re-ranking them to produce incorrect outputs. In this paper, we present a novel method that applies Differential Evolution (DE) to optimize adversarial prompt suffixes for RAG-based question answering. Our approach is gradient-free, treating the RAG pipeline as a black box and evolving a population of candidate suffixes to maximize the retrieval rank of a targeted incorrect document to be closer to real world scenarios. We conducted experiments on the BEIR QA datasets to evaluate attack success at certain retrieval rank thresholds under multiple retrieving applications. Our results demonstrate that DE-based prompt optimization attains competitive (and in some cases higher) success rates compared to GGPP to dense retrievers and PRADA to sparse retrievers, while using only a small number of tokens (<=5 tokens) in the adversarial suffix. Furthermore, we introduce a readability-aware suffix construction strategy, validated by a statistically significant reduction in MLM negative log-likelihood with Welch's t-test. Through evaluations with a BERT-based adversarial suffix detector, we show that DE-generated suffixes evade detection, yielding near-chance detection accuracy.

Figures

Figures reproduced from arXiv: 2507.15042 by the authors.

Figure 1
Figure 1. System architecture of the differential evolution [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Cumulative success rates for DE_seq (blue) vs. DE_seq_stop (orange) as a function of allowed suffix length on MS MARCO dataset. 4.3.3 Prefix and Suffix mutual Attacks. We additionally ran DE on both prefix and suffix from 1 to 5 tokens, attacking on four datasets to examine whether the two strategies are complementary or not. To consider the best potential, we set the task on targeting rank 1 [PITH_FULL_IMAGE:figur… view at source ↗
Figure 3
Figure 3. (a) Local score surface around a query vector. (b) Isotropic smoothness is nearly uncorrelated with attack efficacy. (c) [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: (a) Mean ΔRank as suffix length increases across MS MARCO, FiQA, and NQ. (b) Marginal gain in ΔRank per additional suffix token. E AGGREGATED RESULTS ON LOSS COMPARISON To evaluate the relative effectiveness of Hinge Loss and Cosine Loss in adversarial tail-patch attac…
Figure 5
Figure 5. Figure 5: PPL distributions. Blue = original queries (Q); orange = attacked queries (Q [PITH_FULL_IMAGE:figures/full_fig_p016_5.png]
Figure 6
Figure 6. Figure 6: CLS attack-probability distributions for the same 100 query pairs as Fig. 5. [PITH_FULL_IMAGE:figures/full_fig_p016_6.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Evaluating the Robustness of Retrieval-Augmented Generation to Adversarial Evidence in the Health Domain

    cs.IR 2025-09 conditional novelty 6.0 of 10

    Misleading health documents in RAG context sharply lower LLM accuracy, and heavily helpful-biased retrieval pools restore it.

Reference graph

Works this paper leans on

37 extracted references · 15 canonical work pages · cited by 1 Pith paper

  1. [1]

    MS MARCO: A Human Generated Machine Reading Comprehension Dataset

    Payal Bajaj, Daniel Campos, Nick Craswell, Li Deng, Jianfeng Gao, Xiaodong Liu, Rangan Majumder, Andrew McNamara, Bhaskar Mitra, Tri Nguyen, Mir Rosenberg, Xia Song, Alina Stoica, Saurabh Tiwary, and Tong Wang. MS MARCO: A Human Generated Machine Reading Comprehension Dataset. arXiv preprint arXiv:1611.09268, 2018. https://arxiv.org/abs/1611.09268. DeRAG:...

    arXiv 2018

  2. [2]

    WWW’18 open challenge: Financial opinion mining and question answering

    Macedo Maia, Siegfried Handschuh, Andre Freitas, Brian Davis, Ross McDermott, Manel Zarrouk, and Alexandra Balahur. WWW’18 open challenge: Financial opinion mining and question answering. In Companion of the The Web Confer- ence 2018 (WWW ’18 Companion) , pages 1941–1942, Lyon, France, April 2018. International World Wide Web Conferences Steering Committee

    work page 2018

  3. [3]

    Fact or Fiction: Verifying Scientific Claims

    Daniel Wadden, Rishi Bommasani, Russell Kaplan, Swabha Swayamdipta, and Nanyun Peng. Fact or Fiction: Verifying Scientific Claims. In Proceedings of EMNLP, pages —, 2020

    work page 2020

  4. [4]

    FEVER: A large-scale dataset for fact extraction and VERification

    James Thorne, Andreas Vlachos, Christos Christodoulopoulos, and Arpit Mittal. FEVER: A large-scale dataset for fact extraction and VERification. In Proc. of NAACL-HLT, pages 809–819, New Orleans, LA, USA, 2018. https://aclanthology. org/N18-1074/

    work page 2018

  5. [5]

    SQuAD: 100,000+ questions for machine comprehension of text

    Pranav Rajpurkar, Jian Zhang, Konstantin Lopyrev, and Percy Liang. SQuAD: 100,000+ questions for machine comprehension of text. In Proc. of EMNLP, pages 2383–2392, Austin, TX, USA, 2016. https://aclanthology.org/D16-1264/

    work page 2016

  6. [6]

    BEIR: A Heterogeneous Benchmark for Zero-shot Evaluation of Information Retrieval Models

    Nandan Thakur, Joel Mackenzie, Hasan Sajjad, Ziyu Yao, and Preslav Nakov. BEIR: A Heterogeneous Benchmark for Zero-shot Evaluation of Information Retrieval Models. arXiv preprint arXiv:2104.08663, 2021. https://arxiv.org/abs/2104.08663

    arXiv 2021

  7. [7]

    Dai, Jakob Uszkoreit, Quoc Le, and Slav Petrov

    Tom Kwiatkowski, Jennimaria Palomaki, Olivia Redfield, Michael Collins, Ankur Parikh, Chris Alberti, Danielle Epstein, Illia Polosukhin, Jacob Devlin, Kenton Lee, Kristina Toutanova, Llion Jones, Matthew Kelcey, Ming-Wei Chang, An- drew M. Dai, Jakob Uszkoreit, Quoc Le, and Slav Petrov. Natural Questions: A Benchmark for Question Answering Research. Trans...

    work page 2019

  8. [8]

    Differential evolution – a simple and efficient heuristic for global optimization over continuous spaces

    Rainer Storn and Kenneth Price. Differential evolution – a simple and efficient heuristic for global optimization over continuous spaces. Journal of Global Optimization, 11(4):341–359, 1997

    work page 1997

Show all 37 references
  1. [9]

    Salem, and Ahmed E

    Mohamed Alsayed Elaziz, Ahmed Ali Ismail, Ashraf M. Salem, and Ahmed E. Hassanien. Differential Evolution: A Recent Review Based on State-of-the-Art Works. Alexandria Engineering Journal, 60(4):3595–3615, 2021

    2021

  2. [10]

    Enhancing LLM Factual Accuracy with RAG to Counter Hallucinations: A Case Study on Domain-Specific Queries in Private Knowledge-Bases

    Jiarui Li, Ye Yuan, and Zehua Zhang. Enhancing LLM Factual Accuracy with RAG to Counter Hallucinations: A Case Study on Domain-Specific Queries in Private Knowledge-Bases. arXiv preprint arXiv:2403.10446, 2024. https://arxiv. org/abs/2403.10446

    2024 arXiv

  3. [11]

    Targeting the Core: A Simple and Effective Method to Attack RAG-based Agents via Direct LLM Manipulation

    Xuying Li, Zhuo Li, Yuji Kosuga, Yasuhiro Yoshida, and Victor Bian. Targeting the Core: A Simple and Effective Method to Attack RAG-based Agents via Direct LLM Manipulation. arXiv preprint arXiv:2412.04415, 2024. https://arxiv.org/abs/ 2412.04415

    2024 arXiv

  4. [12]

    BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models

    Jiaqi Xue, Mengxin Zheng, Yebowen Hu, Fei Liu, Xun Chen, and Qian Lou. BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models. arXiv preprint arXiv:2406.00083, 2024. https://arxiv.org/abs/ 2406.00083

    2024 arXiv

  5. [13]

    Detecting Language Model Attacks with Perplexity

    Gabriel Alon and Michael Kamfonas. Detecting Language Model Attacks with Perplexity. arXiv preprint arXiv:2308.14132, 2023. https://arxiv.org/abs/2308.14132

    2023 arXiv

  6. [14]

    Robust Safety Classifier Against Jailbreaking Attacks: Adversarial Prompt Shield

    Jinhwa Kim, Ali Derakhshan, and Ian Harris. Robust Safety Classifier Against Jailbreaking Attacks: Adversarial Prompt Shield. In Proceedings of the 8th Workshop on Online Abuse and Harms (WOAH 2024) , pages 159–170, Mexico City, Mexico, June 2024. Association for Computational...

    2024

  7. [15]

    CtrlRAG: Black-box Adversarial Attacks Based on Masked Lan- guage Models in Retrieval-Augmented Language Generation

    Runqi Sui. CtrlRAG: Black-box Adversarial Attacks Based on Masked Lan- guage Models in Retrieval-Augmented Language Generation. arXiv preprint arXiv:2503.06950, 2025. https://arxiv.org/abs/2503.06950

    2025

  8. [16]

    PRADA: Practical Black-box Adversarial Attacks against Neural Ranking Models

    Chen Wu and Ruqing Zhang. PRADA: Practical Black-box Adversarial Attacks against Neural Ranking Models. ACM Transactions on Information Systems , 41 (Dec. 16, 2022). https://doi.org/10.1145/3576923

    2022 doi

  9. [17]

    One Pixel Attack for Fooling Deep Neural Networks

    Jiawei Su, Danilo Vasconcellos Vargas, and Kouichi Sakurai. One Pixel Attack for Fooling Deep Neural Networks. IEEE Transactions on Evolutionary Computation , 23(5):828–841, 2019. https://doi.org/10.1109/TEVC.2019.2890858

    2019

  10. [18]

    BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. arXiv preprint arXiv:1810.04805, 2018. http://arxiv.org/abs/1810.04805

    2018 arXiv

  11. [19]

    Ignore Previous Prompt: Attack Techniques for Language Models

    Fábio Perez and Ian Ribeiro. Ignore Previous Prompt: Attack Techniques for Language Models. arXiv preprint arXiv:2211.09527, 2022. https://arxiv.org/abs/ 2211.09527

    2022 arXiv

  12. [20]

    Auto- matic and Universal Prompt Injection Attacks Against Large Language Models

    Xiaogeng Liu, Zhiyuan Yu, Yizhe Zhang, Ning Zhang, and Chaowei Xiao. Auto- matic and Universal Prompt Injection Attacks Against Large Language Models. arXiv preprint arXiv:2403.04957, 2024. https://arxiv.org/abs/2403.04957

    2024 arXiv

  13. [21]

    Goal-guided Generative Prompt Injection Attack on Large Language Models

    Chong Zhang, Mingyu Jin, Qinkai Yu, Chengzhi Liu, Haochen Xue, and Xiaobo Jin. Goal-guided Generative Prompt Injection Attack on Large Language Models. arXiv preprint arXiv:2404.07234, 2024. https://arxiv.org/abs/2404.07234

    2024 arXiv

  14. [22]

    Pappas, and Eric Wong

    Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. Jailbreaking Black Box Large Language Models in Twenty Queries. arXiv preprint arXiv:2310.08419, 2024. https://arxiv.org/abs/2310.08419

    2024 arXiv

  15. [23]

    Prompt Perturbation in Retrieval-Augmented Generation based Large Language Models

    Zhibo Hu, Chen Wang, Yanfeng Shu, Hye-young Paik, and Liming Zhu. Prompt Perturbation in Retrieval-Augmented Generation based Large Language Models. arXiv preprint arXiv:2402.07179, 2024. https://arxiv.org/abs/2402.07179

    2024 arXiv

  16. [24]

    TEMPEST: Multi-Turn Jailbreaking of Large Language Models with Tree Search

    Andy Zhou and Ron Arel. TEMPEST: Multi-Turn Jailbreaking of Large Language Models with Tree Search. In Proceedings of the ICLR 2025 Workshop on Building Trust in Language Models and Applications , 2025. https://openreview.net/forum? id=rDC2UVdB0t

    2025

  17. [25]

    Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks

    Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, Sebastian Riedel, and Douwe Kiela. Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks. arXiv preprint arXiv:...

    2005 arXiv

  18. [26]

    Release strategies and the social impacts of language models

    Irene Solaiman, Miles Brundage, Jack Clark, Amanda Askell, Ariel Herbert-Voss, Jeff Wu, Alec Radford, Gretchen Krueger, Jong Wook Kim, Sarah Kreps, and others. Release strategies and the social impacts of language models. In arXiv preprint arXiv:1908.09203, pages —, 2019

    1908 arXiv

  19. [28]

    Black-box Adversarial Sample Generation Based on Differential Evolution

    Junyu Lin, Lei Xu, Yingqi Liu, and Xiangyu Zhang. Black-box Adversarial Sample Generation Based on Differential Evolution. arXiv preprint arXiv:2007.15310, 2020. https://arxiv.org/abs/2007.15310

    2007 arXiv

  20. [29]

    Black-Box Prompt Learning for Pre-trained Language Models

    Shizhe Diao, Zhichao Huang, Ruijia Xu, Xuechun Li, Yong Lin, Xiao Zhou, and Tong Zhang. Black-Box Prompt Learning for Pre-trained Language Models. Transactions on Machine Learning Research , to appear, 2023. https://openreview. net/forum?id=IvsGP7xRvm

    2023

  21. [30]

    Generative Representational Instruction Tuning

    Niklas Muennighoff, Hongjin Su, Liang Wang, Nan Yang, Furu Wei, Tao Yu, Amanpreet Singh, and Douwe Kiela. Generative Representational Instruction Tuning. arXiv preprint arXiv:2402.09906, 2024. https://arxiv.org/abs/2402.09906

    2024 arXiv

  22. [31]

    Arctic-Embed: Scalable, Efficient, and Accurate Text Embedding Models

    Luke Merrick, Danmei Xu, Gaurav Nuti, and Daniel Campos. Arctic-Embed: Scalable, Efficient, and Accurate Text Embedding Models. arXiv preprint arXiv:2405.05374, 2024. https://arxiv.org/abs/2405.05374

    2024 arXiv

  23. [32]

    Token-Level Adversarial Prompt Detection Based on Perplexity Measures and Contextual Information

    Zhengmian Hu, Yichao Lu, Xuejun Liao, Jianfeng Gao, and Maxine Eskenazi. Token-Level Adversarial Prompt Detection Based on Perplexity Measures and Contextual Information. arXiv preprint arXiv:2311.11509, 2023. https://arxiv.org/ abs/2311.11509

    2023 arXiv

  24. [33]

    Rishi Jha, Collin Zhang, Vitaly Shmatikov, and John X. Morris. Harnessing the Universal Geometry of Embeddings. arXiv preprint arXiv:2505.12540, 2025. https://arxiv.org/abs/2505.12540

    2025

  25. [34]

    pen9rum, Rag_attack_DeRag: Differential Evolution Attacks on Retrieval- Augmented Generation, GitHub repository, https://github.com/pen9rum/Rag_ attack_DeRag, accessed May 25, 2025

    2025

  26. [35]

    The Probabilistic Relevance Framework: BM25 and Beyond

    Stephen Robertson and Hugo Zaragoza. The Probabilistic Relevance Framework: BM25 and Beyond. Foundations and Trends in Information Retrieval , 3(1):333–389,

  27. [36]

    Download to CSV

    Vladimir Karpukhin, Barlas Oguz, Sewon Min, Patrick Lewis, Ledell Wu, Sergey Edunov, Danqi Chen, and Wen-tau Yih. Dense Passage Retrieval for Open- Domain Question Answering. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP) , pa...

    1996

  28. [2009]

    https://doi.org/10.1561/1500000019

    doi

  29. [2025]

    https://arxiv.org/abs/2309.08532

    arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.