Pith. sign in

REVIEW 5 major objections 6 minor 34 references

Combating Knowledge Corruption in Agent Systems: A Byzantine-Tolerant Secure Collaborative RAG Framework

T0 review · 5 major / 6 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read SecureCollaRAG bounds the risk of accepting a poisoned RAG document by ε+(1−ε)e^{−γ} when malicious sources are a minority, with asymptotic risk e^{−γ}.

desk verdict The defense and the ATA attack are worth reading, but the proof of the central risk bound is internally inconsistent and the advertised guarantee does not follow; this needs a major revision, not a desk reject. read the letter →

arxiv 2608.04366 v1 pith:SO4DRWWW submitted 2026-08-05 cs.CR cs.AI

Zhaoqi Wang , Daqing He , Zijian Zhang , Ye Liu , Jiamou Liu , Zhirui Zeng , Zhan Qin , Zhen Li
show 8 more authors
Xin Li Hongwei Yao Jincheng An Yong Liu Yi Li Qi Sun Xiulei Liu Liehuang Zhu
This is my paper · ORCID
classification cs.CRcs.AI
keywords retrieval-augmentedgenerationknowledgecorruptionattackByzantinefaulttolerancegraphneuralnetworkmulti-sourceverificationdocumentpoisoningLLMsecurityadaptivetampering
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Retrieval-augmented generation (RAG) lets large language models answer from external documents, but those documents can be poisoned so the model says what an attacker wants. This paper tries to establish that such knowledge-corruption can be made provably hard when retrieval happens across many independent sources. It proposes SecureCollaRAG, which builds a graph of the retrieved documents, scores each document's credibility with a dynamic graph neural network, and discards low-scoring documents before they reach the LLM. The formal centerpiece is Theorem 1: with fewer than half of the sources malicious, the probability of accepting a poisoned document is at most ε+(1−ε)$e^{{−γ}}$, and its limit superior is $e^{{−γ}}$; empirically, attack success rates drop to single digits on medical and finance datasets, even against a new stealthy attack the paper introduces.

What carries the argument

The load-bearing machinery is the Multi-source Knowledge Validation Mechanism, implemented as a dynamic verification graph G_t with documents as nodes and composite-similarity edges, processed by a graph attention network with residual connections, source-reliability gating, cluster prototypes, and a dual-channel classifier that produces document credibility C(d). Three formal components carry the argument: Lemma C establishes the separability of malicious from benign documents by a margin γ in the GNN's latent space; Lemma D bounds the calibration error by ε+(1−ε)$e^{{−γ}}$ using the logistic sigmoid's behavior; Lemma E shows the exponentially smoothed source reliability converges to true long-term credibility. Theorem 1 combines these to bound the instantaneous risk and its limit superior.

What would settle it

Measure the minimum distance between embedded malicious and embedded benign documents in the trained GNN's latent space on a test set produced by the Adaptive Tampering Attack; if that distance is not strictly positive (or is below the margin γ the proof requires), the cluster-separability premise fails and Theorem 1's bound does not apply.

Watch

Extended reading notes

Core claim

The core discovery is that defending collaborative RAG can be reframed as Byzantine-robust aggregation: instead of trying to spot poisoned text by its wording, verify each document against many independent sources and let a graph neural network assign it a credibility score. The verification graph has documents as nodes and edges weighted by semantic and categorical similarity; the GNN combines node features, gated source-reliability signals, and cluster prototypes to output C(d) ∈ [0,1]. Documents below a threshold are discarded, source reliabilities are updated by exponential smoothing, and documents in the uncertain zone are re-checked by a commonsense LLM auditor. The paper's central formal claim is Theorem 1, which states that under a separation-margin assumption on the learned latent space, the risk R_t of the verification mechanism satisfies R_t ≤ ε+(1−ε)$e^{{−γ}}$ for all t and lim sup R_t ≤ $e^{{−γ}}$, meaning a poisoned document is exponentially unlikely to reach the LLM.

Load-bearing premise

The load-bearing premise is that malicious and benign documents occupy separate clusters with a margin γ in the GNN's learned feature space; if the attacker's documents intermingle with benign ones, as the paper's own Adaptive Tampering Attack is designed to do, this premise fails.

Editorial extensions

If this is right

  • Multi-institution RAG deployments in healthcare and finance can safely aggregate siloed, non-IID data when fewer than half of the participating sources are malicious.
  • Attack success rates drop to single digits on MediNote and Finance Alpaca under the Adaptive Tampering Attack, whereas RobustRAG and FilterRAG leave double-digit attack success rates.
  • Source reliability scores converge to true credibility, so the system progressively deprioritizes untrustworthy sources over interaction rounds.
  • The paper introduces the Adaptive Tampering Attack, which generates semantically diverse malicious documents that evade clustering-based detection, providing a more realistic stress test for RAG defenses.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The formal guarantee is only as strong as the separation margin γ; a direct stress test is to measure that margin in the trained GNN for ATA-generated documents, whose design explicitly targets intermingling with benign content.
  • The same verification-graph abstraction could be carried over to other LLM pipelines that fuse multiple sources online, such as tool-use agents or multi-agent deliberation, where source trust must be updated without a fixed corpus.
  • Training the GNN with an explicit inter-class margin objective, rather than relying on the topology loss to create one, would make the exponential bound less dependent on the representation's luck.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes SecureCollaRAG, a defense framework for collaborative retrieval-augmented generation (RAG) systems against knowledge-corruption attacks. The framework builds a dynamic document graph from multiple sources, computes document credibility scores with a GNN, filters low-credibility documents, and updates source reliability scores over time. The authors also introduce a new attack, the Adaptive Tampering Attack (ATA), which generates diverse, stealthy poisoned documents. The central claim is that, under a Byzantine threat model with fewer than 50% malicious sources, the verification mechanism satisfies an exponentially small risk bound, stated as Theorem 1 in Section IV.C and proved in Appendix F. The paper also reports extensive experiments on four datasets with three LLMs, comparing against RobustRAG, FilterRAG, and multi-source baselines.

Significance. If the formal guarantee were valid, the paper would make a meaningful contribution: it would be among the first frameworks to combine multi-source consensus, dynamic graph learning, and a formal Byzantine-robustness argument for RAG. The proposed ATA attack is a useful addition to the adversarial toolkit, and the evaluation spans realistic domain-specific datasets with multiple LLMs, which is a strength. The manuscript also ships a code link and includes an unusually detailed appendix with feature descriptions and proofs. However, the advertised formal result is the paper's principal differentiator, and that result is not established: the proof of Theorem 1 contains a direct logical inconsistency, the key separability premise is assumed rather than derived and is contradicted by the paper's own visualization of ATA, and the asymptotic claim does not follow from the stated lemmas. The empirical results are suggestive but do not compensate for the broken formal analysis because the theory is presented as the basis for the security claim.

major comments (5)
  1. [Appendix F (Proof of Theorem 1); Section IV.C] The proof of Theorem 1 is internally inconsistent. After partitioning into the separable event E and its complement, the proof derives on E that both false-acceptance and false-rejection probabilities vanish, giving R_t|E = 0 in Eq. (41). It then states: 'Substituting the calibration bound R_t|E <= e^{-gamma} in place of the trivial 1 strengthens (42) to the form stated in (15).' But the bound just derived on E is 0, not e^{-gamma}; the proof cannot substitute a weaker bound for a stronger one and call it a strengthening. Moreover, Lemma D bounds the expected calibration error ECE_t in Eq. (27), not the classification risk R_t defined in Eq. (18). Thresholded classification error is not bounded by ECE without an additional factor depending on the threshold theta_c, which the proof never supplies. Therefore Eq. (15) does not follow from the lemmas, even granting the separability premise.
  2. [Appendix B, Eq. (19); Appendix C, Lemma 1; Section IV.D/Appendix G] The load-bearing premise of the theorem, cluster separability with margin Delta in Eq. (19), is assumed rather than proved. The justification given is a t-SNE visualization of PoisonedRAG, and Section IV.C explicitly says this empirical observation 'underpins our theoretical framework.' The proof of Lemma 1 in Appendix C does not close this gap: it asserts that at convergence the topology-aware loss enforces the radius and inter-cluster gap bounds in Eqs. (22)-(24) 'with high probability,' and then invokes concentration and Rademacher generalization bounds without deriving the claimed convergence or the claimed failure probability. More importantly, the paper's own Appendix G and Section IV.D state that ATA-generated malicious documents are 'substantially more dispersed and intermingled with benign samples' than PoisonedRAG documents. Thus the very attack the paper highlights is designed to violate Eq. (19), so the theorem's premise fails for the attack that motivates the framework.
  3. [Appendix F, last paragraph; Lemma E (Appendix E)] The asymptotic claim limsup_{t->infty} R_t <= e^{-gamma} in Eq. (16) is unsupported. Lemma E only shows that the exponentially smoothed reliability scores converge to the limiting average credibility C*_j, assuming that limit exists; it does not show that the failure probability epsilon of the separable event vanishes over time, nor that the fraction of malicious documents in D^{(t)} contracts. The final paragraph of the proof asserts that 'the prevalence of malicious documents in D^{(t)} contracts over time' and that 'the contribution of the failure event E-bar asymptotically vanishes,' but neither statement is derived from Lemma E or any other stated result. Consequently Eq. (16) is an additional assumption, not a conclusion.
  4. [Section III.C, Eq. (4); Section IV.B, Eq. (18)] There is a mismatch between the security goal and the quantity bounded by Theorem 1. The security goal in Eq. (4) is P(D_mal accepted | m < n/2) <= delta, a per-document false-acceptance probability. Theorem 1 bounds R_t, defined in Eq. (18) as the sum of false-acceptance and false-rejection probabilities. Bounding this sum does not by itself bound the false-acceptance probability unless a separate constraint on false rejection is provided; a mechanism that rejects all documents would achieve R_t = 0 only if false rejection is weighted differently. Moreover, Section IV.C states that Theorem 1 'directly satisfies' the security goal and that 'Rt <= e^{-gamma},' but the theorem's R_t is not the quantity in Eq. (4). The connection between the theorem and the paper's stated security objective is therefore not established.
  5. [Section V.A and Table I] The empirical evaluation does not fully support the advertised guarantee. The SCR defender is trained on poisoned documents generated by the same attack types (including ATA) and the same datasets on which it is evaluated, so the experiments demonstrate in-distribution attack mitigation rather than general robustness against unseen attacks. In addition, Table I reports attack success rates (ASR) as the primary metric, but ASR measures end-to-end jailbreak success and is not connected to the document acceptance probability R_t in the theorem; for example, under ATA the NQ/DeepSeek-V3 row reports ASR 27.12%, which is not 'exponentially small' in any evident sense. The paper should either report the document-level acceptance probability and relate it to the theorem, or present the ASR results as an empirical claim separate from the formal guarantee.
minor comments (6)
  1. [Section IV.A vs. Section IV.B] The initial value of the source reliability is stated as 0.5 in Section IV.A ('initialized at 0.5') but as 1 in Section IV.B ('initialized uniformly as rho^{(0)}(s_j) = 1'). Please reconcile these definitions.
  2. [Throughout] The symbol beta is used both for the reliability smoothing parameter in Eq. (13) and for the global/local semantic cohesion weight in Appendix A; the symbol alpha is used both for the similarity fusion coefficient in Eq. (8) and for the gate regularization coefficient in the training description. These collisions make the notation hard to follow.
  3. [Section I, Contributions] The second contribution states 'We provide a analysis of the security problem'; this should be 'an analysis.'
  4. [Section III.A] The sentence 'S = S_b cup S_m where S_b and S_m denotes benign malicious documents' is grammatically garbled; it should read 'benign and malicious documents, respectively.'
  5. [Table I] The table reports results from 50 independent trials but provides no standard deviations, confidence intervals, or significance tests. Given the variance visible across datasets and models, the claim of consistent improvement would be easier to assess with error bars.
  6. [Abstract and Introduction] The phrase 'novel defense framework ... to our knowledge, this is the first framework to integrate multi-source knowledge validation and dynamic graph learning' is a strong novelty claim; consider softening or providing a more precise comparison with the cited defenses.

Circularity Check

3 steps flagged · score 7.0 of 10

Theorem 1's exponential-risk guarantee rests on cluster separability that Lemma 1 assumes rather than proves; Appendix F substitutes an ECE bound for risk, so the advertised bound does not follow.

  1. self definitional [Appendix C, Lemma 1 (Cluster Separability), proof; Eqs. (22)–(24)]
    "At convergence, these terms enforce the following empirical property with high probability (1−δ, δ < ε): max_{d1,d2∈D_b} ∥h_{d1} −h_{d2}∥_2 ≤ σ_b, ... min_{d_b∈D_b, d_m∈D_m} ∥h_{d_b} −h_{d_m}∥_2 ≥ σ_b +σ_m +γ, (24)"

    Lemma 1's conclusion is the existence of a margin-γ separator holding with probability at least 1−ε. The proof begins by asserting the very radius/gap bounds (22)–(24), including the inter-cluster gap ≥ σ_b+σ_m+γ, as an 'empirical property' that the loss enforces; no derivation from the stated assumptions or from convergence of the DGNN is given. From (24) the lemma follows immediately, so the proof assumes the lemma. The same separation is already assumed in Eq. (19) on the basis of a t-SNE plot, so Theorem 1's exponential bound is not derived from first principles but from the lemma's own conclusion.

  2. other [Appendix B, Eq. (19); Section IV-C; Appendix G]
    "Our visual analysis of document embeddings under attack scenarios reveals a distinct clustering pattern that separates malicious documents from benign ones. This empirical observation underpins our theoretical framework... According to the t-SNE visualization, we assume cluster separation with margin ∆>0 in the GNN’s latent space Z... In contrast, ATA-generated malicious documents are substantially more dispersed and intermingled with benign samples."

    The formal theorem is premised on a cluster-separation property observed only on PoisonedRAG embeddings. The paper's own t-SNE for its newly introduced Adaptive Tampering Attack shows that ATA malicious documents are 'substantially more dispersed and intermingled with benign samples', i.e., the Eq. (19) premise fails for the attack the paper highlights. The advertised prediction R_t ≤ e^{−γ} is therefore an unverified empirical input for ATA, not a derived consequence of the framework's mechanism.

1 more flagged steps
  1. other [Appendix F, Proof of Theorem 1, after Eq. (42)]
    "Combining the two cases yields R_t = Pr( ¯E)R_t | ¯E + Pr(E)R_t | E ≤ Pr( ¯E)·1 + Pr(E)·0 = ε. (42) Substituting the calibration bound R_t | \bar{E} ≤ e^{−γ} in place of the trivial 1 strengthens (42) to the form stated in (15)."

    The proof has just derived R_t|E = 0 and R_t ≤ ε. It then claims a 'calibration bound' R_t|E^c ≤ e^{−γ} and substitutes it to obtain the exponential form. Lemma D, however, bounds the expected calibration error ECE_t, not the risk conditional on the complement event, and no argument relates thresholded classification risk to ECE. The e^{−γ} term is inserted by substitution rather than derived, so Eq. (15) and the asymptotic claim in Eq. (16) do not follow from the stated lemmas.

full rationale

Lemma 1 is the load-bearing premise of Theorem 1, but its proof does not prove cluster separability: it directly asserts the same radius/gap inequalities (22)–(24) that constitute the lemma's conclusion, claiming the loss 'enforces' them without derivation. The main text likewise concedes that the theoretical framework is underpinned by an empirical cluster-separation observation on PoisonedRAG embeddings (Eq. 19), while the paper's own ATA visualization shows malicious documents intermingled with benign ones, so the premise fails for the attack the framework is meant to stop. In addition, Appendix F's final step substitutes a calibration bound for risk on the complement event after having proved R_t|E=0 and R_t≤ε, with no argument that ECE bounds thresholded risk. Hence the exponential bound (15)–(16) is not a derived consequence of the lemmas; the advertised Byzantine-tolerant guarantee reduces to an assumed cluster-separation input. The empirical evaluation may still show engineering promise, but the formal result is substantially circular. The self-citations in references [12] and [13] only motivate the Byzantine fault-tolerance framing and are not load-bearing, so they do not further raise the score.

Assumptions & free parameters 5 free parameters · 6 assumptions · 0 invented entities

The framework's central guarantee is not derived from first principles. It relies on assumed cluster separability, an assumed calibration error bound, and a specific threat model. The GNN parameters, reliability scores, and multiple thresholds are either learned from attack data or chosen by hand. No new physical entities are postulated; the verification graph, source reliability, and commonsense penalty are computational constructs.

free parameters (5)
  • GNN weights and cluster prototypes = learned, not reported
    Trained on attack-generated data; architecture details not fully specified; the defense behavior depends on these learned parameters.
  • Source reliability initialization and smoothing beta = 0.5 (Sec IV.A) or 1 (Sec IV.B); beta unstated
    Reliability trajectory is central to aggregation; contradictory initialization and unspecified beta change reputation dynamics.
  • Credibility thresholds (tau_low, tau_high, tau_conf) = not reported
    Define the uncertain zone and retention cutoff; chosen by hand and no sensitivity analysis is given.
  • Similarity fusion alpha and edge threshold tau = not reported
    Control graph topology in Eqs. (7) and (8); no values or robustness analysis are provided.
  • Dirichlet alpha for non-IID partitioning = 0.5
    Only one heterogeneity level is tested, so the non-IID robustness claim rests on a single configuration.
assumptions (6)
  • ad hoc to paper Cluster separability with margin Delta in Eq. (19)
    Assumed from a t-SNE visualization; Lemma 1 claims to prove separability but uses this as a premise.
  • ad hoc to paper GNN approximates Bayes-optimal classifier within error eta < 1/2 (Eq. 20)
    No justification is given; needed for the calibration bound in Lemma 2.
  • domain assumption Adversaries are a minority (<50%), independent, and black-box
    Threat model in Sec III.B; required for the majority-voting guarantee.
  • ad hoc to paper GNN reaches training equilibrium under the composite loss
    Used in Lemma 1 proof; no convergence analysis is supplied.
  • standard math Standard concentration and Rademacher generalization bounds
    Invoked in Lemma 1 proof without stating the function class, sample size, or Lipschitz constants.
  • domain assumption Existence of limits for average credibility C_j^*
    Lemma 3 assumes the limit exists; central to the reliability convergence conclusion.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Combating Knowledge Corruption in Agent Systems: A Byzantine-Tolerant Secure Collaborative RAG Framework." pith.science (2026). https://pith.science/paper/SO4DRWWW

@misc{pith2026260804366,
  author       = {Pith},
  title        = {Pith review of: Combating Knowledge Corruption in Agent Systems: A Byzantine-Tolerant Secure Collaborative RAG Framework},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SO4DRWWW}},
  note         = {Machine review of arXiv:2608.04366}
}
read the original abstract

While retrieval-augmented generation systems partially address the hallucination issues in large language models, it also introduces new vulnerabilities to knowledge corruption attacks. Adversaries exploit these vulnerabilities by poisoning documents provided by RAG system to manipulate LLM outputs. To counter this threat, we propose SecureCollaRAG, a Byzantine-tolerant collaborative RAG framework leveraging Multi-source Knowledge Validation Mechanism. Our approach enables agent system to securely verify document provenance through dynamic GNN-based credibility scoring, effectively preventing stealthy knowledge corruption attacks while preserving essential domain knowledge integrity. Through extensive evaluations and formal analysis, we demonstrate that SecureCollaRAG maintains robustness against attackers under non-IID data distributions.

Figures

Figures reproduced from arXiv: 2608.04366 by the authors.

Figure 1
Figure 1. An overview of SecureCollaRAG framework. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Architecture of our dynamic graph neural network. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Overview of Adaptive Tampering Attack the LLM to automatically generate domain-specific tampering strategies based on the input content’s contextual character￾istics, then randomly select tactics during content generation. This automated strategy generation eliminates the need for manual design of domain-specific attack patterns, significantly enhancing scalability across diverse knowledge domains. This strategic va… view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Visual analysis of PoisonedRAG [PITH_FULL_IMAGE:figures/full_fig_p012_4.png]
Figure 5
Figure 5. Figure 5: Visual analysis of the Adaptive Tampering Attack. [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

34 extracted references · 12 canonical work pages

  1. [1]

    Gpt-4 technical report,

    J. Achiam, S. Adler, S. Agarwal, L. Ahmad, I. Akkaya, F. L. Aleman, D. Almeida, J. Altenschmidt, S. Altman, S. Anadkatet al., “Gpt-4 technical report,”arXiv preprint arXiv:2303.08774, 2023

    arXiv 2023

  2. [2]

    The llama 3 herd of models,

    A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Yang, A. Fanet al., “The llama 3 herd of models,”arXiv e-prints, pp. arXiv–2407, 2024

    2024

  3. [3]

    Deepseek-v3 technical report,

    A. Liu, B. Feng, B. Xue, B. Wang, B. Wu, C. Lu, C. Zhao, C. Deng, C. Zhang, C. Ruanet al., “Deepseek-v3 technical report,”arXiv preprint arXiv:2412.19437, 2024

    arXiv 2024

  4. [4]

    A survey of large language models,

    W. X. Zhao, K. Zhou, J. Li, T. Tang, X. Wang, Y . Hou, Y . Min, B. Zhang, J. Zhang, Z. Donget al., “A survey of large language models,”arXiv preprint arXiv:2303.18223, vol. 1, no. 2, 2023

    arXiv 2023

  5. [5]

    Retrieval- augmented generation for knowledge-intensive nlp tasks,

    P. Lewis, E. Perez, A. Piktus, F. Petroni, V . Karpukhin, N. Goyal, H. K ¨uttler, M. Lewis, W.-t. Yih, T. Rockt ¨aschelet al., “Retrieval- augmented generation for knowledge-intensive nlp tasks,”Advances in neural information processing systems, vol. 33, pp. 9459–9474, 2020

    2020

  6. [6]

    Geo: Generative engine optimization,

    P. Aggarwal, V . Murahari, T. Rajpurohit, A. Kalyan, K. Narasimhan, and A. Deshpande, “Geo: Generative engine optimization,” inProceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2024, pp. 5–16

    work page 2024

  7. [7]

    Poisoning re- trieval corpora by injecting adversarial passages,

    Z. Zhong, Z. Huang, A. Wettig, and D. Chen, “Poisoning re- trieval corpora by injecting adversarial passages,”arXiv preprint arXiv:2310.19156, 2023

    arXiv 2023

  8. [8]

    Poisonedrag: Knowledge corruption attacks to retrieval-augmented generation of large language models,

    W. Zou, R. Geng, B. Wang, and J. Jia, “Poisonedrag: Knowledge corruption attacks to retrieval-augmented generation of large language models,”arXiv preprint arXiv:2402.07867, 2024

    arXiv 2024

Show all 34 references
  1. [9]

    Certifiably robust rag against retrieval corruption,

    C. Xiang, T. Wu, Z. Zhong, D. Wagner, D. Chen, and P. Mittal, “Certifiably robust rag against retrieval corruption,”arXiv preprint arXiv:2405.15556, 2024

    2024

  2. [10]

    Defending against knowledge poisoning attacks during retrieval- augmented generation,

    K. Edemacu, V . M. Shashidhar, M. Tuape, D. Abudu, B. Jang, and J. W. Kim, “Defending against knowledge poisoning attacks during retrieval- augmented generation,”arXiv preprint arXiv:2508.02835, 2025

    2025

  3. [11]

    Web-ftp: A feature transferring-based pre-trained model for web attack detection,

    Z. Guo, Q. Shang, X. Li, C. Li, Z. Zhang, Z. Zhang, J. Hu, J. An, C. Huang, Y . Chenet al., “Web-ftp: A feature transferring-based pre-trained model for web attack detection,”IEEE Transactions on Knowledge and Data Engineering, vol. 37, no. 3, pp. 1495–1507, 2025

    2025

  4. [12]

    Group bft: Two-round bft protocols via replica grouping,

    X. Liu, Z. Zhang, Z. Li, X. Lu, M. Li, L. Xu, M. Ao, and L. Zhu, “Group bft: Two-round bft protocols via replica grouping,”IEEE Transactions on Dependable and Secure Computing, 2025

    2025

  5. [13]

    Abse: Adaptive baseline score-based election for leader-based bft systems,

    X. Liu, Z. Zhang, Z. Li, H. Yin, M. Li, J. Liu, M. Conti, and L. Zhu, “Abse: Adaptive baseline score-based election for leader-based bft systems,”IEEE Transactions on Parallel and Distributed Systems, 2025

    2025

  6. [14]

    P. M. Julia Wiesinger and V . Vuskovic, “Agents,” 2023. [Online]. Available: https://www.kaggle.com/whitepaper-agents

    2023

  7. [15]

    Model context protocol,

    Anthropic, “Model context protocol,” 2024. [Online]. Available: https://modelcontextprotocol.io/introduction

    2024

  8. [16]

    MCP Security Notification,

    Invariant Labs, “MCP Security Notification,”

  9. [17]

    Medical large language models are vulnerable to data-poisoning attacks,

    D. A. Alber, Z. Yang, A. Alyakin, E. Yang, S. Rai, A. A. Valliani, J. Zhang, G. R. Rosenbaum, A. K. Amend-Thomas, D. B. Kurland et al., “Medical large language models are vulnerable to data-poisoning attacks,”Nature Medicine, pp. 1–9, 2025

    2025

  10. [18]

    Differentially private generative adversarial network,

    L. Xie, K. Lin, S. Wang, F. Wang, and J. Zhou, “Differentially private generative adversarial network,”arXiv preprint arXiv:1802.06739, 2018

    2018 arXiv

  11. [19]

    Deprompt: Desensitization and evaluation of personal identifiable information in large language model prompts,

    X. Sun, G. Liu, Z. He, H. Li, and X. Li, “Deprompt: Desensitization and evaluation of personal identifiable information in large language model prompts,”arXiv preprint arXiv:2408.08930, 2024

    2024 arXiv

  12. [20]

    Privacy-preserving machine learning: Methods, challenges and directions,

    R. Xu, N. Baracaldo, and J. Joshi, “Privacy-preserving machine learning: Methods, challenges and directions,”arXiv preprint arXiv:2108.04417, 2021

    2021 arXiv

  13. [21]

    Zero-knowledge proof-based verifiable decen- tralized machine learning in communication network: A comprehensive survey,

    Z. Xing, Z. Zhang, Z. Zhang, Z. Li, M. Li, J. Liu, Z. Zhang, Y . Zhao, Q. Sun, L. Zhuet al., “Zero-knowledge proof-based verifiable decen- tralized machine learning in communication network: A comprehensive survey,”IEEE Communications Surveys & Tutorials, 2025

    2025

  14. [22]

    Natural questions: a benchmark for question answering research,

    T. Kwiatkowski, J. Palomaki, O. Redfield, M. Collins, A. Parikh, C. Alberti, D. Epstein, I. Polosukhin, J. Devlin, K. Leeet al., “Natural questions: a benchmark for question answering research,”Transactions of the Association for Computational Linguistics, vol. 7, pp. 453–466, 2019

    2019

  15. [23]

    Hotpotqa: A dataset for diverse, explainable multi-hop question answering,

    Z. Yang, P. Qi, S. Zhang, Y . Bengio, W. W. Cohen, R. Salakhutdinov, and C. D. Manning, “Hotpotqa: A dataset for diverse, explainable multi-hop question answering,”arXiv preprint arXiv:1809.09600, 2018

    2018 arXiv

  16. [24]

    Medinote: Automated clinical notes,

    A. Bonnet, P. Boulenger, H. Wu, M. Conti, J. Prado, O. El Malki, N. De Sabbata, H. d. S. Gameiro, Y . Xu, F. Boukil, A. Faure, A. A. Sariialou, Y . Niu, Z. Chen, A. Bosselut, and M. Jaggi, “Medinote: Automated clinical notes,” 2024. [Online]. Available: https://huggingface.co/...

    2024

  17. [25]

    Finance alpaca dataset,

    K. Saw, “Finance alpaca dataset,” https://huggingface.co/datasets/ ksaw008/finance alpaca, 2023, accessed: 2025-08-07

    2023

  18. [26]

    Judging llm-as-a-judge with mt-bench and chatbot arena,

    L. Zheng, W.-L. Chiang, Y . Sheng, S. Zhuang, Z. Wu, Y . Zhuang, Z. Lin, Z. Li, D. Li, E. Xinget al., “Judging llm-as-a-judge with mt-bench and chatbot arena,”Advances in neural information processing systems, vol. 36, pp. 46 595–46 623, 2023

    2023

  19. [27]

    Qwen2 technical report,

    A. Yang, B. Yang, B. Hui, B. Zheng, B. Yu, C. Zhou, C. Li, C. Li, D. Liu, F. Huang, G. Dong, H. Wei, H. Lin, J. Tang, J. Wang, J. Yang, J. Tu, J. Zhang, J. Ma, J. Xu, J. Zhou, J. Bai, J. He, J. Lin, K. Dang, K. Lu, K. Chen, K. Yang, M. Li, M. Xue, N. Ni, P. Zhang, P. Wang, R. ...

    2024 arXiv

  20. [28]

    Unsupervised dense information retrieval with contrastive learning,

    G. Izacard, M. Caron, L. Hosseini, S. Riedel, P. Bojanowski, A. Joulin, and E. Grave, “Unsupervised dense information retrieval with contrastive learning,” 2021. [Online]. Available: https://arxiv.org/abs/2112.09118

    2021 arXiv

  21. [29]

    Clinical modernbert: An ef- ficient and long context encoder for biomedical text,

    S. A. Lee, A. Wu, and J. N. Chiang, “Clinical modernbert: An ef- ficient and long context encoder for biomedical text,”arXiv preprint arXiv:2504.03964, 2025

    2025 arXiv

  22. [30]

    Finbert: Financial sentiment analysis with pre-trained lan- guage models,

    D. Araci, “Finbert: Financial sentiment analysis with pre-trained lan- guage models,”arXiv preprint arXiv:1908.10063, 2019

    1908 arXiv

  23. [31]

    Llm factoscope: Uncovering llms’ factual discernment through measuring inner states,

    J. He, Y . Gong, Z. Lin, C. Wei, Y . Zhao, and K. Chen, “Llm factoscope: Uncovering llms’ factual discernment through measuring inner states,” inFindings of the Association for Computational Linguistics ACL 2024, 2024, pp. 10 218–10 230

    2024

  24. [32]

    The graph neural network model,

    F. Scarselli, M. Gori, A. C. Tsoi, M. Hagenbuchner, and G. Monfar- dini, “The graph neural network model,”IEEE transactions on neural networks, vol. 20, no. 1, pp. 61–80, 2008

    2008

  25. [33]

    Graph attention networks,

    P. Veli ˇckovi´c, G. Cucurull, A. Casanova, A. Romero, P. Lio, and Y . Ben- gio, “Graph attention networks,”arXiv preprint arXiv:1710.10903, 2017. APPENDIX A. Detailed Feature Descriptions SecureCollaRAG’s node features incorporate comparative metrics enhanced by a logarithmic...

    2017 arXiv

  26. [2025]

    Available: https://invariantlabs.ai/blog/ mcp-security-notification-tool-poisoning-attacks

    [Online]. Available: https://invariantlabs.ai/blog/ mcp-security-notification-tool-poisoning-attacks

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.