One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems (2025.findings-emnlp)
Copied to clipboard
Zhiyuan Chang, Mingyang Li, Xiaojun Jia, Junjie Wang, Yuekai Huang, Ziyou Jiang, Yang Liu, Qing Wang
| Challenge: | Existing knowledge poisoning attacks against RAG systems require multiple poisoned documents or can only function effectively on simplistic queries. |
| Approach: | They propose a more realistic knowledge poisoning attack that poisons only a single document while remaining effective for complex multi-hop questions involving complex relationships between multiple elements. |
| Outcome: | The proposed attack achieves success by poisoning only a single document while remaining effective for complex multi-hop questions involving complex relationships between multiple elements. |
Similar Papers
Knowledge Poisoning Attacks on Medical Multi-Modal Retrieval-Augmented Generation (2026.acl-long)
Copied to clipboard
Peiru Yang, Haoran Zheng, Tong Ju, Shiting Wang, Wanchun Ni, Jiajun Liu, Shangguang Wang, Yongfeng Huang, Tao Qi
| Challenge: | Existing studies have investigated knowledge poisoning attacks in medical RAG systems . knowledge poison attacks can disrupt model outputs and undermine system reliability . |
| Approach: | They propose a knowledge poisoning framework that injects misinformation into textual data . they propose to use paired visual data as a query-agnostic trigger to promote retrieval . |
| Outcome: | The proposed framework produces clinically plausible but incorrect generations on five LLMs and datasets. |
RevPRAG: Revealing Poisoning Attacks in Retrieval-Augmented Generation through LLM Activation Analysis (2025.findings-emnlp)
Copied to clipboard
| Challenge: | Retrieval-Augmented Generation (RAG) enriches the input to LLMs by retrieving information from the relevant knowledge database. |
| Approach: | They propose to use a knowledge database to enrich the input of LLMs by retrieving information from the relevant knowledge database. |
| Outcome: | The proposed approach can achieve 98% true positive rate while maintaining a false positive rate close to 1%. |
Open Schrödinger’s Closed Box: Identifying Retrieval Augmented Generation in API-Accessible Large Language Model Services (2026.acl-long)
Copied to clipboard
| Challenge: | Large language models (LLMs) are powerful at question-answering but prone to hallucinations due to limited domain-specific or up-to-date knowledge. |
| Approach: | They propose a framework for IDentifying RAG properties in LLM services that integrates LLMs with retrieval systems and adds an external retriever and knowledge database to mitigate hallucinations. |
| Outcome: | The proposed framework detects RAG-enhanced LLMs with 99.97% accuracy with partial or no optional knowledge and nearly 100% when the LLM and database are known. |
PRA-RAG: Provably Robust Aggregation in Retrieval-Augmented Generation against Retrieval Corruption (2026.findings-acl)
Copied to clipboard
Xue Tan, Yi Zheng, Chang Huo, Yunruo Zhang, Yu Liu, Hao Luan, Zhuyang Yu, Jun Dai, Xiaoyan Sun, Ping Chen
| Challenge: | Existing defense mechanisms lack theoretical robustness guarantees and perform unreliably when the LLM has limited knowledge of the retrieved content. |
| Approach: | They propose a provably robust retrieval aggregation algorithm designed to defend against poisoning attacks on retrieved texts. |
| Outcome: | Experiments show that PRA-RAG reduces the attack success rate to as low as 1% while maintaining an accuracy of 71%, significantly outperforming representative state-of-the-art (SOTA) methods. |
Glue pizza and eat rocks - Exploiting Vulnerabilities in Retrieval-Augmented Generative Models (2024.emnlp-main)
Copied to clipboard
| Challenge: | Retrieval-Augmented Generative (RAG) models enhance Large Language Models (LLMs) by integrating external knowledge bases. |
| Approach: | They propose to exploit openness of RAG models by injecting deceptive content into the retrieval database, intentionally changing the model’s behavior. |
| Outcome: | The proposed model can be exploited through crafted content uploads with access to the retriever. |
LLM-Generated Text May Harm Your Retrieval! A Robust Detection Strategy for Retrieval-Augmented Generation (2026.acl-long)
Copied to clipboard
| Challenge: | Retrieval-augmented generation (RAG) improves accuracy and timeliness of large language models, but external corpora may become contaminated with LLM-generated texts. |
| Approach: | They propose a method that integrates external knowledge retrieved from external sources into RAG to filter out LLM-generated texts from retrieved results. |
| Outcome: | The proposed method mitigates performance degradation and improves stability of RAG systems. |
RIPRAG: Hack a Black-box Retrieval-Augmented Generation Question-Answering System with Reinforcement Learning (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing methods to generate RAG documents require knowledge of the target RAG system’s internal composition and implementation details, whereas black-box methods are unable to utilize interactive information. |
| Approach: | They propose a RIPRAG attack framework that treats the target RAG system as a black box and leverages a Reinforcement Learning from Black-box Feedback (RLBF) method to optimize the generation model for poisoned documents. |
| Outcome: | The proposed method achieves an attack success rate (ASR) improvement of up to 0.72 compared to baseline methods. |
MM-PoisonRAG: Disrupting Multimodal RAG with Local and Global Knowledge Poisoning Attacks (2026.acl-long)
Copied to clipboard
Hyeonjeong Ha, Qiusi Zhan, Jeonghwan Kim, Dimitrios Bralios, Saikrishna Sanniboina, Nanyun Peng, Kai-Wei Chang, Daniel Kang, Heng Ji
| Challenge: | Existing research exposes multimodal large language models to knowledge poisoning attacks . localized poisoning attack achieves up to 56% success rate even under restricted access . globalized poison attack completely disrupts model generation to 0% accuracy with just one poisoned content. |
| Approach: | They propose a framework to study the vulnerability of multimodal RAG under knowledge poisoning attacks. |
| Outcome: | The proposed framework exploits two new attack strategies on multimodal RAGs under knowledge poisoning. |
Token-Level Precise Attack on RAG: Searching for the Best Alternatives to Mislead Generation (2026.findings-eacl)
Copied to clipboard
| Challenge: | Existing approaches to attack large language models rely heavily on retrieval and generation stages, limiting their effectiveness in black-box scenarios. |
| Approach: | They propose a retrieval-augmented generation framework that leverages a white-box LLM as an attacker to generate and iteratively optimize malicious passages at the token level. |
| Outcome: | The proposed framework outperforms existing approaches in retrieval-stage and end-to-end attacks on black-box RAG systems. |
The RAG Paradox: A Black-Box Attack Exploiting Unintentional Vulnerabilities in Retrieval-Augmented Generation Systems (2025.findings-emnlp)
Copied to clipboard
| Challenge: | Existing approaches to degrade retrieval-augmented generation systems rely on unrealistic assumptions in which external attackers have access to internal components such as the retriever. |
| Approach: | They propose a black-box attack based on the RAG paradox, a structural vulnerability that emerges from the system’s effort to enhance trust by revealing both the retrieved documents and their sources to users. |
| Outcome: | The proposed method significantly degrades system performance without internal access while generating natural-looking poisoned documents. |