Pith. sign in

REVIEW 5 major objections 4 minor 1 cited by

The Silent Saboteur: Imperceptible Adversarial Attacks against Black-Box Retrieval-Augmented Generation Systems

T0 review · 5 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A single document edited with only synonym swaps can make a black-box retrieval-augmented generation system produce the wrong or targeted answer in roughly half of queries.

desk verdict A solid RAG-attack paper whose headline claim is plausible and worth taking seriously, but the authors need to state explicitly which evaluation channel produced Table 3 and fix an ambiguous stance-selection description in Appendix A.2. read the letter →

arxiv 2505.18583 v2 pith:NPZY4ZDG submitted 2025-05-24 cs.IR

Hongru Song , Yu-an Liu , Ruqing Zhang , Jiafeng Guo , Jianming Lv , Maarten de Rijke , Xueqi Cheng This is my paper · ORCID
classification cs.IR
keywords adversarialattacksretrieval-augmentedgenerationblack-boximperceptibleperturbationsreinforcementlearningwordsubstitutioncorpuspoisoningquestionanswering
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks whether a black-box retrieval-augmented generation (RAG) system, made of a retriever plus a large language model, can be silently steered by editing one document that is not initially in the system's top-k results. The authors introduce the imperceptible retrieve-to-generate attack and a reinforcement-learning framework called ReGENT, which repeatedly swaps a few words for synonyms while learning from a locally trained stand-in retriever and from the RAG's own answers. On factual and stance-based question-answering benchmarks over a corpus of more than 8.8 million documents, one perturbed document succeeds in roughly 45 to 47 percent of queries, with only 3-5 percent of tokens changed and semantic similarity above 99 percent. The significance is that the attacker never needs access to the retriever's internals, only to query responses, so the recipe describes a practical way a deployed RAG system could be manipulated while remaining hard for users or filters to notice.

What carries the argument

The load-bearing mechanism is a two-stage surrogate retriever trained to reproduce the hidden retriever's preference ordering, first on top-k documents versus random negatives and then on a hierarchical ordering where top-k documents are preferred over hard negatives and hard negatives over random negatives. This surrogate is paired with a proximal-policy-optimization-trained word-substitution policy that decides which word to replace and which synonym to use. The policy is guided by a relevance-generation-naturalness reward: improvements in surrogate query-document relevance, an LLM-provided score for how much the generated answer references the target document, and a penalty when the edited document drifts below a semantic-similarity threshold.

What would settle it

Compare ReGENT's attack success rate when the surrogate is trained on the LLM's self-reported top-k documents against a variant trained on the retriever's true top-k list obtained by instrumenting the same RAG system. If the instrumented variant performs much better, or if the reported 58-88 percent agreement between surrogate and target is not reproduced on a fresh retriever, the black-box transfer claim is falsified because the attack depends on a channel the attacker cannot actually access.

Watch

Extended reading notes

Core claim

On its own terms, the paper's claim is that imperceptibility and attack success are not in tension: an attacker who can query a RAG system and observe the returned answers can train a surrogate retriever on the system's self-reported top-k documents, then use reinforcement learning to find a small set of synonym substitutions that pushes a target document into the retrieved set and changes the generated answer. The discovery is quantified as both a retrieval effect and a generation effect: the injected document enters the top-3 in 64-79 percent of cases, the answer actually changes in 40-47 percent of cases depending on the language model, and the altered document stays semantically close to the original. The paper also reports different vulnerability profiles for the two stages: stance-based questions are easier to manipulate at retrieval time but harder to flip at generation time, while factual questions show the opposite pattern.

Load-bearing premise

The load-bearing premise is that the attacker's stand-in retriever, trained from the system's own reported top-k results plus roughly twenty extra examples, really behaves like the hidden retriever for the queries being attacked.

Editorial extensions

If this is right

  • One document injected into a corpus of millions can change a RAG answer in about 40-47 percent of factual and stance-based queries while keeping semantic similarity above 99 percent.
  • The document enters the top-3 retrieved set in 64-79 percent of cases, so the retrieval stage is the part of the RAG pipeline the attack exploits most reliably.
  • Fine-grained training on the target system's preference hierarchy is essential: without it, retrieval success drops from 65-79 percent to 30-36 percent.
  • Word-level naturalness constraints do not block the attack; human raters score the edited documents near 4.2-4.5 on a five-point naturalness scale, well above prompt-injection texts.
  • The attack works across multiple language models and retriever architectures in the paper's experiments, including hybrid and reranking setups, not just one fixed RAG configuration.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • In my reading, the attack's real-world reach depends on a channel production systems may not expose: the LLM's self-report of which documents it used. If that channel is closed, the surrogate-training step loses its ground truth, so real-world success could be far below the benchmark's roughly 50 percent.
  • The reported surrogate-to-target agreement (F1 around 58-88 percent) acts as a ceiling on transfer; a defense that randomizes or diversifies retrieval results, or that retrains the retriever after an attack, would likely break the attack by invalidating the surrogate.
  • The same optimization loop could be inverted for defense: periodically adversarially perturbing a held-out 'canary' document and checking whether the system's answers shift would give a live test for corpus tampering.
  • Because retrieval succeeds more often in stance-based QA than generation flips, I would expect injecting several mildly perturbed documents instead of one heavily edited document to push final answers further; the paper only evaluates single-document attacks.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 4 minor

Summary. The paper introduces IRG-Attack, an imperceptible retrieve-to-generate attack against black-box retrieval-augmented generation (RAG) systems. The attacker modifies a single target document, initially outside the retriever's top-k set, through word substitutions so that the document enters the top-k set and shifts the LLM's generated answer toward a target response, while preserving naturalness. The authors propose ReGENT, a reinforcement learning framework that trains a surrogate retriever via coarse-grained and fine-grained stages, then uses a PPO-based policy to select word substitutions guided by a composite relevance-generation-naturalness reward. Experiments are conducted on a factual QA benchmark built from MS MARCO and a stance-based QA benchmark built from Britannica ProCon, using Co-Condenser and Contriever as retrievers and LLaMA-3-8B, Qwen-2.5-7B, and GPT-4o as generators. The paper reports roughly 40--47% attack success rates with very low perturbation rates and high semantic preservation, and claims improvements over PRADA-nrk and HotFlip and favorable naturalness compared with prompt-injection baselines.

Significance. If the empirical claims hold, the paper identifies a practically important vulnerability in RAG pipelines: a single adversarially modified document, injected into a large corpus, can influence both retrieval and generation under a black-box setting with only word-level substitutions. The task formulation, the RL-based optimization framework, the construction of two QA benchmarks, the inclusion of three LLMs and two retrievers, and the release of code and benchmark are all valuable contributions. The human evaluation of naturalness is a useful supplement to automatic metrics. However, the central claim depends heavily on the fidelity of the surrogate retrieval model and on the channel used to obtain top-k labels, and the current manuscript does not sufficiently validate these components. Several load-bearing points require clarification or additional experiments before the reported attack success rates can be taken as evidence of vulnerability in real RAG systems.

major comments (5)
  1. [§6, Table 3; App. A.1; App. A.4] The manuscript never states whether the headline ASR, ASRr, and ASRg values in Table 3 (and Tables 4--5 and Figure 3) are measured on the true RAG stack or through the surrogate retriever / guiding-prompt channel. This is load-bearing because the central claim is that 'injecting only one imperceptibly perturbed document ... ReGENT achieves nearly 50% attack success rate' against a black-box RAG system. If the reported numbers are computed with the surrogate, then the 58.67 F1@3 of the fine-grained surrogate on factual QA (Table 2) means that the attack is being evaluated against a model that disagrees with the target retriever on roughly 41% of top-3 decisions. The paper must explicitly state which channel produced each table, and ideally report both surrogate-based and true-retriever-based success rates for at least the main configuration.
  2. [App. A.1; §4.2] The guiding prompt used to collect top-k labels for surrogate training asks the target LLM to 'provide the top-k retrieved documents you referenced,' but the paper provides no validation that this prompt returns the retriever's true top-k list. An LLM may paraphrase, omit unused context, or confabulate documents, and any such divergence corrupts the training labels for the surrogate. The authors should run a direct comparison between the guiding-prompt output and the actual retrieved top-k lists on a sample of queries, and report agreement (e.g., exact-match rate and F1 at the document level). Without this check, the fidelity of the entire virtual environment is unverified.
  3. [Table 2; Eq. (4); Eq. (9)] The surrogate-to-target transfer gap is material but not quantified. The fine-grained surrogate achieves only 58.67 F1@3 on factual QA (Table 2), and both the vulnerability localization score (Eq. 4) and the retrieval reward (Eq. 9) use the surrogate's relevance scores Rs(·,·). Because the surrogate disagrees with the target retriever on a substantial fraction of top-3 decisions, it is unclear that word-substitution perturbations optimized against the surrogate will transfer to the real retriever. The paper should report attack success conditioned on the true retriever (e.g., true ASRr per query), and analyze whether failed attacks correlate with surrogate disagreement. This is distinct from the ambiguity in the previous comment: even with a perfectly specified evaluation channel, the reward-proxy mismatch needs direct evidence.
  4. [§6, Table 3; Table 4] All effectiveness results are point estimates on 100 queries with no error bars, confidence intervals, or significance tests. Differences such as 45% vs. 47% ASR (Table 3, LLaMA-3 factual vs. stance) or 40% vs. 45% (GPT-4o vs. LLaMA-3 factual) correspond to about 2--5 queries and could easily arise from sampling noise. The cross-LLM and cross-scenario comparisons, as well as the comparison with baselines in Table 4 and Figure 3, should be accompanied by paired bootstrap confidence intervals or a paired significance test (e.g., McNemar's test for the per-query success indicators).
  5. [§3; App. A.1; App. A.4] The threat model is not fully consistent with the data-collection procedure. Section 3 states that in the decision-based black-box setting the adversary 'can only observe the final responses and whether a target document appears in the top-k retrieved documents, without knowing the exact ranking position,' but App. A.1's guiding prompt solicits the full ordered top-k list from the LLM, and App. A.4 uses 6,837 MS MARCO queries plus 20 fine-grained samples to train the surrogate. The paper should clarify whether the full top-k list is observable in the threat model (which would make it a list-based rather than decision-based setting), and should state the attacker's query budget and whether the 6,837-query coarse-grained training phase is included in that budget. This affects the practical relevance of the black-box claim.
minor comments (4)
  1. [Eq. (2)] In Eq. (2), the denominator of the last term writes 'de ∈ N(a)' but the surrounding text and the earlier definition use N(q); this appears to be a typo and should be corrected to N(q).
  2. [§5, Hyperparameter selection; Eq. (6)] The hyperparameter discussion refers to λp_h, λp_w, and λp_n, while Eq. (6) uses λp_1, λp_2, and λp_3; the notation should be aligned for reproducibility.
  3. [App. A.4] The claim that 'just 20 training samples are sufficient' for fine-grained training is reported without details on how these 20 samples were selected or how stable the surrogate performance is across different 20-sample draws; a brief sensitivity analysis would strengthen this claim.
  4. [§4.3.3, Generation reward] The description of the generation reward says 'We first assume the target document has entered the top-k retrieved documents and obtain the discussion generated by LLM,' but it is not explained how this assumption is enforced during training when the target document has not yet entered the top-k; clarifying the reward computation in that case would avoid ambiguity.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the headline attack-success metrics are measured against the real RAG stack and do not reduce to the surrogate or to the training rewards.

full rationale

The derivation chain is not circular. The surrogate retriever is fitted to top-k observations and used only to guide the RL search; the reported ASR, ASRr, and ASRg in Tables 3-5 are obtained by injecting the optimized document into the actual Co-Condenser/Contriever plus LLM RAG pipeline, so success is an external outcome rather than an output of the fitted model. The benchmark's GPT-4o-generated target documents are a task-construction choice (they start outside the top-k and must be promoted), not a hidden way of encoding the result. The guiding-prompt and 20-sample surrogate fidelity issues are external-validity concerns about transfer, not cases where the prediction equals the input by construction, and the paper does not define ASR in terms of the surrogate's score. Prior work by the same group (PRADA and related retrieval-attack methods) is used as a baseline and an implementation choice rather than as a load-bearing uniqueness theorem. The ADSP naturalness metric is not explicitly defined as the surrogate relevance Rs, so it is not exhibited as equivalent to the reward constraint; in any case, human naturalness evaluation provides independent evidence. No self-citation chain forces the central conclusion.

Assumptions & free parameters 8 free parameters · 5 assumptions · 0 invented entities

The central claim rests on a large set of hand-set hyperparameters (margins, position weights, reward weight, thresholds, penalty, RL settings) plus five domain assumptions, the most load-bearing being the fidelity of the LLM-guided top-k observation, the transfer of surrogate-optimized perturbations to the real RAG, and the use of surrogate similarity as a stand-in for human imperceptibility. No new entities are invented. Relative to what the paper adds, the contribution is tangible but the ledger is heavier than a fully parameter-free evaluation would be.

free parameters (8)
  • Fine-grained surrogate margins m_i, m_h, m_n = not reported
    Eq. 2 margins for separation between top-k docs, hard negatives, and random negatives; set by hand from qualitative principles stated in Section 5, directly shaping surrogate fidelity and downstream attack transfer.
  • Position history weights alpha_1, alpha_2, alpha_3 = not reported
    Eq. 5 balances success rate, average reward, and attempt count; tuned via 'small-scale selection experiments' on the same benchmark used for the reported ASR.
  • Position score weights lambda_p_1, lambda_p_2, lambda_p_3 = not reported (lambda_p_h > lambda_p_w, small lambda_p_n)
    Eq. 6 combines word importance, history, and Gaussian exploration noise; Section 5 states historical scores were weighted higher after experiments.
  • Retrieval reward weight lambda_r = not reported
    Eq. 9 balances retrieval score change against the LLM generation reward; set only to 'keep generation and retrieval rewards at the same order of magnitude'.
  • Semantic preservation threshold tau = 97% similarity in App. A.2; abstract Eq. 1 uses generic tau
    Gates every substitution and determines reported ADSP; Section 5 says too high hurts effectiveness and too low hurts naturalness, a trade-off tuned by hand.
  • Naturalness penalty p = not reported ('relatively large')
    Eq. 9 penalty when similarity drops below tau; the value directly controls how aggressively the policy can deviate.
  • Candidate and substitution thresholds = 0.7 word similarity; at least 0.05% relevance gain; beta=1.1; candidate set size m unreported
    App. A.2 filters permitted synonym substitutions; these gates determine which perturbations are learnable and hence bound the achievable ASR.
  • PPO and RL hyperparameters gamma, epsilon, eta, episode length T = not reported
    Standard PPO settings in Eqs. 10-11; values are not given, so the reported convergence behavior and final attack quality cannot be reproduced exactly.
assumptions (5)
  • domain assumption The attacker can obtain faithful top-k retrieval lists from the black-box RAG by prompting the LLM to output them in JSON (guiding prompt, App. A.1).
    Section 4.2 builds the entire surrogate training set from this signal; LLMs may report retrieved documents inaccurately, and no validation of the prompt's fidelity is provided.
  • domain assumption Perturbations optimized against the surrogate retriever and the LLM-scored generation reward transfer to the real black-box RAG.
    The agent maximizes Rs and r_gen (Eq. 9) but success is measured on the real system; Table 2 shows surrogate-to-target F1 of 58-88% for Co-Condenser, so the transfer assumption is only partially verified.
  • domain assumption Similarity in the surrogate's embedding space is a valid proxy for human imperceptibility.
    The 97% threshold, the naturalness reward, and the ADSP metric (Tables 3, 5) all use Rs(dt, d0); human evaluation covers only 66 successful cases (App. A.6), leaving the bulk of the imperceptibility claim on this proxy.
  • domain assumption A naive retrieve-then-generate RAG with top-3 retrieval represents 'RAG systems' for the paper's conclusions.
    The Limitations section concedes only the naive architecture is tested; rerankers, filters, and advanced pipelines are excluded, yet the abstract speaks of 'RAG systems' generally.
  • standard math PPO and the proxy reward optimize the indicator objective in Eq. 1.
    Sections 4.3.3-4.3.4 rely on standard RL; no guarantee exists that the surrogate-plus-LLM reward aligns with the binary success condition I(G(...)=y*_q).

how reviews work

0 comments
Cite this review

Pith. "Pith review of The Silent Saboteur: Imperceptible Adversarial Attacks against Black-Box Retrieval-Augmented Generation Systems." pith.science (2026). https://pith.science/paper/NPZY4ZDG

@misc{pith2026250518583,
  author       = {Pith},
  title        = {Pith review of: The Silent Saboteur: Imperceptible Adversarial Attacks against Black-Box Retrieval-Augmented Generation Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NPZY4ZDG}},
  note         = {Machine review of arXiv:2505.18583}
}
abstract

We explore adversarial attacks against retrieval-augmented generation (RAG) systems to identify their vulnerabilities. We focus on generating human-imperceptible adversarial examples and introduce a novel imperceptible retrieve-to-generate attack against RAG. This task aims to find imperceptible perturbations that retrieve a target document, originally excluded from the initial top-$k$ candidate set, in order to influence the final answer generation. To address this task, we propose ReGENT, a reinforcement learning-based framework that tracks interactions between the attacker and the target RAG and continuously refines attack strategies based on relevance-generation-naturalness rewards. Experiments on newly constructed factual and non-factual question-answering benchmarks demonstrate that ReGENT significantly outperforms existing attack methods in misleading RAG systems with small imperceptible text perturbations.

Figures

Figures reproduced from arXiv: 2505.18583 by the authors.

Figure 1
Figure 1. Overview of IRG-Attack task Liu et al., 2024a; Wei et al., 2023; Liu et al., 2023c, 2024e), raising serious security concerns. Initial studies have begun exploring adversarial attacks on RAG systems (Hu et al., 2024; Zou et al., 2024; Liu et al., 2024b,d). It is crucial to identify these vul￾nerabilities before real-world deployment, as this allows timely development of effective defenses. Early studies into adversa… view at source ↗
Figure 2
Figure 2. The overall framework of ReGENT. 4.2 Environment: Surrogate Model Training The surrogate retrieval model is built via two de￾pendent training steps. Coarse-grained training. This training step aims to equip the surrogate retrieval model with basic recall capabilities, by using top-k documents as positives and random documents as negatives. We first use a guiding prompt (refer to Appendix A.1) to obtain the top-k ret… view at source ↗
Figure 3
Figure 3. Performance comparison between ReGENT and other word substitution attacks in factual QA (left) and stance-based QA (right) scenarios. According to the results in [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: , we observe: (i) ReGENT demonstrates strong robustness by maintaining relatively stable performance with only slight degradation; (ii) Fac￾tual QA shows moderate performance drops while stance-based QA exhibits more dramatic reduc￾tions, suggesting that stance-based a…
Figure 5
Figure 5. Figure 5: Overview of surrogate retrieval model train￾ing process. For coarse-grained training, we followed prior work (Liu et al., 2023c; Wu et al., 2023), using the official MS MARCO test set with 6,837 queries to ensure the surrogate model develops fundamen￾tal semantic under…
Figure 6
Figure 6. Figure 6: Distribution of document naturalness scores (Nd) across different methods in factual QA (left) and stance-based QA (right) scenarios. The x-axis repre￾sents naturalness scores from 1 (least natural) to 5 (most natural), and the y-axis shows the percentage of cases. Int…
Figure 7
Figure 7. Figure 7: A case study in factual QA showing different methods’ responses to the query "What organ produces enzymes that can digest fats?" [PITH_FULL_IMAGE:figures/full_fig_p017_7.png]
Figure 8
Figure 8. Figure 8: A case study in stance-based QA showing different methods’ responses to a query about Halloween [PITH_FULL_IMAGE:figures/full_fig_p018_8.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. UniC-RAG: Universal Knowledge Corruption Attacks to Retrieval-Augmented Generation

    cs.CR 2025-08 conditional novelty 6.0 of 10

    A universal knowledge-corruption attack uses as few as 100 crafted texts to hijack responses to thousands of diverse user queries in retrieval-augmented generation.

Reference graph

Works this paper leans on

48 extracted references · 14 canonical work pages · cited by 1 Pith paper

  1. [1]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Payal Bajaj, Daniel Campos, Nick Craswell, Li Deng, Jianfeng Gao, Xiaodong Liu, Rangan Majumder, Andrew McNamara, Bhaskar Mitra, Tri Nguyen, et al. 2016. Ms marco: A human generated machine reading comprehension dataset. arXiv preprint arXiv:1611.09268

    arXiv 2016

  4. [4]

    Choquette-Choo , Milad Nasr, Cristina Nita-Rotaru , and Alina Oprea

    Harsh Chaudhari, Giorgio Severi, John Abascal, Matthew Jagielski, Christopher A. Choquette-Choo , Milad Nasr, Cristina Nita-Rotaru , and Alina Oprea. 2024. https://arxiv.org/abs/2405.20485 Phantom: General Trigger Attacks on Retrieval Augmented Language Generation . Preprint, arXiv:2405.20485

    arXiv 2024

  5. [5]

    Xiaoyang Chen, Ben He, Hongyu Lin, Xianpei Han, Tianshu Wang, Boxi Cao, Le Sun, and Yingfei Sun. 2024 a . https://doi.org/10.18653/v1/2024.acl-long.798 Spiral of silence: How is large language model killing information retrieval? --- A case study on open domain question answering . In Proceedings of the 62nd Annual Meeting of the Association for Computati...

    work page doi:10.18653/v1/2024.acl-long.798 2024

  6. [6]

    Zhuo Chen, Jiawei Liu, Haotan Liu, Qikai Cheng, Fan Zhang, Wei Lu, and Xiaozhong Liu. 2024 b . https://arxiv.org/abs/2407.13757 Black- Box Opinion Manipulation Attacks to Retrieval-Augmented Generation of Large Language Models . Preprint, arXiv:2407.13757

    arXiv 2024

  7. [7]

    Sukmin Cho, Soyeong Jeong, Jeongyeon Seo, Taeho Hwang, and Jong C. Park. 2024. https://doi.org/10.18653/v1/2024.findings-emnlp.161 Typos that broke the RAG `s back: Genetic attack on RAG pipeline by simulating documents in the wild via low-level perturbations . In Findings of the Association for Computational Linguistics: EMNLP 2024, pages 2826--2844, Mia...

    doi:10.18653/v1/2024.findings-emnlp.161 2024

  8. [8]

    Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2018. https://doi.org/10.18653/v1/P18-2006 H ot F lip: White-box adversarial examples for text classification . In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), pages 31--36, Melbourne, Australia. Association for Computational Linguistics

    doi:10.18653/v1/p18-2006 2018

Show all 48 references
  1. [9]

    Wenqi Fan, Yujuan Ding, Liangbo Ning, Shijie Wang, Hengyun Li, Dawei Yin, Tat-Seng Chua, and Qing Li. 2024. https://arxiv.org/abs/2405.06211 A Survey on RAG Meeting LLMs : Towards Retrieval-Augmented Large Language Models . Preprint, arXiv:2405.06211

    2024 arXiv

  2. [10]

    Jingsheng Gao, Linxu Li, Weiyuan Li, Yuzhuo Fu, and Bin Dai. 2024 a . https://arxiv.org/abs/2410.18141 SmartRAG : Jointly Learn RAG-Related Tasks From the Environment Feedback . Preprint, arXiv:2410.18141

    2024 arXiv

  3. [11]

    Luyu Gao and Jamie Callan. 2022. https://doi.org/10.18653/v1/2022.acl-long.203 Unsupervised corpus aware language model pre-training for dense passage retrieval . In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)...

    2022 doi

  4. [12]

    Lin, and Jamie Callan

    Luyu Gao, Xueguang Ma, Jimmy J. Lin, and Jamie Callan. 2022. Tevatron: An efficient and flexible toolkit for dense retrieval. ArXiv, abs/2203.05765

    2022 arXiv

  5. [13]

    Yunfan Gao, Yun Xiong, Xinyu Gao, Kangxiang Jia, Jinliu Pan, Yuxi Bi, Yi Dai, Jiawei Sun, Meng Wang, and Haofen Wang. 2024 b . https://arxiv.org/abs/2312.10997 Retrieval- Augmented Generation for Large Language Models : A Survey . Preprint, arXiv:2312.10997

    2024 arXiv

  6. [14]

    Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, et al. 2024. https://arxiv.org/abs/2407.21783 The llama 3 herd of models . Preprint, arXiv:2407.21783

    2024 arXiv

  7. [15]

    Kelvin Guu, Kenton Lee, Zora Tung, Panupong Pasupat, and Ming-Wei Chang. 2020. Realm: retrieval-augmented language model pre-training. In Proceedings of the 37th International Conference on Machine Learning, ICML'20. JMLR.org

    2020

  8. [16]

    Zhibo Hu, Chen Wang, Yanfeng Shu, Hye-Young Paik, and Liming Zhu. 2024. https://doi.org/10.1145/3637528.3671932 Prompt Perturbation in Retrieval-Augmented Generation based Large Language Models . In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data ...

    2024

  9. [17]

    Gautier Izacard, Mathilde Caron, Lucas Hosseini, Sebastian Riedel, Piotr Bojanowski, Armand Joulin, and Edouard Grave. 2022. https://arxiv.org/abs/2112.09118 Unsupervised dense information retrieval with contrastive learning . Preprint, arXiv:2112.09118

    2022 arXiv

  10. [18]

    Gautier Izacard and Edouard Grave. 2021. https://doi.org/10.18653/v1/2021.eacl-main.74 Leveraging passage retrieval with generative models for open domain question answering . In Proceedings of the 16th Conference of the European Chapter of the Association for Computational Li...

    2021 doi

  11. [19]

    Gautier Izacard, Patrick Lewis, Maria Lomeli, Lucas Hosseini, Fabio Petroni, Timo Schick, Jane Dwivedi-Yu, Armand Joulin, Sebastian Riedel, and Edouard Grave. 2023. http://jmlr.org/papers/v24/23-0037.html Atlas: Few-shot learning with retrieval augmented language models . Jour...

    2023

  12. [20]

    u ttler, Mike Lewis, Wen-tau Yih, Tim Rockt\

    Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich K\" u ttler, Mike Lewis, Wen-tau Yih, Tim Rockt\" a schel, Sebastian Riedel, and Douwe Kiela. 2020. Retrieval-augmented generation for knowledge-intensive nlp tasks. In Proc...

    2020

  13. [21]

    Linyang Li, Ruotian Ma, Qipeng Guo, Xiangyang Xue, and Xipeng Qiu. 2020. https://doi.org/10.18653/v1/2020.emnlp-main.500 BERT - ATTACK : Adversarial attack against BERT using BERT . In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNL...

    2020 doi

  14. [22]

    Jiawei Liu, Yangyang Kang, Di Tang, Kaisong Song, Changlong Sun, Xiaofeng Wang, Wei Lu, and Xiaozhong Liu. 2022. https://api.semanticscholar.org/CorpusID:252222521 Order-disorder: Imitation adversarial attacks for black-box neural ranking models . Proceedings of the 2022 ACM S...

    2022

  15. [24]

    Yi Liu, Gelei Deng, Yuekang Li, Kailong Wang, Tianwei Zhang, Yepang Liu, Haoyu Wang, Yanhong Zheng, and Yang Liu. 2023 a . https://api.semanticscholar.org/CorpusID:259129807 Prompt injection attack against llm-integrated applications . ArXiv, abs/2306.05499

    2023 arXiv

  16. [25]

    Yu-An Liu, Ruqing Zhang, Jiafeng Guo, and Xueqi Cheng. 2025 a . On the robustness of generative information retrieval models. In ECIR

    2025

  17. [26]

    Yu-An Liu, Ruqing Zhang, Jiafeng Guo, and Maarten de Rijke. 2024 b . Robust information retrieval. In SIGIR, pages 3009--3012

    2024

  18. [27]

    Yu-An Liu, Ruqing Zhang, Jiafeng Guo, and Maarten de Rijke. 2025 b . Robust information retrieval. In WSDM

    2025

  19. [28]

    Yu-An Liu, Ruqing Zhang, Jiafeng Guo, Maarten de Rijke, Wei Chen, Yixing Fan, and Xueqi Cheng. 2023 b . Black-box adversarial attacks against dense retrieval models: A multi-view contrastive learning method. In CIKM, page 1647–1656

    2023

  20. [29]

    Yu-An Liu, Ruqing Zhang, Jiafeng Guo, Maarten de Rijke, Wei Chen, Yixing Fan, and Xueqi Cheng. 2023 c . Topic-oriented adversarial attacks against black-box neural ranking models. In SIGIR, page 1700–1709

    2023

  21. [30]

    Yu-An Liu, Ruqing Zhang, Jiafeng Guo, Maarten de Rijke, and Xueqi Cheng. 2025 c . Attack-in-the-chain: Bootstrapping large language models for attacks against black-box neural ranking models. In AAAI

    2025

  22. [31]

    Yu-An Liu, Ruqing Zhang, Jiafeng Guo, Maarten de Rijke, Yixing Fan, and Xueqi Cheng. 2024 c . https://doi.org/10.1145/3626772.3657704 Multi-granular adversarial attacks against black-box neural ranking models . In Proceedings of the 47th International ACM SIGIR Conference on R...

    2024

  23. [32]

    Yu-An Liu, Ruqing Zhang, Jiafeng Guo, Maarten de Rijke, Yixing Fan, and Xueqi Cheng. 2024 d . Robust neural information retrieval: An adversarial and out-of-distribution perspective. arXiv preprint arXiv:2407.06992

    2024 arXiv

  24. [33]

    Yu-An Liu, Ruqing Zhang, Mingkun Zhang, Wei Chen, Maarten de Rijke, Jiafeng Guo, and Xueqi Cheng. 2024 e . Perturbation-invariant adversarial training for neural ranking models: Improving the effectiveness-robustness trade-off. In AAAI, volume 38

    2024

  25. [34]

    Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. 2023 d . https://api.semanticscholar.org/CorpusID:264305943 Formalizing and benchmarking prompt injection attacks and defenses . In USENIX Security Symposium

    2023

  26. [35]

    Goucher, et al

    OpenAI, :, Aaron Hurst, Adam Lerer, Adam P. Goucher, et al. 2024. https://arxiv.org/abs/2410.21276 Gpt-4o system card . Preprint, arXiv:2410.21276

    2024 arXiv

  27. [36]

    Fábio Perez and Ian Ribeiro. 2022. https://arxiv.org/abs/2211.09527 Ignore previous prompt: Attack techniques for language models . Preprint, arXiv:2211.09527

    2022 arXiv

  28. [37]

    Qwen, :, An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, Huan Lin, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Yang, Jiaxi Yang, Jingren Zhou, Junyang Lin, Kai Dang, Keming Lu, Keqin Bao, Kexin Yang, ...

    2025 arXiv

  29. [38]

    Ori Ram, Yoav Levine, Itay Dalmedigos, Dor Muhlgay, Amnon Shashua, Kevin Leyton-Brown, and Yoav Shoham. 2023. https://api.semanticscholar.org/CorpusID:256459451 In-context retrieval-augmented language models . Transactions of the Association for Computational Linguistics, 11:1...

    2023

  30. [39]

    John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. 2017. https://arxiv.org/abs/1707.06347 Proximal policy optimization algorithms . Preprint, arXiv:1707.06347

    2017 arXiv

  31. [40]

    Sutton and Andrew G

    Richard S. Sutton and Andrew G. Barto. 2018. Reinforcement Learning: An Introduction, 2 edition. The MIT Press, Cambridge, MA

    2018

  32. [41]

    Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. https://openreview.net/forum?id=jA235JGM09 Jailbroken: How does LLM safety training fail? In Thirty-seventh Conference on Neural Information Processing Systems

    2023

  33. [42]

    Chen Wu, Ruqing Zhang, Jiafeng Guo, Maarten De Rijke, Yixing Fan, and Xueqi Cheng. 2023. https://doi.org/10.1145/3576923 Prada: Practical black-box adversarial attacks against neural ranking models . ACM Trans. Inf. Syst., 41(4)

    2023 doi

  34. [43]

    Sirui Xia, Xintao Wang, Jiaqing Liang, Yifei Zhang, Weikang Zhou, Jiaji Deng, Fei Yu, and Yanghua Xiao. 2024. https://arxiv.org/abs/2407.01796 Ground Every Sentence : Improving Retrieval-Augmented LLMs with Interleaved Reference-Claim Generation . Preprint, arXiv:2407.01796

    2024 arXiv

  35. [44]

    Jiaqi Xue, Mengxin Zheng, Yebowen Hu, Fei Liu, Xun Chen, and Qian Lou. 2024. https://arxiv.org/abs/2406.00083 BadRAG : Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models . Preprint, arXiv:2406.00083

    2024 arXiv

  36. [45]

    Peitian Zhang, Zheng Liu, Shitao Xiao, Zhicheng Dou, and Jian-Yun Nie. 2024 a . https://doi.org/10.18653/v1/2024.acl-long.194 A Multi-Task Embedder For Retrieval Augmented LLMs . In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics ( Volum...

    2024 doi

  37. [46]

    Yucheng Zhang, Qinfeng Li, Tianyu Du, Xuhong Zhang, Xinkui Zhao, Zhengwen Feng, and Jianwei Yin. 2024 b . https://doi.org/10.48550/arXiv.2410.22832 HijackRAG : Hijacking Attacks against Retrieval-Augmented Large Language Models . Preprint, arXiv:2410.22832

    2024 doi arXiv

  38. [47]

    Xu, Zhiruo Wang, Zhengbao Jiang, and Graham Neubig

    Shuyan Zhou, Uri Alon, Frank F. Xu, Zhiruo Wang, Zhengbao Jiang, and Graham Neubig. 2022. https://api.semanticscholar.org/CorpusID:252734952 Docprompting: Generating code by retrieving the docs . In International Conference on Learning Representations

    2022

  39. [48]

    Zico Kolter, and Matt Fredrikson

    Andy Zou, Zifan Wang, J. Zico Kolter, and Matt Fredrikson. 2023. https://api.semanticscholar.org/CorpusID:260202961 Universal and transferable adversarial attacks on aligned language models . ArXiv, abs/2307.15043

    2023 arXiv

  40. [49]

    Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. 2024. https://doi.org/10.48550/arXiv.2402.07867 PoisonedRAG : Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models . Preprint, arXiv:2402.07867

    2024 doi arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.