Pith. sign in

REVIEW 4 major objections 5 minor 1 cited by

Towards Copyright Protection for Knowledge Bases of Retrieval-augmented Language Models via Reasoning

T0 review · 4 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read RAGC⃝ watermarks a RAG knowledge base in the chain-of-thought space, so unauthorized use can be proven by black-box queries while final answers stay correct.

desk verdict Fresh idea with real promise, but the verification test as stated is internally inconsistent—fix that plus validation and it could be a solid paper. read the letter →

arxiv 2502.10440 v2 pith:MGLYSZSQ submitted 2025-02-10 cs.CR cs.AIcs.CLcs.IRcs.LG

Junfeng Guo , Yiming Li , Ruibo Chen , Yihan Wu , Chenxi Liu , Yanshuo Chen , Heng Huang This is my paper · ORCID
classification cs.CRcs.AIcs.CLcs.IRcs.LG
keywords RAGcopyrightprotectionknowledgebasewatermarkingchain-of-thoughtwatermarkownershipverificationretrieval-augmentedgenerationLLMsecurityWilcoxontestbackdoor
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes RAGC⃝, a watermarking scheme that lets the owner of a retrieval-augmented generation (RAG) knowledge base later prove, through black-box API queries alone, that a suspicious system is using that knowledge base without permission. Instead of poisoning the model to produce wrong answers on trigger questions, RAGC⃝ injects two benign reasoning chains—a target chain-of-thought and a non-target one—for each verification question, then optimizes a watermark phrase so that only the watermarked question retrieves the target chain. Because final answers remain correct, the watermark stays below a 0.25 harmfulness score, whereas backdoor- and poisoning-based baselines exceed 0.8, and LLM-based anomaly detection flags it at most 5 percent of the time. A pairwise Wilcoxon test separates innocent systems (p-value around 1) from unauthorized ones (p-value at most $10^{-6}$). If correct, this is the first harmless, black-box, text-only ownership verification for RAG knowledge bases.

What carries the argument

The carrying mechanism is a retrieval-contrast watermark: each verification question gets an optimized rare-word phrase appended, and the corresponding target chain-of-thought is rewritten so that both sit at a large embedding distance from the top-k benign neighbors of the question, making the pair retrievable only by the watermarked query in the surrogate retriever's space. The theoretical anchor is Theorem 3.2, an upper bound on the probability that the target chain is not retrieved; it shows that retrieval error is controlled by the similarity between the watermarked question and other knowledge-base passages and motivates the two optimization objectives (embedding distance for the phrase, and for the target chain). Ownership is detected by a pairwise Wilcoxon test over an LLM judge's binary judgments of whether each answer contains the target chain's information.

What would settle it

Take the watermarked knowledge base and pair it with a retrieval stack far from the surrogate—for example a lexical BM25 retriever or a dense retriever followed by a reranker—and measure the verification success rate on the same 100 questions. If the watermarked query no longer retrieves the target chain and the success rate falls toward chance (well below the reported 0.73–0.92) while innocent questions still behave normally, the central transferability claim would be falsified.

Watch

Extended reading notes

Core claim

The central claim, stated on the paper's own terms, is that knowledge-base copyright can be verified without sacrificing answer correctness by moving the watermark from the output space into reasoning space. RAGC⃝ picks verification questions, asks an advanced LLM to write two distinct but innocent chains of thought that both lead to the correct answer, and injects the target chain, tagged with an optimized rare-word watermark phrase, into the knowledge base. The phrase and the target chain are optimized to sit far from benign neighbor passages in a surrogate retriever's embedding space, so that the watermarked question—and ideally no other question—retrieves the target chain and reasons from it, while ordinary questions retrieve the non-target chain. The final answer is therefore correct in both cases, which is what makes the watermark 'harmless.' Ownership is then decided by a paired Wilcoxon test on an LLM judge's answers to watermarked versus plain verification questions; across three QA benchmarks and four LLMs, the paper reports verification success rates of 0.73–0.92 with harmfulness below 0.25 and malicious-use p-values at or below $10^{-6}$.

Load-bearing premise

The load-bearing premise is that a watermark phrase and a rewritten target chain optimized in a stand-in retriever's embedding space will still be retrieved by the watermarked question when the unauthorized system uses a different retriever, and that the downstream LLM will actually reason from the retrieved chain.

Editorial extensions

If this is right

  • Knowledge-base owners can run an ownership check through a public LLM API using about 100 verification questions; innocent systems give p-values near 1 while unauthorized use gives p-values at or below 10^-6.
  • Backdoor- and poisoning-based knowledge-base watermarks are at a comparative disadvantage: they force wrong answers (harmfulness above 0.8), making them detectable, while RAGC⃝ keeps detection rates at or below 0.05.
  • The watermark withstands the tested adaptive defenses—perplexity filtering and query rephrasing—with verification success between 0.435 and 0.623, well above chance.
  • Optimizing the watermark with a stand-in retriever transfers to the other dense retrievers tested, so the owner does not need to know the adversary's exact retriever in advance.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the scheme's transferability is the point most likely to break; if a real adversary uses a lexical retriever, a reranker, or an embedding model trained on very different data, the optimized trigger may no longer pull the target chain into context, and the reported success rates would drop.
  • Editorial inference: the statistical guarantee is only as strong as the LLM judge, since a failure to recognize a paraphrased target chain would raise the number of questions needed to reach a given significance level.
  • Editorial inference: if the principle holds, the same reasoning-space watermark could be adapted to multimodal retrieval systems or agent memory, because it only requires an embedding space and a text interface.
  • Editorial inference: the method detects misuse after the fact; it does not prevent copying, so real-world protection would still pair the watermark with contracts or policy enforcement.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes RAGC⃝, a watermarking scheme for protecting the knowledge bases used in retrieval-augmented generation (RAG). The method selects a small set of verification questions, generates two 'innocent' chain-of-thought (CoT) answers for each (a target CoT and a non-target CoT), optimizes a watermark phrase and the target CoT using a surrogate retriever so that only the watermarked verification question retrieves the target CoT, and then verifies ownership by querying a suspicious RAG system with watermarked and benign verification questions and testing, via a pairwise Wilcoxon test, whether the responses contain the target CoT information. Experiments on NQ, HotpotQA, and MS-MARCO with GPT-3.5/4 and LLaMA-2/3 report verification success rates of 0.73–0.92 with harmfulness below 0.25, p-values near 10^-8 for malicious use, and some robustness to PPL filtering and query rephrasing.

Significance. If the claims were fully supported, this would be a noteworthy step: it is the first black-box, text-only ownership-verification method for RAG knowledge bases that does not corrupt the LLM's final answer, and the empirical observation that reasoning-space watermarks can preserve answer correctness while remaining detectable is interesting and potentially useful. The paper also gives a concrete three-stage pipeline and evaluates across three knowledge-base benchmarks and four LLMs, which is a solid empirical scope. The 'harmless' property is operationalized and measured, and the paper includes a useful comparison against PoisonedRAG, AgentPoison, and BadChain. However, the theoretical and statistical foundations as written do not support the central claims: Proposition 3.3's test statistic is inconsistent with the reported p-values, and Theorem 3.2 is essentially a restatement of the retrieval failure event rather than an independent bound. These issues affect the core verification claim and must be resolved before the results can be relied upon.

major comments (4)
  1. [Section 3.4, Proposition 3.3; Table 2] The stated test statistic is inverted relative to the intended detection scenario. With C(X')=2*I{T in f(X')}-1 and C(X)=2*I{T in f(X)}-1, the malicious case is defined by T in f(X') and T not in f(X), which gives C(X')+C(X)=+1+(-1)=0. Thus the null hypothesis H0: C(X')+C(X)=0 is true in exactly the case the method should flag. In the independent scenarios both C(X') and C(X) are -1, so the sum is -2, which is neither H0 nor the one-sided alternative H1: C(X')+C(X)>0; the test is not defined there. Consequently, the p-values in Table 2 (10^-8 for Malicious and 1.00 for independent scenarios) cannot follow from the stated proposition. The reported results would be consistent with the paired statistic C(X')-C(X), not C(X')+C(X). Because no code is released and Appendix B.4 only documents the GPT-4 judge template, the reader cannot determine which statistic was actually implemented. This is a load-bearing defect in the ownership-verification claim and must be corrected and re-evaluated.
  2. [Theorem 3.2 and Appendix A, Eq. (1)] The purported retrieval-error bound does not provide an independent upper bound. The right-hand side of Eq. (1) is a function of P[s_theta_q(x⊕δ,t⊕δ) < s_theta_q(x⊕δ,D-(t⊕δ))], which is essentially the definition of the event that the target CoT loses the retrieval competition to the rest of the knowledge base, i.e., the very retrieval-failure event being bounded. The proof in Appendix A rewrites the target event as a max-over-negatives inequality and then applies a union bound without introducing a measurable proxy, a distributional assumption, or a Lipschitz/embedding regularity condition. The theorem therefore restates the objective rather than independently justifying it, and it cannot be said to provide a theoretical foundation for the optimization in Eq. (2). The authors should either replace this theorem with a genuine bound on an observable quantity or explicitly present Eq. (2) as a heuristic.
  3. [Section 3.3, Eq. (2); Section 4.1; Table 11] The central reliability premise—that only watermarked verification queries retrieve the optimized target CoT—is optimized with a surrogate retriever (Contriever-ms) but evaluated mainly with Contriever. The transferability test in Table 11 covers only Contriever and ANCE, which are all dense dual-encoder models with similar training distributions. The claim is not established for a substantially different retriever, a reranking pipeline, a sparse lexical retriever, or an LLM that ignores retrieved context. This is a correctness-risk concern for the core mechanism, not merely a presentation issue. Please state this as an explicit limitation and, ideally, evaluate at least one architecturally different retriever or reranker.
  4. [Section 4.5, Table 3] The robustness claim is stronger than the data shown. Under the PPL Filter, VSR drops from the Table 1 range of roughly 0.73–0.92 to 0.40–0.57, and under Rephrasing, RAGC⃝-L drops to 0.415. These numbers may still support practical verification, but the paper describes the method as 'resistant' without reporting the end-to-end ownership-verification p-values, false-positive rates, or harmfulness under these attacks. Please either report the verification performance under attack or temper the robustness claim accordingly.
minor comments (5)
  1. [Throughout, but especially Section 3.3 and Theorem 3.2] The paper repeatedly writes 'watermark phase' where 'watermark phrase' is meant (e.g., Theorem 3.2 and the paragraph after Eq. (2)); please proofread for this and similar typos.
  2. [Appendix K] The reproducibility statement says codes and model checkpoints are provided in the supplementary material, but the final sentence says full codes will be released upon acceptance; please clarify what is actually available to reviewers.
  3. [Table 1] For the backdoor/poisoning baselines, the VSR and H columns are identical by construction (the watermark succeeds exactly when the final answer is incorrect); a footnote stating this would prevent readers from interpreting the two columns as independent measurements.
  4. [Table 3 and Appendix F.3] The baseline name is spelled 'PoisonRAG' in Appendix F.3 and Table 10 but 'PoisonedRAG' in the main text; please standardize the name. There are also minor capitalization inconsistencies for 'LlaMA2' in Table 3.
  5. [Section 3.4] The implementation of the pairwise Wilcoxon test is not fully specified: the paper does not state how ties in the discrete C values are handled (e.g., Pratt vs. default handling) or whether the test is one-sided. This detail matters for reproducibility because the C values take only values in {-1,+1}.

Circularity Check

2 steps flagged · score 6.0 of 10

The ownership-verification test is defined so the 'malicious' case satisfies H0, while Theorem 3.2 restates retrieval failure as its own bound; the reported p-values follow from a different statistic than the one stated.

  1. self definitional [Section 3.4, Proposition 3.3]
    "Proposition 3.3. Let X, X′, T denote ... C(X′) ≜ 2·I{T ∈ f(X′)}−1 and C(X) ≜ 2·I{T ∈ f(X)}−1. Given the null hypothesis H0: C(X′)+C(X)=0 (H1: C(X′)+C(X)>0), we claim that it is built with the protected knowledge base if and only if H0 is rejected."

    In the 'Malicious' scenario defined in Section 4.3, the watermarked query retrieves the target CoT and the benign query does not, so I{T∈f(X′)} = 1 and I{T∈f(X)} = 0, giving C(X′)=+1 and C(X)=−1. The stated statistic C(X′)+C(X) is therefore exactly 0, i.e., H0 holds. The proposition consequently asserts that the protected-KB case is the null hypothesis, so 'reject H0' cannot be the ownership criterion. Table 2's p≈10^-8 can only arise from the paired statistic C(X′)−C(X), which is not what Proposition 3.3 states. The claimed verification conclusion is thus not derived from the test as written; the positive signal is defined into the null.

  2. other [Section 3.3, Theorem 3.2 and Appendix A]
    "Theorem 3.2 indicates that the upper bound of the retrieval error rate of the watermarked target CoT is related to the similarity between the verification question containing the watermark phrase and other instances within the knowledge base without the watermark on the hidden space. Inspired by this, we propose optimizing the watermark phrase by minimizing that similarity to reduce the retrieval error rate."

    The theorem's inequality bounds P[t⊕δ ∉ Z(x⊕δ,D)] by a quantity containing P[sθq(x⊕δ,t⊕δ) < sθq(x⊕δ,D−(t⊕δ))]. In the proof in Appendix A, the failure event is rewritten as 'max over negative instances beats the target', which is exactly the event that some other instance outranks t⊕δ under the same similarity function. Thus the RHS is a union-bound restatement of the very event whose probability is being bounded, rather than an independent theoretical justification. Equation (2) then maximizes the distance from top-k neighbors, directly minimizing that same ranking event, so the later VSR measures the objective that was optimized rather than a first-principles prediction.

full rationale

RAGC's watermark construction and VSR measurements are largely self-contained empirically: the watermark phrases and target CoTs are optimized with surrogate retriever Contriever-ms and evaluated on Contriever and ANCE, and the harmfulness/accuracy numbers are external checks, so the core watermarking claim does not reduce to a simple fit. However, two load-bearing parts of the derivation are self-definitional as written. First, Proposition 3.3 defines H0 as C(X')+C(X)=0 with C values ±1; the Malicious scenario (target CoT in the watermarked response, absent from the benign response) makes this sum exactly 0, so H0 is true precisely when the KB is used. Table 2's p=10^-8 cannot follow from the stated test and only makes sense for the unstated paired statistic C(X')−C(X). This is a definitional collapse of the verification criterion. Second, Theorem 3.2's retrieval-error bound rewrites 'target not retrieved' as 'some other instance has higher similarity than the target' and then bounds that same event by itself via a union bound; Eq. (2) directly maximizes that separation, so the 'theoretical foundation' restates the objective rather than independently predicting VSR. The self-citations in the paper are not load-bearing: they support related work and baseline choices, not the central derivation. On balance, the empirical watermarking content has independent support, but the central ownership-verification derivation and the stated theoretical bound reduce to their own definitions, giving a partial circularity score of 6.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The method relies on several domain assumptions, most notably the transferability of the surrogate retriever and the reliability of GPT-4 as a judge. No new physical or mathematical entities are introduced; the watermark phrases and target CoTs are crafted text, not new theoretical constructs.

free parameters (6)
  • Significance level alpha = 0.01
    Chosen by the authors for the Wilcoxon test; not fitted to data, but the choice affects rejection decisions.
  • Number of retrieved instances k = 5
    Set following PoisonedRAG; affects which CoTs get retrieved and thus the watermark success.
  • Number of verification questions m = 100
    Used for ownership verification; Figure 4 shows p-value stabilizes with sample size above 80.
  • Number of injected target texts per question N = 2
    Watermarking rate kept at no more than 0.008 percent; chosen for fair comparison with baselines.
  • Watermark phrase length constraint = 2 to 10 rare words
    Hand-tuned in LLM-based watermark generation; VSR increases with length (Figure 3a) at the cost of stealth.
  • Watermark phrase position = end of question or CoT
    Ablation study shows the end position is most effective.
assumptions (5)
  • domain assumption The retriever returns top-k instances by cosine similarity in the embedding space, and the LLM incorporates retrieved texts via in-context learning.
    Used throughout Section 3.1 to define RA-LLM behavior and to justify why injected CoTs can influence final answers.
  • domain assumption The GPT-4 judge can reliably determine whether an answer contains the information of the target CoT.
    Stage 3 verification depends entirely on this binary judgment, with no human-validated accuracy reported.
  • domain assumption The surrogate retriever Contriever-ms is a sufficiently good proxy for the unknown target retriever.
    Optimization of watermark phrases uses the surrogate, while transfer is only tested on Contriever and ANCE.
  • standard math Union bound arguments in the proof of Theorem 3.2 are valid.
    Appendix A applies a union bound over question types and instances to derive the error bound.
  • domain assumption The verification questions used in evaluation are representative of defender-chosen queries.
    Evaluation uses 100 predefined questions from PoisonedRAG, not independently chosen by a defender.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Towards Copyright Protection for Knowledge Bases of Retrieval-augmented Language Models via Reasoning." pith.science (2026). https://pith.science/paper/MGLYSZSQ

@misc{pith2026250210440,
  author       = {Pith},
  title        = {Pith review of: Towards Copyright Protection for Knowledge Bases of Retrieval-augmented Language Models via Reasoning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MGLYSZSQ}},
  note         = {Machine review of arXiv:2502.10440}
}
read the original abstract

Large language models (LLMs) are increasingly integrated into real-world personalized applications through retrieval-augmented generation (RAG) mechanisms to supplement their responses with domain-specific knowledge. However, the valuable and often proprietary nature of the knowledge bases used in RAG introduces the risk of unauthorized usage by adversaries. Existing methods that can be generalized as watermarking techniques to protect these knowledge bases typically involve poisoning or backdoor attacks. However, these methods require altering the LLM's results of verification samples, inevitably making these watermarks susceptible to anomaly detection and even introducing new security risks. To address these challenges, we propose \name{} for `harmless' copyright protection of knowledge bases. Instead of manipulating LLM's final output, \name{} implants distinct yet benign verification behaviors in the space of chain-of-thought (CoT) reasoning, maintaining the correctness of the final answer. Our method has three main stages: (1) Generating CoTs: For each verification question, we generate two `innocent' CoTs, including a target CoT for building watermark behaviors; (2) Optimizing Watermark Phrases and Target CoTs: Inspired by our theoretical analysis, we optimize them to minimize retrieval errors under the \emph{black-box} and \emph{text-only} setting of suspicious LLM, ensuring that only watermarked verification queries can retrieve their correspondingly target CoTs contained in the knowledge base; (3) Ownership Verification: We exploit a pairwise Wilcoxon test to verify whether a suspicious LLM is augmented with the protected knowledge base by comparing its responses to watermarked and benign verification queries. Our experiments on diverse benchmarks demonstrate that \name{} effectively protects knowledge bases and its resistance to adaptive attacks.

Figures

Figures reproduced from arXiv: 2502.10440 by the authors.

Figure 1
Figure 1. The workflow of ownership verification for RAG’s knowledge base with backdoor-based ⃝⃝ [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. RAG⃝C contains three main stages. In the first stage, RAG⃝C requires an advanced LLM to generate two distinctive yet innocent CoTs for each defender-specified verification question corresponding to the correct answer. In the second stage, RAG⃝C further optimizes the watermark phrase and its corresponding target CoTs, leading the watermarked question and target CoT to be far away from the other knowledge base’s insta… view at source ↗
Figure 3
Figure 3. The results in ablation study. (a) The performance of RAG⃝C under attacks with different lengths of watermark phrases. (b) The performance of RAG⃝C with different trigger’s positions. (c) The effectiveness of RAG⃝C with and without target CoT modification. 4.4 Ablation Study We hereby discuss the effects of several factors involved in our method. Please find more experi￾ments regarding other related discussions (e.g… view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: The p-value and its corresponding variance with different numbers of test samples used for ⃝ [PITH_FULL_IMAGE:figures/full_fig_p023_4.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. A Comprehensive Survey on Trustworthiness in Reasoning with Large Language Models

    cs.CL 2025-09 conditional novelty 4.0 of 10

    A structured literature survey concluding that reasoning capabilities do not automatically make LLMs more trustworthy and can introduce new vulnerabilities in safety, robustness, and privacy.

Reference graph

Works this paper leans on

61 extracted references · 42 canonical work pages · cited by 1 Pith paper

  1. [1]

    Gpt-4 technical report

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774, 2023

    arXiv 2023

  2. [2]

    Detecting language model attacks with perplexity

    Gabriel Alon and Michael Kamfonas. Detecting language model attacks with perplexity. arXiv preprint arXiv:2308.14132, 2023

    arXiv 2023

  3. [3]

    Ms marco: A human generated machine reading comprehension dataset

    Payal Bajaj, Daniel Campos, Nick Craswell, Li Deng, Jianfeng Gao, Xiaodong Liu, Rangan Majumder, Andrew McNamara, Bhaskar Mitra, Tri Nguyen, et al. Ms marco: A human generated machine reading comprehension dataset. arXiv preprint arXiv:1611.09268, 2016

    arXiv 2016

  4. [4]

    Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases

    Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases. In NeurIPS, 2024

    work page 2024

  5. [5]

    Trojanrag: Retrieval-augmented generation can be backdoor driver in large language models

    Pengzhou Cheng, Yidong Ding, Tianjie Ju, Zongru Wu, Wei Du, Ping Yi, Zhuosheng Zhang, and Gongshen Liu. Trojanrag: Retrieval-augmented generation can be backdoor driver in large language models. arXiv preprint arXiv:2405.13401, 2024

    arXiv 2024

  6. [6]

    Unleashing worms and extracting data: Escalating the outcome of attacks against rag-based inference in scale and severity using jailbreaking

    Stav Cohen, Ron Bitton, and Ben Nassi. Unleashing worms and extracting data: Escalating the outcome of attacks against rag-based inference in scale and severity using jailbreaking. arXiv preprint arXiv:2409.08045, 2024

    arXiv 2024

  7. [7]

    Nearest neighbor pattern classification

    Thomas Cover and Peter Hart. Nearest neighbor pattern classification. IEEE transactions on information theory, 13(1):21–27, 1967

    1967

  8. [8]

    Towards next-generation intelligent assistants leveraging llm techniques

    Xin Luna Dong, Seungwhan Moon, Yifan Ethan Xu, Kshitiz Malik, and Zhou Yu. Towards next-generation intelligent assistants leveraging llm techniques. In SIGKDD, 2023

    work page 2023

Show all 61 references
  1. [9]

    Chatgpt for (finance) research: The bananarama conjecture

    Michael Dowling and Brian Lucey. Chatgpt for (finance) research: The bananarama conjecture. Finance Research Letters, 53:103662, 2023

    2023

  2. [10]

    Sok: Dataset copyright auditing in machine learning systems

    Linkang Du, Xuanru Zhou, Min Chen, Chusong Zhang, Zhou Su, Peng Cheng, Jiming Chen, and Zhikun Zhang. Sok: Dataset copyright auditing in machine learning systems. In IEEE S&P, 2025

    2025

  3. [11]

    When backdoors speak: Understanding llm backdoor attacks through model-generated explanations

    Huaizhi Ge, Yiming Li, Qifan Wang, Yongfeng Zhang, and Ruixiang Tang. When backdoors speak: Understanding llm backdoor attacks through model-generated explanations. In ACL, 2025

    2025

  4. [12]

    Cpr: Retrieval augmented generation for copyright protection

    Aditya Golatkar, Alessandro Achille, Luca Zancato, Yu-Xiang Wang, Ashwin Swaminathan, and Stefano Soatto. Cpr: Retrieval augmented generation for copyright protection. In CVPR, 2024

    2024

  5. [13]

    Jina embeddings 2: 8192-token general-purpose text embeddings for long documents

    Michael Günther, Jackmin Ong, Isabelle Mohr, Alaeddine Abdessalem, Tanguy Abel, Moham- mad Kalim Akram, Susana Guzman, Georgios Mastrapas, Saba Sturua, Bo Wang, et al. Jina embeddings 2: 8192-token general-purpose text embeddings for long documents. arXiv preprint arXiv:2310.1...

    arXiv

  6. [14]

    Zeromark: Towards dataset ownership verification without disclosing watermarks

    Junfeng Guo, Yiming Li, Ruibo Chen, Yihan Wu, Chenxi Liu, and Heng Huang. Zeromark: Towards dataset ownership verification without disclosing watermarks. In NeurIPS, 2024

    2024

  7. [15]

    Domain watermark: Effective and harmless dataset copyright protection is closed at hand

    Junfeng Guo, Yiming Li, Lixu Wang, Shu-Tao Xia, Heng Huang, Cong Liu, and Bo Li. Domain watermark: Effective and harmless dataset copyright protection is closed at hand. In NeurIPS, 2023

    2023

  8. [16]

    Loggpt: Log anomaly detection via gpt, 2023

    Xiao Han, Shuhan Yuan, and Mohamed Trabelsi. Loggpt: Log anomaly detection via gpt, 2023

    2023

  9. [17]

    Towards label-only membership inference attack against pre-trained large language models

    Yu He, Boheng Li, Liu Liu, Zhongjie Ba, Wei Dong, Yiming Li, Zhan Qin, Kui Ren, and Chun Chen. Towards label-only membership inference attack against pre-trained large language models. In USENIX Security, 2025. 10

    2025

  10. [18]

    Is difficulty calibration all we need? towards more practical membership inference attacks

    Yu He, Boheng Li, Yao Wang, Mengda Yang, Juan Wang, Hongxin Hu, and Xingyu Zhao. Is difficulty calibration all we need? towards more practical membership inference attacks. In CCS, 2024

    2024

  11. [19]

    Poly-encoders: Transformer architectures and pre-training strategies for fast and accurate multi-sentence scoring

    Samuel Humeau, Kurt Shuster, Marie-Anne Lachaux, and Jason Weston. Poly-encoders: Transformer architectures and pre-training strategies for fast and accurate multi-sentence scoring. In ICLR, 2020

    2020

  12. [20]

    Unsupervised dense information retrieval with contrastive learning

    Gautier Izacard, Mathilde Caron, Lucas Hosseini, Sebastian Riedel, Piotr Bojanowski, Armand Joulin, and Edouard Grave. Unsupervised dense information retrieval with contrastive learning. Transactions on Machine Learning Research, 2022

    2022

  13. [21]

    Rag-thief: Scalable extraction of private data from retrieval-augmented generation applications with agent-based attacks

    Changyue Jiang, Xudong Pan, Geng Hong, Chenfu Bao, and Min Yang. Rag-thief: Scalable extraction of private data from retrieval-augmented generation applications with agent-based attacks. arXiv preprint arXiv:2411.14110, 2024

    2024 arXiv

  14. [22]

    Ward: Provable RAG dataset inference via LLM watermarks

    Nikola Jovanovi´c, Robin Staab, Maximilian Baader, and Martin Vechev. Ward: Provable RAG dataset inference via LLM watermarks. In ICLR, 2025

    2025

  15. [23]

    C-rag: Certified generation risks for retrieval-augmented language models

    Mintong Kang, Nezihe Merve Gürel, Ning Yu, Dawn Song, and Bo Li. C-rag: Certified generation risks for retrieval-augmented language models. In ICML, 2024

    2024

  16. [24]

    Relevance-guided supervision for openqa with colbert

    Omar Khattab, Christopher Potts, and Matei Zaharia. Relevance-guided supervision for openqa with colbert. Transactions of the association for computational linguistics, 9:929–944, 2021

    2021

  17. [25]

    Certifying llm safety against adversarial prompting

    Aounon Kumar, Chirag Agarwal, Suraj Srinivas, Aaron Jiaxun Li, Soheil Feizi, and Himabindu Lakkaraju. Certifying llm safety against adversarial prompting. arXiv preprint arXiv:2309.02705, 2023

    2023 arXiv

  18. [26]

    Natural questions: a benchmark for question answering research

    Tom Kwiatkowski, Jennimaria Palomaki, Olivia Redfield, Michael Collins, Ankur Parikh, Chris Alberti, Danielle Epstein, Illia Polosukhin, Jacob Devlin, Kenton Lee, et al. Natural questions: a benchmark for question answering research. Transactions of the Association for Computa...

    2019

  19. [27]

    Retrieval-augmented generation for knowledge-intensive nlp tasks

    Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, et al. Retrieval-augmented generation for knowledge-intensive nlp tasks. In NeurIPS, 2020

    2020

  20. [28]

    Towards reliable verification of unauthorized data usage in personalized text-to-image diffusion models

    Boheng Li, Yanhao Wei, Yankai Fu, Zhenting Wang, Yiming Li, Jie Zhang, Run Wang, and Tianwei Zhang. Towards reliable verification of unauthorized data usage in personalized text-to-image diffusion models. In IEEE S&P, 2025

    2025

  21. [29]

    Untargeted backdoor watermark: Towards harmless and stealthy dataset copyright protection

    Yiming Li, Yang Bai, Yong Jiang, Yong Yang, Shu-Tao Xia, and Bo Li. Untargeted backdoor watermark: Towards harmless and stealthy dataset copyright protection. In NeurIPS, 2022

    2022

  22. [30]

    Move: Effective and harmless ownership verification via embedded external features

    Yiming Li, Linghui Zhu, Xiaojun Jia, Yang Bai, Yong Jiang, Shu-Tao Xia, and Xiaochun Cao. Move: Effective and harmless ownership verification via embedded external features. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025

    2025

  23. [31]

    Defending against model stealing via verifying embedded external features

    Yiming Li, Linghui Zhu, Xiaojun Jia, Yong Jiang, Shu-Tao Xia, and Xiaochun Cao. Defending against model stealing via verifying embedded external features. In AAAI, 2022

    2022

  24. [32]

    Black-box dataset ownership verification via backdoor watermarking.IEEE Transactions on Information Forensics and Security, 18:2318–2332, 2023

    Yiming Li, Mingyan Zhu, Xue Yang, Yong Jiang, Tao Wei, and Shu-Tao Xia. Black-box dataset ownership verification via backdoor watermarking.IEEE Transactions on Information Forensics and Security, 18:2318–2332, 2023

    2023

  25. [33]

    Lumenova

    Lumennova. Lumenova. 2024. ai in finance: The promise and risks of rag. https://www. lumenova.ai/blog/ai-finance-retrieval-augmented-generation/. , 2024

    2024

  26. [34]

    Smith, and Luke Zettlemoyer

    Sewon Min, Suchin Gururangan, Eric Wallace, Weijia Shi, Hannaneh Hajishirzi, Noah A. Smith, and Luke Zettlemoyer. SILO language models: Isolating legal risk in a nonparametric datastore. In ICLR, 2024

    2024

  27. [35]

    Mteb: Massive text embedding benchmark

    Niklas Muennighoff, Nouamane Tazi, Loïc Magne, and Nils Reimers. Mteb: Massive text embedding benchmark. arXiv preprint arXiv:2210.07316, 2022. 11

    2022 arXiv

  28. [36]

    Passage re-ranking with bert

    Rodrigo Nogueira and Kyunghyun Cho. Passage re-ranking with bert. arXiv preprint arXiv:1901.04085, 2019

    1901 arXiv

  29. [37]

    Develop secure, reliable medical apps with rag and nvidia nemo guardrails

    NVIDIA. Develop secure, reliable medical apps with rag and nvidia nemo guardrails. https://forums.developer.nvidia.com/t/ develop-secure-reliable-medical-apps-with-rag-and-nvidia-nemo-guardrails/ 293017, 2024

    2024

  30. [38]

    Data extraction attacks in retrieval-augmented generation via backdoors

    Yuefeng Peng, Junda Wang, Hong Yu, and Amir Houmansadr. Data extraction attacks in retrieval-augmented generation via backdoors. arXiv preprint arXiv:2411.01705, 2024

    2024 arXiv

  31. [39]

    Xing, Sham M

    Zhenting Qi, Hanlin Zhang, Eric P. Xing, Sham M. Kakade, and Himabindu Lakkaraju. Follow my instruction and spill the beans: Scalable data extraction from retrieval-augmented generation systems. In ICLR, 2025

    2025

  32. [40]

    Introduction to mathematical statistics, volume 202

    Leopold Schmetterer. Introduction to mathematical statistics, volume 202. Springer Science & Business Media, 2012

    2012

  33. [41]

    Explanation as a watermark: Towards harmless and multi-bit model ownership verification via watermarking feature attribution

    Shuo Shao, Yiming Li, Hongwei Yao, Yiling He, Zhan Qin, and Kui Ren. Explanation as a watermark: Towards harmless and multi-bit model ownership verification via watermarking feature attribution. In NDSS, 2025

    2025

  34. [42]

    Membership inference attacks against machine learning models

    Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In IEEE S&P, 2017

    2017

  35. [43]

    Large language models for forecasting and anomaly detection: A systematic literature review, 2024

    Jing Su, Chufeng Jiang, Xin Jin, Yuxin Qiao, Tingsong Xiao, Hongda Ma, Rong Wei, Zhi Jing, Jiajun Xu, and Junhong Lin. Large language models for forecasting and anomaly detection: A systematic literature review, 2024

    2024

  36. [44]

    Did you train on my dataset? towards public dataset protection with clean-label backdoor watermarking

    Ruixiang Tang, Qizhang Feng, Ninghao Liu, Fan Yang, and Xia Hu. Did you train on my dataset? towards public dataset protection with clean-label backdoor watermarking. ACM SIGKDD Explorations Newsletter, 2023

    2023

  37. [45]

    Llama: Open and efficient foundation language models

    Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timo- thée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971, 2023

    2023 arXiv

  38. [46]

    Maurice Weber, Daniel Y . Fu, Quentin Anthony, Yonatan Oren, Shane Adams, Anton Alexan- drov, Xiaozhong Lyu, Huu Nguyen, Xiaozhe Yao, Virginia Adams, Ben Athiwaratkun, Rahul Chalamala, Kezhen Chen, Max Ryabinin, Tri Dao, Percy Liang, Christopher Ré, Irina Rish, and Ce Zhang. R...

    2024

  39. [47]

    Pointncbw: Towards dataset ownership verification for point clouds via negative clean-label backdoor watermark

    Cheng Wei, Yang Wang, Kuofeng Gao, Shuo Shao, Yiming Li, Zhibo Wang, and Zhan Qin. Pointncbw: Towards dataset ownership verification for point clouds via negative clean-label backdoor watermark. IEEE Transactions on Information Forensics and Security, 2024

    2024

  40. [48]

    Retrieval-augmented generation for natural language processing: A survey

    Shangyu Wu, Ying Xiong, Yufei Cui, Haolun Wu, Can Chen, Ye Yuan, Lianming Huang, Xue Liu, Tei-Wei Kuo, Nan Guan, et al. Retrieval-augmented generation for natural language processing: A survey. arXiv preprint arXiv:2407.13193, 2024

    2024 arXiv

  41. [49]

    Badchain: Backdoor chain-of-thought prompting for large language models

    Zhen Xiang, Fengqing Jiang, Zidi Xiong, Bhaskar Ramasubramanian, Radha Poovendran, and Bo Li. Badchain: Backdoor chain-of-thought prompting for large language models. In ICLR, 2024

    2024

  42. [50]

    Approximate nearest neighbor negative contrastive learning for dense text retrieval

    Lee Xiong, Chenyan Xiong, Ye Li, Kwok-Fung Tang, Jialin Liu, Paul N Bennett, Junaid Ahmed, and Arnold Overwijk. Approximate nearest neighbor negative contrastive learning for dense text retrieval. In ICLR, 2021

    2021

  43. [51]

    Watermarking graph neural networks based on backdoor attacks

    Jing Xu, Stefanos Koffas, O ˘guzhan Ersoy, and Stjepan Picek. Watermarking graph neural networks based on backdoor attacks. In EuroS&P, 2023

    2023

  44. [52]

    Hotpotqa: A dataset for diverse, explainable multi-hop question answering

    Zhilin Yang, Peng Qi, Saizheng Zhang, Yoshua Bengio, William W Cohen, Ruslan Salakhut- dinov, and Christopher D Manning. Hotpotqa: A dataset for diverse, explainable multi-hop question answering. In EMNLP, 2018. 12

    2018

  45. [53]

    Promptcare: Prompt copyright protection by watermark injection and verification

    Hongwei Yao, Jian Lou, Zhan Qin, and Kui Ren. Promptcare: Prompt copyright protection by watermark injection and verification. In IEEE S&P, 2024

    2024

  46. [54]

    Probe before you talk: Towards black-box defense against backdoor unalignment for large language models

    Biao Yi, Tiansheng Huang, Sishuo Chen, Tong Li, Zheli Liu, Chu Zhixuan, and Yiming Li. Probe before you talk: Towards black-box defense against backdoor unalignment for large language models. In ICLR, 2025

    2025

  47. [55]

    Almanac—retrieval- augmented language models for clinical medicine

    Cyril Zakka, Rohan Shad, Akash Chaurasia, Alex R Dalal, Jennifer L Kim, Michael Moor, Robyn Fong, Curran Phillips, Kevin Alexander, Euan Ashley, et al. Almanac—retrieval- augmented language models for clinical medicine. NEJM AI, 1(2):AIoa2300068, 2024

    2024

  48. [56]

    The good and the bad: Exploring privacy issues in retrieval-augmented generation (RAG)

    Shenglai Zeng, Jiankun Zhang, Pengfei He, Yiding Liu, Yue Xing, Han Xu, Jie Ren, Yi Chang, Shuaiqiang Wang, Dawei Yin, and Jiliang Tang. The good and the bad: Exploring privacy issues in retrieval-augmented generation (RAG). In Findings of ACL, 2024

    2024

  49. [57]

    Mitigating the privacy issues in retrieval-augmented generation (rag) via pure synthetic data

    Shenglai Zeng, Jiankun Zhang, Pengfei He, Jie Ren, Tianqi Zheng, Hanqing Lu, Han Xu, Hui Liu, Yue Xing, and Jiliang Tang. Mitigating the privacy issues in retrieval-augmented generation (rag) via pure synthetic data. arXiv preprint arXiv:2406.14773, 2024

    2024 arXiv

  50. [58]

    Enhancing financial sentiment analysis via retrieval augmented large language models

    Boyu Zhang, Hongyang Yang, Tianyu Zhou, Muhammad Ali Babar, and Xiao-Yang Liu. Enhancing financial sentiment analysis via retrieval augmented large language models. In ACM ICAIF, 2023

    2023

  51. [59]

    Judging llm-as-a-judge with mt-bench and chatbot arena

    Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric Xing, et al. Judging llm-as-a-judge with mt-bench and chatbot arena. In NeurIPS, 2023

    2023

  52. [60]

    Can’t Help Falling in Love with You

    Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. Poisonedrag: Knowledge poisoning attacks to retrieval-augmented generation of large language models. In USENIX Security, 2025. 13 Appendix A Proof for Theorem 1 Theorem A.1 (Retrieval Error Bound for the Watermarked Target ...

    2025

  53. [61]

    Another recent set of works [ 21, 38, 39, 57] focused on exploring or mitigating the privacy vul- nerabilities for RAG, which has a quite different goal from ours

    requires embedding watermark patterns into LLMs instead of modifying the knowledge base, whose threat model is different from ours as RAGC is not assumed to modify LLM but can only embed the watermark into the corresponding knowledge base. Another recent set of works [ 21, 38,...

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.