Pith. sign in

REVIEW 4 major objections 3 minor 43 references

Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injection

T0 review · 4 major / 3 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read RAG-IDS's retrieval-boundary defense restores clean detection quality under knowledge poisoning, from $R=1.002$ at 1% poison to $R=0.573$ at 30%, while multi-document context limits prompt-injection label flips to 0.6–2.4%.

desk verdict LECC is a real idea and the IDS evaluation is new, but the defense's headline recovery claim collapses under the same-rate comparison the paper itself tabulates. read the letter →

arxiv 2608.08100 v1 pith:VR5AL5EX submitted 2026-08-08 cs.CR cs.AIcs.LG

Kaysarul Anas Apurba , Md. Hasibul Hasan , Mahedee Zaman Moon , Sk. Md. Mizanur Rahman , Atsuo Inomata This is my paper · ORCID
classification cs.CRcs.AIcs.LG
keywords adversarialdefenseintrusiondetectionsystemknowledgepoisoninglargelanguagemodelspromptinjectionretrieval-augmentedgenerationlabel-embeddingconsistencycheckretrieval
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Retrieval-augmented generation lets an LLM classify network flows by retrieving similar labeled history, but the vector knowledge base is a writable surface: an attacker can inject attack flows relabeled as benign, or hide instruction overrides inside retrieved documents. The paper claims that a defense placed at the retrieval boundary—soft trust scoring, label-embedding consistency checking (LECC), and prompt sanitization—can recover most of the clean classification quality under such attacks. On a 10-class network-traffic benchmark, the recovery ratio relative to clean undefended macro-F1 stays near 1.0 at 1% knowledge-base poisoning and falls to 0.573 at 30%, with negligible clean overhead; multi-document context keeps prompt-injection label flips between 0.6% and 2.4% instead of the 35–55% seen with single-document retrieval. If true, a RAG-based detector can serve as an explainable, attack-resilient layer in a hybrid IDS rather than a drop-in replacement for classical classifiers.

What carries the argument

The load-bearing object is the label-embedding consistency check (LECC). For a retrieved document with embedding $\mathbf{e}_{d_i}$ and stated label $\ell$, LECC computes distances $\delta_c=\|\mathbf{e}_{d_i}-\boldsymbol{\mu}_c\|$ to all class centroids and the distance to the stated label's centroid $\delta_\ell$; if the nearest centroid is not the stated label, it applies penalty $s_2=(\delta_\ell-\delta_{\min})/(\delta_\ell+\varepsilon)$, otherwise it falls back to a per-class 95th-percentile outlier threshold calibrated on clean data. This penalty enters a composite score $\hat{s}(d_i)=s_{\mathrm{ret}}(d_i)-\lambda(s_1+s_2+s_3)$ with $\lambda=0.3$, where $s_1$ is the soft trust-score deficit below cosine threshold $\theta=0.40$ and $s_3$ is a prompt-injection score from regex and exemplar similarity; documents are reranked by $\hat{s}$ and demoted rather than removed. LECC is the component that makes the defense work against the relabeling attack, because that attack preserves original embeddings.

What would settle it

Run the defense against a 30% poison batch whose injected documents are embedded near the benign-class centroid while labeled benign, and compare defended macro-F1 with the reported $R=0.573$; if recovery collapses toward the undefended values, the LECC centroid check is the failure point, not the cure.

Watch

Extended reading notes

Core claim

The paper's central discovery is that one consistency check carries the defense: when an attack flow is relabeled as benign, its embedding stays close to its true attack-class centroid and far from the stated benign centroid, so comparing each retrieved document's embedding against all class centroids exposes the relabeling. The full defense combines this label-embedding consistency check with a soft trust-score penalty for documents below a similarity threshold and a prompt-sanitizer score, reranking by the composite score instead of deleting documents. Under retrieval poisoning with the relabeling attack, defended macro-F1 matches clean undefended performance at 1% poison ($R=1.002\pm0.006$) and retains $R=0.573\pm0.057$ at 30%, with clean overhead within noise; the ablation shows LECC alone reproduces the defended path. Under prompt injection, five-document context limits label-flip success to 0.6–2.4%, while single-document retrieval fails at 35–55% and demotion becomes a null operation. The paper frames these as defense-study claims: absolute clean macro-F1 remains low (about 0.27 on the adversarial query set), so the contribution is recovery and explainability, not replacing high-throughput ML classifiers.

Load-bearing premise

The defense's centroid positions and per-class outlier thresholds are calibrated on a clean knowledge base before any poison is injected, so an adversary who corrupts the calibration set or writes poison embeddings near the benign-class centroid can bypass every check; the paper explicitly leaves such adaptive embedding attacks out of scope.

Editorial extensions

If this is right

  • Because LECC alone reproduces the full defense under poisoning, future RAG-IDS designs should treat embedding-label consistency as the primary control point rather than adding more filters.
  • Because hard cosine filtering underperforms soft demotion at every poison rate, defenders should demote suspicious documents instead of deleting them, preserving diverse context.
  • Because multi-document context keeps prompt-injection label-flip rates at 0.6–2.4% while single-document retrieval reaches 35–55%, retrieval depth should be treated as a security parameter.
  • Because the defense adds about 5 ms per query versus roughly 1.9 s of LLM generation, securing the retrieval boundary costs almost nothing in latency.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • We infer that an adversary who can poison the calibration set or shift poison embeddings toward the benign-class centroid will bypass LECC, since every defense term reduces to distance checks against centroids the adversary can estimate.
  • We infer that the reported recovery ratio would shrink if clean retrieval improved: the recovery ratio divides defended macro-F1 by clean undefended macro-F1, so a stronger clean baseline makes the same absolute defended quality look worse.
  • We infer that the defense likely transfers to other traffic benchmarks by re-fitting centroids and thresholds, but transfer is untested because the paper only measures one dataset.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 3 minor

Summary. The paper proposes RAG-IDS, a three-tier retrieval-augmented intrusion detection framework with a defense module (soft trust filter D1, label-embedding consistency check LECC/D2, and prompt sanitizer D3) intended to preserve classification quality under knowledge poisoning and prompt injection. Using CIC-UNSW-NB15, the authors report recovery ratios R = F1_defended / F1_clean_undefended ranging from R=1.002 at 1% poisoning to R=0.573 at 30%, negligible clean overhead, and low label-flip success in the multi-document prompt-injection setting. Ablations identify LECC as the component that shapes the defended pipeline.

Significance. The paper is commendably transparent: it reports absolute F1 values alongside recovery ratios, includes per-seed results, an ablation study, latency measurements, and an explicit discussion of limitations, calibration assumptions, and out-of-scope adaptive attacks. The experimental setup is described in unusual detail for a preprint, and the authors are honest that clean RAG-IDS accuracy is far below tree-based baselines. However, the significance of the work depends entirely on the claim that the defense recovers classification quality under retrieval poisoning, and that claim is not supported by the reported data. A defense that performs worse than the undefended pipeline at the same poison rate does not demonstrate retrieval-boundary defense. Because the central contribution fails on its own terms, the paper cannot be accepted in its current form.

major comments (4)
  1. [§VI-D, Table V] The recovery metric R is defined against clean undefended F1, but the appropriate baseline for a defense under attack is the undefended pipeline at the same poison rate. Table V shows that at 10%, 20%, and 30% poisoning, defended macro-F1 is lower than undefended macro-F1 (0.2157 vs 0.2248; 0.1863 vs 0.2005; 0.1540 vs 0.1671), and defended FPR is higher at each of these rates. The paper acknowledges this in the text ('Absolute defended F1 can fall slightly below undefended F1 at the same rate') but the consequence is not minor: at 10% and 30% the differences are substantial relative to the standard deviations, and the direction is consistently negative. Thus the defense does not reduce the impact of poisoning compared to doing nothing; it increases it. The headline claim of 'recovery' is therefore not demonstrated.
  2. [§VI-E, Table VIII] The ablation directly contradicts the claim that LECC is the primary contributor to robustness. At p=0.10, D2-only yields F1=0.210 versus undefended F1=0.222; at p=0.30, D2-only yields F1=0.153 versus undefended F1=0.170. The R values for D2-only (0.794 and 0.579) are also below the undefended R values (0.838 and 0.643). The authors state that the ablation 'explains who shapes the defended pipeline, not that demotion always raises absolute F1 under attack,' but this evades the real issue: the component credited with robustness is the component that degrades performance. On the evidence in Table VIII, LECC is the primary contributor to the defense's deficit, not to its robustness.
  3. [§IV-A.2 and §VII] The LECC design is explicitly tailored to PoisonedRAG-style relabeling, and the evaluation includes only that exact attack family. The paper acknowledges in Section VII that adaptive embedding attacks are out of scope and that centroid calibration on a clean KB contradicts a fully writable threat model. A targeted defense against a specific attack is a legitimate research goal, but the conclusion that RAG-IDS is 'attack-resilient' goes beyond the evidence. More importantly, the circularity is secondary: even against the attack the defense is designed for, the defense fails to beat the undefended baseline at the same poison rate. The evaluation therefore does not establish that LECC provides any protective value.
  4. [§VI-D, CEXP08, and §VII] The low-volume poisoning probe (CEXP08) shows that injecting one or two PoisonedRAG-style documents leaves both undefended and defended F1 unchanged, so the defense provides no measurable benefit in the operationally realistic low-count regime. The defense only engages at percent-scale write shares, and in exactly that regime it lowers F1 relative to undefended retrieval. There is consequently no demonstrated poisoning scenario in which the defense improves classification quality. The paper's own data support the opposite conclusion: the defended pipeline is either neutral or worse than the undefended pipeline under the tested attacks.
minor comments (3)
  1. [Abstract and §VI-D] The term 'recovery' is misleading when R is defined as F1_defended / F1_clean_undefended and every reported R below 1 indicates a loss relative to clean. At 1% poisoning R=1.002 is parity, not recovery; the abstract's phrase 'recovery relative to clean undefended performance' would be more accurately rendered as 'retained fraction of clean undefended F1' or 'robustness ratio.'
  2. [Table II and Table III] The tables are transparent about the difference between pooled and macro-averaged FPR, but the reader cannot numerically compare FPR across rows. Since the FPR gap is used to motivate hybrid deployment, reporting at least one row with a single pooling convention would strengthen the presentation.
  3. [§VI-C and §VI-D] Two clean macro-F1 values are reported for RAG-IDS: 0.1237 under the CEXP02 200-sample protocol and 0.2697 under the CEXP04 N=499 protocol. The text explains that they are not directly comparable, but the existence of two clean baselines will confuse readers; a single naming convention (e.g., 'CEXP02 clean characterization' vs. 'CEXP04 clean baseline') would help.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the recovery claims are empirical measurements under a stated threat model, and the matched design of LECC to PoisonedRAG relabeling is disclosed rather than disguised as an independent derivation.

full rationale

The paper's central claims are empirical measurements under an explicit threat model, not derivations that reduce to their own assumptions. Recovery R is defined as F1_def/F1_clean,undef and is computed from measured F1 values, not fitted or constructed from the baseline. LECC is admittedly built to target PoisonedRAG-style relabeling: the paper states that 'relabelled attack documents retain their original embeddings and therefore lie closer to the attack centroid than to the stated Benign centroid,' and the evaluation injects exactly that attack family. This is a matched defense/attack design and a disclosed limitation (adaptive embedding attacks are listed as out of scope), not a hidden reduction of the result to the input. The centroids and per-class thresholds are calibrated on clean data before poisoning, which is a standard and openly stated optimistic assumption; no parameter is fitted to the reported recovery quantity. The references to PoisonedRAG and other prior work are external, and there is no load-bearing self-citation or imported uniqueness theorem. The same-rate comparison weakness identified by the skeptic (defended F1 below undefended F1 at 10-30% poisoning) is a substantive evaluation-framing concern rather than circularity, and the paper explicitly discloses these absolute numbers in Table V and Section VI-D. Because the central recovery claim is empirically measured and the threat-model match is transparent, the analysis finds no circular step under the stated hard rules.

Assumptions & free parameters 5 free parameters · 3 assumptions · 0 invented entities

The central robustness claim rests on two optimistic domain assumptions: the PoisonedRAG relabeling signature (embeddings preserved) and a clean calibration set. The defense's hand-set parameters (theta, lambda, D3 weights) are not varied in sensitivity analysis, and the retrieval depth k and small 2000-document KB are fixed; the clean pipeline's macro-F1 is extremely sensitive to these choices (CEXP02 Hit@5 = 0.19). No new entities are introduced.

free parameters (5)
  • D1 trust threshold theta = 0.40
    Cosine similarity threshold below which D1 applies a penalty; chosen by hand, no sensitivity analysis reported.
  • Defense weight lambda = 0.3
    Weight on the composite suspicion penalty in the final retrieval score; affects how strongly demotion reorders context.
  • D3 weights wr, we = 0.5 each
    Weights for regex match and embedding-exemplar similarity in the D3 prompt sanitizer score.
  • Retrieval depth k = 5
    Number of documents assembled into LLM context; the single-document k=1 setting is the injection stress test.
  • Knowledge base size = 2000
    Sampled KB with 200 documents per class; clean retrieval quality is highly sensitive to this choice (CEXP02 Hit@5 = 0.19).
assumptions (3)
  • domain assumption PoisonedRAG relabeling preserves the original document embeddings
    LECC (Section IV-A.2) is premised on this signature; adaptive attacks that move embeddings near the Benign centroid are out of scope (Section VII).
  • domain assumption Defense calibration occurs on a clean knowledge base before poisoning
    Stated in Section VI-D and Limitations: centroids and percentile thresholds are computed on clean KB data, which contradicts a fully writable threat model if the adversary poisons the calibration set.
  • domain assumption Cosine similarity and BM25/BGE-M3 retrieval scores are reliable proxies for flow-text semantic similarity
    The entire retrieval and defense design assumes these similarity measures carry the semantic signal needed for classification, validated only on one closed-world dataset.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injection." pith.science (2026). https://pith.science/paper/VR5AL5EX

@misc{pith2026260808100,
  author       = {Pith},
  title        = {Pith review of: Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VR5AL5EX}},
  note         = {Machine review of arXiv:2608.08100}
}
read the original abstract

Retrieval-Augmented Generation (RAG) enables large language models to classify network flows and generate human-readable incident reports by retrieving semantically similar historical traffic from a vector knowledge base. However, the retrieval layer introduces vulnerabilities to knowledge poisoning and prompt-injection attacks. We present RAG-IDS, a three-tier multi-agent intrusion detection framework with a retrieval-boundary defense combining soft trust scoring, label-embedding consistency checking (LECC), and prompt sanitization, designed to recover classification quality under retrieval-layer attack. Experiments on CIC-UNSW-NB15 show recovery relative to clean undefended performance ranging from R=1.0 at 1% poisoning to R=0.57 at 30%, with negligible clean-performance overhead. Under prompt injection, multi-document retrieval limits label-flip success to 0.6-2.4%, compared with 35-55% for single-document retrieval. Ablation results show that LECC is the primary contributor to robustness, while soft trust-based demotion outperforms hard filtering. The defended RAG pipeline offers an explainable, attack-resilient foundation for intrusion detection, well suited for hybrid deployment alongside high-throughput classifiers.

Figures

Figures reproduced from arXiv: 2608.08100 by the authors.

Figure 1
Figure 1. The two attack surfaces addressed by RAG-IDS. (a) Retrieval poisoning [1]: the adversary injects attack-class documents relabelled as [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Operational flow of RAG-IDS. The system ingests network flow [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. RAG-IDS three-tier multi-agent architecture. The adversarial defense [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Macro F1 (left) and FPR (right) vs. retrieval poison rate under the [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Macro F1 (left) and FPR (right) vs. absolute poison count under [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 7
Figure 7. Figure 7: Macro F1 (left) and FPR (right) vs. retrieval poison rate. D1+D2+D3 [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 8
Figure 8. Figure 8: Injection success and D3 neutralization per payload (left); macro F1 [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]
Figure 10
Figure 10. Figure 10: Undefended vs. B0 (FilterRAG-style) vs. Full D1+D2+D3, macro F1 [PITH_FULL_IMAGE:figures/full_fig_p011_10.png]
Figure 11
Figure 11. Figure 11: Recovery R vs. poison rate for B0 vs. Full D1+D2+D3 (CEXP06 v2; seed 42). Full dominates B0 at every rate. TABLE XIV CORE EXPERIMENTAL CONFIGURATION (CEXP04 PROTOCOL). Component Configuration Retriever embedding BGE-M3 (BAAI/bge-m3) Hybrid retrieval FAISS dense + BM25…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

43 extracted references · 33 canonical work pages

  1. [1]

    PoisonedRAG: Knowledge Cor- ruption Attacks to Retrieval-Augmented Generation,

    W. Zou, R. Geng, B. Wang, and J. Jia, “PoisonedRAG: Knowledge Cor- ruption Attacks to Retrieval-Augmented Generation,” inProc. USENIX Security, 2025

    work page 2025

  2. [2]

    Temporal Dynamics of Memory Poisoning in Web3-Style LLM Agents,

    A. Yazdinejad and H. Karimipour, “Temporal Dynamics of Memory Poisoning in Web3-Style LLM Agents,”IEEE Access, vol. 14, 2026

    work page 2026

  3. [3]

    Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injec- tion,

    K. Greshakeet al., “Not What You’ve Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injec- tion,” inProc. ACM AISec, 2023

    work page 2023

  4. [4]

    SafeRAG: Benchmarking Security in Retrieval- Augmented Generation of Large Language Models,

    X. Lianget al., “SafeRAG: Benchmarking Security in Retrieval- Augmented Generation of Large Language Models,” inProc. ACL, 2025, pp. 4609–4631

    work page 2025

  5. [5]

    Outside the Closed World: On Using Machine Learning for Network Intrusion Detection,

    R. Sommer and V . Paxson, “Outside the Closed World: On Using Machine Learning for Network Intrusion Detection,” inProc. IEEE S&P, 2010, pp. 305–316

    work page 2010

  6. [6]

    The Base-Rate Fallacy and Its Implications for the Difficulty of Intrusion Detection,

    S. Axelsson, “The Base-Rate Fallacy and Its Implications for the Difficulty of Intrusion Detection,” inProc. ACM CCS, 2000

    work page 2000

  7. [7]

    UNSW-NB15: A Comprehensive Data Set for Network Intrusion Detection Systems,

    N. Moustafa and J. Slay, “UNSW-NB15: A Comprehensive Data Set for Network Intrusion Detection Systems,” inProc. MilCIS, 2015

    work page 2015

  8. [8]

    Poisoning and Evasion: Deep Learning-Based NIDS under Adversarial Attacks,

    H. Mohammadianet al., “Poisoning and Evasion: Deep Learning-Based NIDS under Adversarial Attacks,” inProc. PST, 2024

    work page 2024

Show all 43 references
  1. [9]

    Retrieval-Augmented Generation for Knowledge- Intensive NLP Tasks,

    P. Lewiset al., “Retrieval-Augmented Generation for Knowledge- Intensive NLP Tasks,” inProc. NeurIPS, 2020

    2020

  2. [10]

    RAGAS: Automated Evaluation of Retrieval Augmented Generation,

    S. Eset al., “RAGAS: Automated Evaluation of Retrieval Augmented Generation,” inProc. EACL, 2024

    2024

  3. [11]

    BGE M3-Embedding: Multi-Lingual, Multi- Functionality, Multi-Granularity Text Embeddings,

    J. Chenet al., “BGE M3-Embedding: Multi-Lingual, Multi- Functionality, Multi-Granularity Text Embeddings,”arXiv:2309.07597, 2024

    2024 arXiv

  4. [12]

    The Probabilistic Relevance Framework: BM25 and Beyond,

    S. Robertson and H. Zaragoza, “The Probabilistic Relevance Framework: BM25 and Beyond,”Found. Trends IR, vol. 3, no. 4, 2009

    2009

  5. [13]

    Reciprocal Rank Fusion Outperforms Condorcet and Individual Rank Learning Methods,

    G. V . Cormack, C. L. A. Clarke, and S. Buettcher, “Reciprocal Rank Fusion Outperforms Condorcet and Individual Rank Learning Methods,” inProc. ACM SIGIR, 2009

    2009

  6. [14]

    Random Forests,

    L. Breiman, “Random Forests,”Machine Learning, vol. 45, no. 1, pp. 5– 32, 2001

    2001

  7. [15]

    XGBoost: A Scalable Tree Boosting System,

    T. Chen and C. Guestrin, “XGBoost: A Scalable Tree Boosting System,” inProc. ACM KDD, 2016

    2016

  8. [16]

    A Survey of Network-Based Intrusion Detection Data Sets,

    M. Ringet al., “A Survey of Network-Based Intrusion Detection Data Sets,”Computers & Security, vol. 86, 2019

    2019

  9. [17]

    Cy- berRAG: An Agentic RAG Cyber Attack Classification and Reporting Tool,

    F. Blefari, C. Cosentino, F. A. Pironti, A. Furfaro, and F. Marozzo, “Cy- berRAG: An Agentic RAG Cyber Attack Classification and Reporting Tool,”Future Generation Computer Systems, 2025

    2025

  10. [18]

    MA-IDS: Multi-Agent RAG Framework for IoT Network Intrusion Detection with an Experience Library,

    M. S. Islam, L. G. Jaimes, and A. S. Dina, “MA-IDS: Multi-Agent RAG Framework for IoT Network Intrusion Detection with an Experience Library,”arXiv:2604.05458, 2026

    2026 arXiv

  11. [19]

    FALCON: Autonomous Cyber Threat Intelligence Mining with LLMs for IDS Rule Generation,

    S. Mitraet al., “FALCON: Autonomous Cyber Threat Intelligence Mining with LLMs for IDS Rule Generation,”arXiv:2508.18684, 2025

    2025 arXiv

  12. [20]

    FlowTransformer: A Transformer Framework for Flow-Based Network Intrusion Detection Systems,

    L. D. Manocchio, S. Layeghy, W. W. Lo, G. K. Kulatilleke, M. Sarhan, and M. Portmann, “FlowTransformer: A Transformer Framework for Flow-Based Network Intrusion Detection Systems,”Expert Systems with Applications, vol. 241, Art. 122564, 2024

    2024

  13. [21]

    Billion-Scale Similarity Search with GPUs,

    J. Johnson, M. Douze, and H. J ´egou, “Billion-Scale Similarity Search with GPUs,”IEEE Trans. Big Data, vol. 7, no. 3, 2021

    2021

  14. [22]

    SMOTE: Synthetic Minority Over-sampling Technique,

    N. V . Chawlaet al., “SMOTE: Synthetic Minority Over-sampling Technique,”JAIR, vol. 16, pp. 321–357, 2002

    2002

  15. [23]

    Benchmarking and Defending Against Indirect Prompt Injection Attacks on LLMs,

    J. Yiet al., “Benchmarking and Defending Against Indirect Prompt Injection Attacks on LLMs,”arXiv:2312.14197, 2023

    2023 arXiv

  16. [24]

    Basic Con- cepts and Taxonomy of Dependable and Secure Computing,

    A. Avizienis, J.-C. Laprie, B. Randell, and C. Landwehr, “Basic Con- cepts and Taxonomy of Dependable and Secure Computing,”IEEE Trans. Dependable Secure Comput., vol. 1, no. 1, pp. 11–33, 2004

    2004

  17. [25]

    Security Evaluation of Pattern Classifiers under Attack,

    B. Biggio, G. Fumera, and F. Roli, “Security Evaluation of Pattern Classifiers under Attack,”IEEE Trans. Knowl. Data Eng., vol. 26, no. 4, pp. 984–996, 2014

    2014

  18. [26]

    Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning,

    B. Biggio and F. Roli, “Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning,”Pattern Recognition, vol. 84, pp. 317– 331, 2018

    2018

  19. [27]

    Dense Passage Retrieval for Open-Domain Ques- tion Answering,

    V . Karpukhinet al., “Dense Passage Retrieval for Open-Domain Ques- tion Answering,” inProc. EMNLP, 2020, pp. 6769–6781

    2020

  20. [28]

    Retrieval-Augmented Generation for Large Language Models: A Survey,

    Y . Gaoet al., “Retrieval-Augmented Generation for Large Language Models: A Survey,”arXiv:2312.10997, 2024

    2024 arXiv

  21. [29]

    Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations,

    A. Vassilev, A. Oprea, A. Fordyce, and H. Anderson, “Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations,” NIST AI 100-2e2023, National Institute of Standards and Technology, Jan. 2024

    2024

  22. [30]

    Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection,

    Y . Mirsky, T. Doitshman, Y . Elovici, and A. Shabtai, “Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection,” inProc. NDSS, 2018

    2018

  23. [31]

    On the Effectiveness of Machine and Deep Learning for Cyber Secu- rity,

    G. Apruzzese, M. Colajanni, L. Ferretti, A. Guido, and M. Marchetti, “On the Effectiveness of Machine and Deep Learning for Cyber Secu- rity,” inProc. CyCon X, Tallinn, 2018, pp. 371–390

    2018

  24. [32]

    Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characteriza- tion,

    I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, “Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characteriza- tion,” inProc. ICISSP, 2018, pp. 108–116

    2018

  25. [33]

    The Evaluation of Network Anomaly Detec- tion Systems: Statistical Analysis of the UNSW-NB15 Data Set,

    N. Moustafa and J. Slay, “The Evaluation of Network Anomaly Detec- tion Systems: Statistical Analysis of the UNSW-NB15 Data Set,”Inf. Security J.: A Global Perspective, vol. 25, no. 1–3, pp. 18–31, 2016

    2016

  26. [34]

    Phantom: General Trigger Attacks on Retrieval Augmented Language Generation,

    H. Chaudhariet al., “Phantom: General Trigger Attacks on Retrieval Augmented Language Generation,”arXiv:2405.20485, 2024

    2024

  27. [35]

    Practical Poisoning Attacks against Retrieval- Augmented Generation,

    B. Zhanget al., “Practical Poisoning Attacks against Retrieval- Augmented Generation,”arXiv:2504.03957, 2025

    2025

  28. [36]

    Defending Against Knowledge Poisoning Attacks During Retrieval-Augmented Generation,

    K. Edemacuet al., “Defending Against Knowledge Poisoning Attacks During Retrieval-Augmented Generation,”arXiv:2508.02835, 2025. 13 Preprint. Work In Progress

    2025

  29. [37]

    A Detailed Analysis of the KDD CUP 99 Data Set,

    M. Tavallaee, E. Bagheri, W. Lu, and A. A. Ghorbani, “A Detailed Analysis of the KDD CUP 99 Data Set,” inProc. IEEE CISDA, 2009

    2009

  30. [38]

    Long Short-Term Memory,

    S. Hochreiter and J. Schmidhuber, “Long Short-Term Memory,”Neural Computation, vol. 9, no. 8, pp. 1735–1780, 1997

    1997

  31. [39]

    Intrusion Detection System: A Comprehensive Review,

    H.-J. Liao, C.-H. R. Lin, Y .-C. Lin, and K.-Y . Tung, “Intrusion Detection System: A Comprehensive Review,”J. Netw. Comput. Appl., vol. 36, pp. 16–24, 2013

    2013

  32. [40]

    A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection,

    A. L. Buczak and E. Guven, “A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection,”IEEE Com- mun. Surveys Tut., vol. 18, no. 2, pp. 1153–1176, 2016

    2016

  33. [41]

    A Survey on Hallucination in Large Language Models: Principles, Taxonomy, Challenges, and Open Questions,

    L. Huanget al., “A Survey on Hallucination in Large Language Models: Principles, Taxonomy, Challenges, and Open Questions,”ACM Trans. Inf. Syst., vol. 1, no. 1, Art. 1, 2024

    2024

  34. [42]

    Traceback of Poisoning Attacks to Retrieval- Augmented Generation,

    B. Zhanget al., “Traceback of Poisoning Attacks to Retrieval- Augmented Generation,” inProc. ACM Web Conf. (WWW), 2025

    2025

  35. [43]

    CPA-RAG: Covert Poisoning Attacks on Retrieval- Augmented Generation in Large Language Models,

    C. Liet al., “CPA-RAG: Covert Poisoning Attacks on Retrieval- Augmented Generation in Large Language Models,”arXiv:2505.19864, 2025. 14

    2025 arXiv

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.