The Hidden Threat in Plain Text: Attacking RAG Data Loaders

Alberto Castagnaro; Luca Pajola; Mauro Conti; Simeone Pizzi; Umberto Salviati

REVIEW 4 major objections 4 minor 32 references

The Hidden Threat in Plain Text: Attacking RAG Data Loaders

T0 review · 4 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Invisible document tricks poison RAG pipelines 74.4% of the time.

desk verdict A useful, well-scoped study of invisible-poisoning attacks on RAG data loaders, with a broad benchmark and toolkit, but the headline aggregate needs an audit and the OCR defense result is deferred. read the letter →

arxiv 2507.05093 v1 pith:BXNI3C5M submitted 2025-07-07 cs.CR cs.AI

Alberto Castagnaro , Umberto Salviati , Mauro Conti , Luca Pajola , Simeone Pizzi This is my paper

classification cs.CRcs.AI

keywords retrieval-augmentedgenerationRAGsecurityknowledgebasepoisoningdocumentingestionattackinvisiblecharacterattacksUnicodeLLMcontentinjection

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that the data-loading step of retrieval-augmented generation (RAG) pipelines is a practical attack surface: document parsers extract text differently from what a human sees rendered, so invisible Unicode characters and formatting tricks can hide existing facts or insert new ones without being noticed by a human inspector. The authors build a taxonomy of nine knowledge-poisoning attacks, implement nineteen stealthy techniques in an open toolkit called PhantomText, and test them against twenty-one parsers from five popular data loaders, reporting a 74.4% average attack success rate. They then show the attacks carry through six end-to-end RAG systems, including black-box services such as NotebookLM and OpenAI Assistants, where techniques like font poisoning and homoglyph substitution succeed in nearly every tested case. If true, any RAG application that ingests untrusted documents—supply-chain documentation, web sources, user uploads—can be steered toward false or harmful answers without the injected content ever appearing on screen.

What carries the argument

The load-bearing mechanism is the rendering/extraction asymmetry: document formats (PDF, HTML, DOCX) carry text in a logical structure plus visual styling, and the tested loaders' parsers read the logical layer while humans see the styled render. The paper's terminology for the attack surface is Content Obfuscation (distorting existing content through invisible or confusable characters) and Content Injection (adding hidden content through layout, font, or metadata tricks), implemented by the PhantomText toolkit's nineteen techniques. The extraction asymmetry carries the argument because every measured success is a case where the parser's text layer and the human-visible rendering disagree.

What would settle it

Take the same poisoned documents and route them through an ingestion pipeline that renders each page to an image and OCRs it before embedding (the paper's own proposed defense). If injected words such as transparent text, zero-size fonts, and out-of-bound text still enter the indexed text, the OCR defense claim is wrong; if they disappear, the 74.4% loader attack success rate applies only to non-OCR, text-parsing deployments.

Watch

Extended reading notes

Core claim

The central discovery is that the asymmetry between human rendering and machine extraction of styled documents is exploitable at scale. For Content Obfuscation, techniques such as zero-width characters, homoglyphs, bidirectional reordering, and diacritical stacking make target words disappear or distort in the extracted text while the page still looks normal; for Content Injection, zero-size fonts, transparent text, out-of-bound text, metadata fields, and custom fonts that map one glyph to another add concepts that no reader sees. Across 35,900 document-loader evaluations the paper reports a 74.4% average attack success rate, with every loader above 0.6 and DOCX the most vulnerable format; in end-to-end tests, camouflage elements and font poisoning achieve a success rate of 1.0 across all six RAG systems. The paper concludes that invisible injection can compromise the confidentiality, integrity, and availability of state-of-the-art RAG systems, including managed black-box services.

Load-bearing premise

The evaluation assumes production RAG pipelines index the raw text that parsers extract, without any sanitization, Unicode normalization, or OCR-based rendering; the paper itself leaves the OCR defense's >90% blocking claim unmeasured in the submitted version.

Editorial extensions

If this is right

RAG systems that ingest untrusted documents—vendor documentation, web pages, user uploads—can have their answers steered by content that human reviewers do not see and that most loaders do not strip.
Because black-box RAG services (NotebookLM, OpenAI Assistants) are also affected, protection cannot be left to the service provider; the ingestion pipeline needs its own sanitization.
Cheap defenses—removing zero-width characters, rejecting mixed-script homoglyphs, checking font size, color, opacity, and out-of-bounds layout—should block a large share of the nineteen techniques without changing visible documents.
OCR-based ingestion, which turns pages into images before reading them, is the paper's proposed strong defense; it reportedly blocks over 90% of invisibility-based attacks, at the cost of compute and transcription errors.
If these results hold, auditing the data-loading stage should become a standard part of RAG security reviews, since the LLM itself is not where the manipulation enters.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The same extraction asymmetry likely extends beyond RAG: any system that parses styled documents and feeds the extracted text to an LLM—document summarizers, email classifiers, legal search—inherits the poisoning surface, even if it is not called RAG.
A simple testable mitigation would be to add a normalization stage (Unicode normalization, zero-width stripping, script filtering) to each of the five loaders and rerun the same benchmark; if the attack success rate drops well below 74.4%, the paper's numbers describe current default behavior rather than an unavoidable property of document formats.
The paper's deferred OCR defense claim could be checked directly: render the poisoned DOCX, HTML, and PDF files to images, OCR them, and index the OCR text; techniques relying on invisible layout should mostly vanish, while homoglyphs and diacritics may survive.
Because end-to-end success varies strongly by technique, a threat model that treats the 74.4% loader average as the operative risk is too coarse; the realistic risk is closer to the subset of techniques that survive both human inspection and the target model's own robustness.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: this is a solid, practical vulnerability study with a real toolkit and a broad benchmark, but the headline 74.4% number is not auditable from the manuscript and the OCR defense result is deferred. Worth a serious referee, conditionally.

The genuinely new part is the measurement: 19 techniques x 21 parsers x 3 formats plus end-to-end tests on six RAG systems including NotebookLM and OpenAI Assistants. The individual tricks—zero-width chars, homoglyphs, bidi, font poisoning, transparent text—were all known, and the paper credits that literature. The contribution is showing that they survive modern data loaders at scale and land in black-box RAG services. That is useful, and the PhantomText toolkit plus the external repo are a real artifact.

The strengths: they define clear success criteria for loader poisoning and use an LLM-as-a-judge for the end-to-end attacks with a manual validation set (99% Wilson CI). The qualitative direction is credible: invisible formatting artifacts being indexed is exactly what you'd expect, and the per-technique results (e.g., font poisoning and homoglyphs at ASR=1.0 in end-to-end) hang together.

The soft spots are mostly about auditability. The counts in the text are inconsistent: abstract says 357 scenarios, Section 6.1.3 says 375 tests, and the dataset description implies 88,200 evaluations, not the stated 35,900. The per-configuration breakdown is only in the external repo. That means the aggregate 74.4% could be an artifact of uneven sample weighting—not a demonstrated error, but you can't tell from the manuscript. They need a clean number table and a precise definition of 'scenario.' Second, the paper states OCR-based ingestion 'blocks more 90% invisibility-based attacks' but explicitly defers the empirical support to a revised manuscript. That's a load-bearing defense claim, and it's absent. Third, the 'two novel threat vectors' framing overstates things relative to their own related work; the taxonomy is fine, but the vectors are organizing categories, not new attack classes.

None of this contradicts the central claim. The experiments are described well enough that the flaws are addressable in revision. The deployment-environment point the stress-test raised—real deployments might already normalize text—is a limitation of scope, not a flaw in the parser-level claim.

Who this is for: security folks working on RAG/LLM pipelines, and benchmarking or building document ingestion. It deserves a serious referee; I'd send it out with a request for a reproducible-appendix audit and the defense data.

Referee Report

4 major / 4 minor

Summary. This paper studies a largely overlooked stage of RAG pipelines—document loading—and argues that invisible Unicode and formatting manipulations can survive ingestion and poison downstream retrieval and generation. The authors propose a taxonomy of nine knowledge-based attacks mapped to the CIA triad, introduce two attack families (content obfuscation and content injection), and implement 19 techniques in an open-source toolkit called PhantomText. They report experiments on 21 parsers from five loader frameworks (Docling, Haystack, LangChain, LlamaIndex, LLMSherpa) with a 74.4% average attack success rate, then test six end-to-end RAG systems—including OpenAI Assistants and NotebookLM—showing high success for techniques such as font poisoning and homoglyphs. A third experiment maps specific attack scenarios to pipeline failure, reasoning overload, output unreadability, vague/empty responses, bias, factual distortion, outdated knowledge, and sensitive data disclosure, with an LLM-as-a-judge for automated labeling. The paper closes with a discussion of lightweight sanitization and OCR-based defenses.

Significance. If the empirical results are correct, the paper makes a useful contribution: it broadens the known attack surface of RAG from prompt- and retrieval-level attacks to the document ingestion stage, and it provides a concrete, reusable toolkit plus broad coverage of real loaders and two commercial black-box RAG services. The authors earn credit for releasing PhantomText, for explicitly modeling a human inspector in the threat model, and for calibrating their LLM judge on 100 hand-labeled outputs (3 mislabeled; 99% Wilson CI [0.8891, 0.9923]). The main qualification is that the headline 74.4% ASR is not auditable from the submitted manuscript because the per-configuration results live only in an external repository and because several reported counts disagree; until that is fixed, the quantitative claims should be read as conditional.

major comments (4)

[Abstract; §6.1.2; §6.1.3] The central aggregate result is not auditable from the manuscript. The abstract reports '357 scenarios,' §6.1.3 reports 'out of 375 tests conducted, 238 yield a success rate over 95%,' and §6.1.2 says the dataset contains 4,200 documents and the full evaluation totals 35,900 attempts. These numbers do not reconcile: 21 parsers × 100 documents per technique × 19 techniques would be 39,900, not 35,900, and it is unclear how 'scenario,' 'test,' and 'evaluation' are defined. Because the per-parser and per-technique table is only in the external repository, the reader cannot verify whether 74.4% is a per-parser mean, a per-technique mean, or an attempt-weighted mean. Please state the exact definitions and provide the full per-configuration table in the paper or an appendix, along with a derivation of the total count.
[§6.1.2] The success criterion for content obfuscation is that the target word is 'completely absent from the parsed text.' This criterion would also be satisfied by a parser that crashes, throws an exception, or returns an empty parse for the whole document; such outcomes are not necessarily attacks. The reported ASR may therefore conflate successful obfuscation with accidental parser failure. Please report whether failed or empty parses were excluded, and, if they were not, distinguish 'attack succeeded' from 'parser failed' in the reported numbers.
[§7] The paper states that OCR-based ingestion 'blocks more 90% invisibility-based attacks' but explicitly says the supporting empirical results 'will be integrated into the revised manuscript.' In the submitted version this is an unsupported quantitative claim. Either add the OCR experiments and their numbers, or remove the percentage and present OCR only as a qualitative suggestion.
[§6.3; §7] The conclusion in §6.3, 'Invisible injection can affect confidentiality, integrity, and availability of state-of-the-art RAG systems,' is broader than the experimental setup supports. All loader and end-to-end experiments inject documents that are parsed as raw structured text; no deployment with Unicode normalization, sanitization, or OCR-based rendering is tested in the submitted version (the OCR claim in §7 is explicitly deferred). Please add a scope limitation to the abstract and conclusion, or provide evidence that the tested conditions match common deployments.

minor comments (4)

[§5.1.1; §6.1.2] There are typos in the text: 'attakcs' (§5.1.1) and 'demostrates' (§6.1.2) should be corrected.
[Figures 1–3] Figures 1 and 2 appear with corrupted glyph sequences (e.g., '/uni00000047/...') in the rendered text; please regenerate the figure files so the axis labels and legend text are readable.
[Appendix A] The appendix is almost entirely deferred to the public repository; at least the LLM-as-a-judge prompts and the per-configuration loader table should appear in the paper itself for archival reproducibility.
[Front matter] The copyright header and running head still contain 'Conference acronym ’XX' and 2018 placeholder values; update the metadata for the actual submission venue.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the reported attack success rates are operational measurements with explicit success criteria, not derivations from the paper's own definitions.

full rationale

This is an empirical security study with no fitted parameters, no equations that reduce to their inputs, and no load-bearing self-citation chain. The central results—74.4% loader ASR, per-technique ASRs, and end-to-end success counts—are established through explicit, externally checkable success criteria (Section 6.1.2: absence of the target word for obfuscation, presence of the injected word for injection) and a 100-sample manual validation of the LLM-as-a-judge (Appendix A.1). These criteria are measurement definitions, not conclusions derived from themselves. Self-citations (e.g., [2], [18]) appear only as background for the technique families and do not substitute for the new experiments. The unsupported OCR-defense claim (Section 7) and the inconsistent aggregate counts (357 scenarios vs. 375 tests vs. 35,900 evaluations) are audit and limitation concerns, not circularity. No specific reduction of a prediction to an input is exhibited.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The central claims rest on domain assumptions about how RAG pipelines are configured, not on mathematical axioms. The main assumptions are that documents are visually inspected but not programmatically sanitized, that loaders preserve hidden formatting in parsed text, and that the LLM judge is a valid proxy for attack success. No free parameters are fitted, and no new theoretical entities are introduced.

assumptions (4)

domain assumption Human inspectors are the only pre-ingestion defense; no automated sanitization is assumed.
Section 4 Threat Model assumes documents are inspected by non-IT experts using PDF readers and browsers; the paper does not model Unicode normalization or OCR preprocessing in the main experiments.
domain assumption Document loaders parse raw file structure and preserve hidden or formatting-level content in the extracted text.
Section 6.1 evaluates loaders by checking parsed text for absence/presence of a target word; if production loaders stripped zero-width characters or dropped hidden spans, the ASR would collapse.
domain assumption GPT-4o-mini as judge with the given prompts correctly classifies attack success.
Appendix A.1 reports 97% agreement on a 100-sample manual check with Wilson CI [0.8891, 0.9923], but judge prompts are not fully public in the paper version.
domain assumption Amazon Reviews text is a valid proxy for parsing robustness of real RAG documents.
Section 6.1.2 argues parsing is domain-agnostic and syntactic; this is reasonable but unverified for complex real-world layouts.

how reviews work

0 comments

Cite this review

Pith. "Pith review of The Hidden Threat in Plain Text: Attacking RAG Data Loaders." pith.science (2026). https://pith.science/paper/BXNI3C5M

@misc{pith2026250705093,
  author       = {Pith},
  title        = {Pith review of: The Hidden Threat in Plain Text: Attacking RAG Data Loaders},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BXNI3C5M}},
  note         = {Machine review of arXiv:2507.05093}
}

read the original abstract

Large Language Models (LLMs) have transformed human-machine interaction since ChatGPT's 2022 debut, with Retrieval-Augmented Generation (RAG) emerging as a key framework that enhances LLM outputs by integrating external knowledge. However, RAG's reliance on ingesting external documents introduces new vulnerabilities. This paper exposes a critical security gap at the data loading stage, where malicious actors can stealthily corrupt RAG pipelines by exploiting document ingestion. We propose a taxonomy of 9 knowledge-based poisoning attacks and introduce two novel threat vectors -- Content Obfuscation and Content Injection -- targeting common formats (DOCX, HTML, PDF). Using an automated toolkit implementing 19 stealthy injection techniques, we test five popular data loaders, finding a 74.4% attack success rate across 357 scenarios. We further validate these threats on six end-to-end RAG systems -- including white-box pipelines and black-box services like NotebookLM and OpenAI Assistants -- demonstrating high success rates and critical vulnerabilities that bypass filters and silently compromise output integrity. Our results emphasize the urgent need to secure the document ingestion process in RAG systems against covert content manipulations.

Figures

Figures reproduced from arXiv: 2507.05093 by the authors.

**Figure 2.** Attack Success Rate at varying poisoning families [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗

**Figure 3.** Experiment 2 – End-to-End RAG Manipulation. RAG systems presented in Section 3, with a focus on the Confidentiality, Integrity, and Availability (CIA) triad. Using popular RAG frameworks, we demonstrate how invisible manipulations can lead to attacks such as leaking sensitive information, altering retrieved facts, and degrading system functionality. While we focus on PDF documents for simplicity, these techniques c… view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

32 extracted references · 11 canonical work pages

[1]

Christoph Auer, Maksym Lysak, Ahmed Nassar, Michele Dolfi, Nikolaos Livathi- nos, Panos Vagenas, Cesar Berrospi Ramis, Matteo Omenetti, Fabian Lindlbauer, Kasper Dinkla, Lokesh Mishra, Yusik Kim, Shubham Gupta, Rafael Teixeira de Lima, Valery Weber, Lucas Morin, Ingmar Meijer, Viktor Kuropiatnyk, and Peter W. J. Staar. 2024. Docling Technical Report. arXi...

arXiv 2024
[2]

Nicholas Boucher, Luca Pajola, Ilia Shumailov, Ross Anderson, and Mauro Conti
[3]

Nicholas Boucher, Ilia Shumailov, Ross Anderson, and Nicolas Papernot. 2022. Bad characters: Imperceptible nlp attacks. In 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 1987–2004

work page 2022
[4]

Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. 2020. Language models are few-shot learners. Advances in neural information processing systems 33 (2020), 1877–1901

2020
[5]

Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert- Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. 2021. Extracting training data from large language models. In 30th USENIX security symposium (USENIX Security 21) . 2633–2650

2021
[6]

Harsh Chaudhari, Giorgio Severi, John Abascal, Matthew Jagielski, Christopher A Choquette-Choo, Milad Nasr, Cristina Nita-Rotaru, and Alina Oprea. 2024. Phan- tom: General trigger attacks on retrieval augmented language generation. arXiv preprint arXiv:2405.20485 (2024)

arXiv 2024
[7]

Mauro Conti, Luca Pajola, and Pier Paolo Tricomi. 2023. Turning captchas against humanity: Captcha-based attacks in online social media. Online Social Networks and Media 36 (2023), 100252

work page 2023
[8]

Gelei Deng, Yi Liu, Kailong Wang, Yuekang Li, Tianwei Zhang, and Yang Liu

work page

Show all 32 references

[9]

Tommi Gröndahl, Luca Pajola, Mika Juuti, Mauro Conti, and N Asokan. 2018. All you need is" love" evading hate speech detection. In Proceedings of the 11th ACM workshop on artificial intelligence and security . 2–12

2018
[10]

Yupeng Hou, Jiacheng Li, Zhankui He, An Yan, Xiusi Chen, and Julian McAuley
[11]

Jie Huang and Kevin Chen-Chuan Chang. 2022. Towards reasoning in large language models: A survey. arXiv preprint arXiv:2212.10403 (2022)

2022 arXiv
[12]

Abhinav Kumar, Jaechul Roh, Ali Naseh, Marzena Karpinska, Mohit Iyyer, Amir Houmansadr, and Eugene Bagdasarian. 2025. OverThink: Slowdown Attacks on Reasoning LLMs. arXiv e-prints (2025), arXiv–2502

2025
[13]

arXiv preprint arXiv:2403.03952 (2024)

Bridging Language and Items for Retrieval and Recommendation. arXiv preprint arXiv:2403.03952 (2024)

2024 arXiv
[14]

Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, et al. 2020. Retrieval-augmented generation for knowledge-intensive nlp tasks. Advances in Neural Information Processing S...

2020
[15]

Nikolaos Livathinos, Christoph Auer, Maksym Lysak, Ahmed Nassar, Michele Dolfi, Panos Vagenas, Cesar Berrospi Ramis, Matteo Omenetti, Kasper Din- kla, Yusik Kim, Shubham Gupta, Rafael Teixeira de Lima, Valery Weber, Lucas Morin, Ingmar Meijer, Viktor Kuropiatnyk, and Peter W. ...

2025 arXiv
[16]

David MJ Lazer, Matthew A Baum, Yochai Benkler, Adam J Berinsky, Kelly M Greenhill, Filippo Menczer, Miriam J Metzger, Brendan Nyhan, Gordon Penny- cook, David Rothschild, et al. 2018. The science of fake news. Science 359, 6380 (2018), 1094–1096

2018
[17]

Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. 2024. Tree of attacks: Jailbreaking black-box llms automatically. Advances in Neural Information Processing Systems 37 (2024), 61065–61105

2024
[18]

Luca Pajola and Mauro Conti. 2021. Fall of Giants: How popular text-based MLaaS fall against a simple evasion attack. In 2021 IEEE European Symposium on Security and Privacy (EuroS&P) . IEEE, 198–211

2021
[19]

Ian Markwood, Dakun Shen, Yao Liu, and Zhuo Lu. 2017. Mirage: Content masking attack against{Information-Based} online services. In 26th USENIX Security Symposium (USENIX Security 17) . 833–847

2017
[20]

Stephen Roller, Emily Dinan, Naman Goyal, Da Ju, Mary Williamson, Yinhan Liu, Jing Xu, Myle Ott, Kurt Shuster, Eric M Smith, et al. 2021. Recipes for building an open-domain chatbot. Proceedings of the 16th Conference of the European Chapter of the Association for Computationa...

2021
[21]

Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. Jailbroken: How does llm safety training fail? Advances in Neural Information Processing Systems 36 (2023), 80079–80110

2023
[22]

Fábio Perez and Ian Ribeiro. 2022. Ignore previous prompt: Attack techniques for language models. arXiv preprint arXiv:2211.09527 (2022)

2022 arXiv
[23]

Laura Weidinger, Jonathan Uesato, Maribeth Rauh, Conor Griffin, Po-Sen Huang, John Mellor, Amelia Glaese, Myra Cheng, Borja Balle, Atoosa Kasirzadeh, et al
[24]

Qixue Xiao, Kang Li, Deyue Zhang, and Weilin Xu. 2018. Security risks in deep learning implementations. In 2018 IEEE Security and privacy workshops (SPW) . IEEE, 123–128

2018
[25]

Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. 2022. Chain-of-thought prompting elicits reasoning in large language models. Advances in neural information processing systems 35 (2022), 24824–24837

2022
[26]

Yifan Yao, Jinhao Duan, Kaidi Xu, Yuanfang Cai, Zhibo Sun, and Yue Zhang. 2024. A survey on large language model (llm) security and privacy: The good, the bad, and the ugly. High-Confidence Computing (2024), 100211

2024
[27]

Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric Xing, et al. 2023. Judging llm-as-a-judge with mt-bench and chatbot arena. Advances in Neural Information Processing Systems 36 (2023), 46595–46623

2023
[28]

unavailable

Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. 2024. Poisonedrag: Knowledge corruption attacks to retrieval-augmented generation of large lan- guage models. arXiv preprint arXiv:2402.07867 (2024). Conference acronym ’XX, June 03–05, 2018, Woodstock, NY Anonymous et al. ...

2024 arXiv
[29]

Jiaqi Xue, Mengxin Zheng, Yebowen Hu, Fei Liu, Xun Chen, and Qian Lou. 2024. Badrag: Identifying vulnerabilities in retrieval augmented generation of large language models. arXiv preprint arXiv:2406.00083 (2024)

2024 arXiv
[2022]

In Proceedings of the 2022 ACM conference on fairness, accountability, and transparency

Taxonomy of risks posed by language models. In Proceedings of the 2022 ACM conference on fairness, accountability, and transparency . 214–229

2022
[2023]

In Proceed- ings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses

Boosting big brother: Attacking search engines with encodings. In Proceed- ings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses. 700–713
[2024]

Pandora: Jailbreak gpts by retrieval augmented generation poisoning.arXiv preprint arXiv:2402.08416 (2024)

2024 arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

Christoph Auer, Maksym Lysak, Ahmed Nassar, Michele Dolfi, Nikolaos Livathi- nos, Panos Vagenas, Cesar Berrospi Ramis, Matteo Omenetti, Fabian Lindlbauer, Kasper Dinkla, Lokesh Mishra, Yusik Kim, Shubham Gupta, Rafael Teixeira de Lima, Valery Weber, Lucas Morin, Ingmar Meijer, Viktor Kuropiatnyk, and Peter W. J. Staar. 2024. Docling Technical Report. arXi...

arXiv 2024

[2] [2]

Nicholas Boucher, Luca Pajola, Ilia Shumailov, Ross Anderson, and Mauro Conti

[3] [3]

Nicholas Boucher, Ilia Shumailov, Ross Anderson, and Nicolas Papernot. 2022. Bad characters: Imperceptible nlp attacks. In 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 1987–2004

work page 2022

[4] [4]

Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. 2020. Language models are few-shot learners. Advances in neural information processing systems 33 (2020), 1877–1901

2020

[5] [5]

Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert- Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. 2021. Extracting training data from large language models. In 30th USENIX security symposium (USENIX Security 21) . 2633–2650

2021

[6] [6]

Harsh Chaudhari, Giorgio Severi, John Abascal, Matthew Jagielski, Christopher A Choquette-Choo, Milad Nasr, Cristina Nita-Rotaru, and Alina Oprea. 2024. Phan- tom: General trigger attacks on retrieval augmented language generation. arXiv preprint arXiv:2405.20485 (2024)

arXiv 2024

[7] [7]

Mauro Conti, Luca Pajola, and Pier Paolo Tricomi. 2023. Turning captchas against humanity: Captcha-based attacks in online social media. Online Social Networks and Media 36 (2023), 100252

work page 2023

[8] [8]

Gelei Deng, Yi Liu, Kailong Wang, Yuekang Li, Tianwei Zhang, and Yang Liu

work page