The RAG Paradox: A Black-Box Attack Exploiting Unintentional Vulnerabilities in Retrieval-Augmented Generation Systems (2025.findings-emnlp)
Copied to clipboard
| Challenge: | Existing approaches to degrade retrieval-augmented generation systems rely on unrealistic assumptions in which external attackers have access to internal components such as the retriever. |
| Approach: | They propose a black-box attack based on the RAG paradox, a structural vulnerability that emerges from the system’s effort to enhance trust by revealing both the retrieved documents and their sources to users. |
| Outcome: | The proposed method significantly degrades system performance without internal access while generating natural-looking poisoned documents. |
Similar Papers
Your RAG is Unfair: Exposing Fairness Vulnerabilities in Retrieval-Augmented Generation via Backdoor Attacks (2025.emnlp-main)
Copied to clipboard
Gaurav Bagwe, Saket Sanjeev Chaturvedi, Xiaolong Ma, Xiaoyong Yuan, Kuang-Ching Wang, Lan Emily Zhang
| Challenge: | Retrieval-augmented generation (RAG) enhances factual grounding but introduces new attack surfaces, particularly through backdoor attacks. |
| Approach: | They propose a framework that exposes fairness vulnerabilities in RAG through a two-phase backdoor attack. |
| Outcome: | Empirical results show that BiasRAG achieves high attack success rates while remaining undetectable under standard fairness evaluations. |
The Silent Saboteur: Imperceptible Adversarial Attacks against Black-Box Retrieval-Augmented Generation Systems (2025.findings-acl)
Copied to clipboard
| Challenge: | Existing studies have focused on corpus poisoning, but there are no studies on adversarial attacks on RAG systems. |
| Approach: | They propose a novel imperceptible retrieve-to-generate attack against RAG systems . they propose regenerative reinforcement learning framework that tracks interactions between attacker and target RAG . |
| Outcome: | The proposed framework outperforms existing attacks on factual and non-factual RAG systems with small imperceptible text perturbations. |
RIPRAG: Hack a Black-box Retrieval-Augmented Generation Question-Answering System with Reinforcement Learning (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing methods to generate RAG documents require knowledge of the target RAG system’s internal composition and implementation details, whereas black-box methods are unable to utilize interactive information. |
| Approach: | They propose a RIPRAG attack framework that treats the target RAG system as a black box and leverages a Reinforcement Learning from Black-box Feedback (RLBF) method to optimize the generation model for poisoned documents. |
| Outcome: | The proposed method achieves an attack success rate (ASR) improvement of up to 0.72 compared to baseline methods. |
Token-Level Precise Attack on RAG: Searching for the Best Alternatives to Mislead Generation (2026.findings-eacl)
Copied to clipboard
| Challenge: | Existing approaches to attack large language models rely heavily on retrieval and generation stages, limiting their effectiveness in black-box scenarios. |
| Approach: | They propose a retrieval-augmented generation framework that leverages a white-box LLM as an attacker to generate and iteratively optimize malicious passages at the token level. |
| Outcome: | The proposed framework outperforms existing approaches in retrieval-stage and end-to-end attacks on black-box RAG systems. |
Glue pizza and eat rocks - Exploiting Vulnerabilities in Retrieval-Augmented Generative Models (2024.emnlp-main)
Copied to clipboard
| Challenge: | Retrieval-Augmented Generative (RAG) models enhance Large Language Models (LLMs) by integrating external knowledge bases. |
| Approach: | They propose to exploit openness of RAG models by injecting deceptive content into the retrieval database, intentionally changing the model’s behavior. |
| Outcome: | The proposed model can be exploited through crafted content uploads with access to the retriever. |
One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems (2025.findings-emnlp)
Copied to clipboard
Zhiyuan Chang, Mingyang Li, Xiaojun Jia, Junjie Wang, Yuekai Huang, Ziyou Jiang, Yang Liu, Qing Wang
| Challenge: | Existing knowledge poisoning attacks against RAG systems require multiple poisoned documents or can only function effectively on simplistic queries. |
| Approach: | They propose a more realistic knowledge poisoning attack that poisons only a single document while remaining effective for complex multi-hop questions involving complex relationships between multiple elements. |
| Outcome: | The proposed attack achieves success by poisoning only a single document while remaining effective for complex multi-hop questions involving complex relationships between multiple elements. |
Does RAG Introduce Unfairness in LLMs? Evaluating Fairness in Retrieval-Augmented Generation Systems (2025.coling-main)
Copied to clipboard
| Challenge: | Retrieval-Augmented Generation (RAG) models address fairness concerns with respect to sensitive attributes such as gender, geographic location, and other demographic factors. |
| Approach: | They propose a framework to evaluate fairness in RAG using scenario-based questions and analyzing disparities across demographic attributes. |
| Outcome: | The proposed framework analyzes disparities across demographic attributes and identifies fairness issues in retrieval and generation stages. |
Open Schrödinger’s Closed Box: Identifying Retrieval Augmented Generation in API-Accessible Large Language Model Services (2026.acl-long)
Copied to clipboard
| Challenge: | Large language models (LLMs) are powerful at question-answering but prone to hallucinations due to limited domain-specific or up-to-date knowledge. |
| Approach: | They propose a framework for IDentifying RAG properties in LLM services that integrates LLMs with retrieval systems and adds an external retriever and knowledge database to mitigate hallucinations. |
| Outcome: | The proposed framework detects RAG-enhanced LLMs with 99.97% accuracy with partial or no optional knowledge and nearly 100% when the LLM and database are known. |
Retrievals Can Be Detrimental: Unveiling the Backdoor Vulnerability of Retrieval-Augmented Diffusion Models (2026.acl-long)
Copied to clipboard
| Challenge: | Retrieval-augmented diffusion models (RDMs) have been developed to enhance performance with reduced parameters. |
| Approach: | They propose to integrate retrieval-augmented diffusion models with Retrieval-augmented generation (RAG) that enhances performance with reduced parameters. |
| Outcome: | The proposed framework achieves outstanding attack effects while maintaining benign utility. |
EcoSafeRAG: Efficient Security through Context Analysis in Retrieval-Augmented Generation (2025.findings-emnlp)
Copied to clipboard
| Challenge: | Existing defense methods rely on internal knowledge of the model, which conflicts with the design concept of Retrieval-Augmented Generation (RAG). |
| Approach: | EcoSafeRAG uses sentence-level processing and bait-guided context diversity detection to identify malicious content . |
| Outcome: | EcoSafeRAG uses sentence-level processing and bait-guided context diversity detection to identify malicious content. |