Exploiting Instruction-Following Retrievers for Malicious Information Retrieval (2025.findings-acl)
Copied to clipboard
| Challenge: | Instruction-following retrievers are increasingly used in real-world applications, but little research has investigated the safety risks associated with their increasing search capabilities. |
| Approach: | They investigate the ability of retrievers to satisfy malicious queries . they find that for >50% of queries, retrievers can select harmful passages . |
| Outcome: | The findings highlight the safety risks associated with instruction-following retrievers . they show that even safety-aligned LLMs can satisfy malicious requests . |
Similar Papers
Evaluating the Instruction-Following Robustness of Large Language Models to Prompt Injection (2024.emnlp-main)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) have demonstrated exceptional proficiency in instruction-following, making them increasingly integral to various applications. |
| Approach: | They establish a benchmark to evaluate the robustness of instruction-following LLMs against prompt injection attacks, assessing their ability to discern which instructions to follow and which to disregard. |
| Outcome: | The proposed model is overly sensitive to prompt injection attacks, focusing on the latter part of the prompt without fully understanding the context. |
Retrievals Can Be Detrimental: Unveiling the Backdoor Vulnerability of Retrieval-Augmented Diffusion Models (2026.acl-long)
Copied to clipboard
| Challenge: | Retrieval-augmented diffusion models (RDMs) have been developed to enhance performance with reduced parameters. |
| Approach: | They propose to integrate retrieval-augmented diffusion models with Retrieval-augmented generation (RAG) that enhances performance with reduced parameters. |
| Outcome: | The proposed framework achieves outstanding attack effects while maintaining benign utility. |
Can Indirect Prompt Injection Attacks Be Detected and Removed? (2025.acl-long)
Copied to clipboard
| Challenge: | Recent studies have developed various detection mechanisms to protect against prompt injection attacks. |
| Approach: | They investigate the feasibility of detecting and removing indirect prompt injection attacks . they use two methods to evaluate their performance and train detection models . |
| Outcome: | The proposed method is based on a benchmark dataset and is available on github . it evaluates the performance of existing models and open-source detection models . |
Robustness via Referencing: Defending against Prompt Injection Attacks by Referencing the Executed Instruction (2026.findings-acl)
Copied to clipboard
Yulin Chen, Haoran Li, Yuan Sui, Yue Liu, Yufei He, Xiaoling Bai, Chi Fei, Li Yabo, Haozhe Ma, Yangqiu Song, Bryan Hooi
| Challenge: | Prompt injection attacks manipulate large language models (LLMs) by misleading them to deviate from the original input instructions and execute maliciously injected instructions. |
| Approach: | They propose a prompt injection defense method that suppresses the model's instruction-following tendencies rather than suppressing them. |
| Outcome: | The proposed method outperforms prompt-engineering-based approaches and fine-tuning methods and reduces the ASR to nearly 0% in some scenarios. |
Glue pizza and eat rocks - Exploiting Vulnerabilities in Retrieval-Augmented Generative Models (2024.emnlp-main)
Copied to clipboard
| Challenge: | Retrieval-Augmented Generative (RAG) models enhance Large Language Models (LLMs) by integrating external knowledge bases. |
| Approach: | They propose to exploit openness of RAG models by injecting deceptive content into the retrieval database, intentionally changing the model’s behavior. |
| Outcome: | The proposed model can be exploited through crafted content uploads with access to the retriever. |
Poisoning Retrieval Corpora by Injecting Adversarial Passages (2023.emnlp-main)
Copied to clipboard
| Challenge: | Dense retrievers have outperformed traditional lexical methods in a range of information retrieval tasks, but to what extent can they be safely deployed in real-world applications? |
| Approach: | They propose a method where a malicious user injects a small number of adversarial passages into a retrieval corpus to maximize similarity with a set of training queries. |
| Outcome: | The proposed attack fools retrieval systems into returning top results for queries not seen by the attacker. |
False Sense of Security: Why Probing-based Malicious Input Detection Fails to Generalize (2026.findings-acl)
Copied to clipboard
| Challenge: | Recent work has leveraged probing-based approaches to study the separability of malicious and benign inputs in Large Language Models’ internal representations. |
| Approach: | They propose to use probing-based methods to study separability of malicious and benign inputs in LLMs' internal representations to detect harmful and benign content. |
| Outcome: | The proposed methods show that they learn superficial patterns rather than semantic harmfulness. |
Are My Optimized Prompts Compromised? Exploring Vulnerabilities of LLM-based Optimizers (2026.eacl-long)
Copied to clipboard
| Challenge: | Recent studies have focused on poisoning during supervised fine-tuning, RLHF, or inference-time time optimization. |
| Approach: | They propose a simple fake reward attack that requires no access to the reward model and significantly increases vulnerability. |
| Outcome: | The proposed attack reduces the fake reward ASR from 0.23 to 0.07 without degrading utility. |
Efficient but Vulnerable: Benchmarking and Defending LLM Batch Prompting Attack (2025.findings-acl)
Copied to clipboard
| Challenge: | a recent study reveals a significant security vulnerability in batch prompting . malicious users can inject attack instructions into a batch, leading to unwanted interference . |
| Approach: | They construct a batch prompting benchmark and test it against other LLMs to find out if batch prompts are vulnerable. |
| Outcome: | The proposed approach achieves 95% accuracy in detecting attacks. |
AIP: Subverting Retrieval-Augmented Generation via Adversarial Instructional Prompt (2025.emnlp-main)
Copied to clipboard
| Challenge: | Existing RAG attacks rely on manipulating user queries, but exploit instructional prompts to manipulate RAG outputs covertly. |
| Approach: | They propose an attack that exploits adversarial instructional prompts to manipulate RAG outputs . they propose a query generation strategy that simulates realistic linguistic variation in user queries . |
| Outcome: | The proposed attack exploits instructional prompts to manipulate RAG outputs . it achieves up to 95.23% attack success rate while maintaining benign functionality . |