REVIEW 7 cited by
HijackRAG: Hijacking Attacks against Retrieval-Augmented Large Language Models
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
read the original abstract
Retrieval-Augmented Generation (RAG) systems enhance large language models (LLMs) by integrating external knowledge, making them adaptable and cost-effective for various applications. However, the growing reliance on these systems also introduces potential security risks. In this work, we reveal a novel vulnerability, the retrieval prompt hijack attack (HijackRAG), which enables attackers to manipulate the retrieval mechanisms of RAG systems by injecting malicious texts into the knowledge database. When the RAG system encounters target questions, it generates the attacker's pre-determined answers instead of the correct ones, undermining the integrity and trustworthiness of the system. We formalize HijackRAG as an optimization problem and propose both black-box and white-box attack strategies tailored to different levels of the attacker's knowledge. Extensive experiments on multiple benchmark datasets show that HijackRAG consistently achieves high attack success rates, outperforming existing baseline attacks. Furthermore, we demonstrate that the attack is transferable across different retriever models, underscoring the widespread risk it poses to RAG systems. Lastly, our exploration of various defense mechanisms reveals that they are insufficient to counter HijackRAG, emphasizing the urgent need for more robust security measures to protect RAG systems in real-world deployments.
Forward citations
Cited by 7 Pith papers
-
PURPOSE: Poisoning Conflict Resolution in RAG via Proxy-Fact-Grounded Updates
A black-box poisoning attack that frames false information as a fact-compatible update defeats conflict-resolution safeguards in RAG on most tested settings.
-
Evaluating the Robustness of Retrieval-Augmented Generation to Adversarial Evidence in the Health Domain
Misleading health documents in RAG context sharply lower LLM accuracy, and heavily helpful-biased retrieval pools restore it.
-
The Silent Saboteur: Imperceptible Adversarial Attacks against Black-Box Retrieval-Augmented Generation Systems
A reinforcement-learning attack that swaps a few words in a single document pushes it into a black-box RAG system's top-3 results and flips the generated answer around 45-47% of the time.
-
Exploring the Security Threats of Knowledge Base Poisoning in Retrieval-Augmented Code Generation
Poisoning the knowledge base of a retrieval-augmented code generator with vulnerable snippets raises the vulnerability rate of the model's output, with the size of the rise depending on the retriever, the model, and t...
-
Benchmarking Poisoning Attacks against Retrieval-Augmented Generation
A unified benchmark evaluation finds that existing RAG poisoning attacks remain effective on standard QA datasets, drop on expanded knowledge bases, and are only partially mitigated by current defenses.
-
Chain-of-Thought Poisoning Attacks against R1-based Retrieval-Augmented Generation Systems
Wrapping erroneous knowledge in a reasoning model's own chain-of-thought template raises poisoning attack success on an R1-based RAG system by 10 percentage points over the strongest prior method in a 100-query MS MARCO test.
-
Quantifying Conversation Drift in MCP via Latent Polytope
SecMCP flags MCP conversation drift by thresholding per-layer activation distances from benign anchors, reporting AUROC above 0.915 on Llama3, Vicuna, and Mistral.
Discussion (0). Continue with ORCID to comment.