{"id":"2fdd5603-5141-45ca-a449-a6a1fb0fdf21","arxiv_id":"2510.02964","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"SECRET, an adaptive RAG extraction attack that fuses LLM-optimized jailbreak prompts with cluster-guided queries, extracts large portions of private databases from commercial and open LLMs, including ~35% of a sampled corpus from Claude 3.7 Sonnet.","lead":"Researchers show a black-box attacker can pull private documents out of retrieval-augmented LLMs by optimizing a jailbreak prompt and steering queries cluster by cluster. Their SECRET attack extracts roughly a third of a 1,000-document private database from Claude 3.7 Sonnet, where prior attacks extracted nothing.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Head-to-head superiority claim rests on modified/reimplemented baselines; the '0% vs 35%' margin may not reflect published attacks.","rationale":"I read the paper as a well-scoped empirical attack paper whose headline is: SECRET beats all prior EDEAs and extracts ~35% of a 1,000-document private RAG database powered by Claude 3.7 Sonnet, where previous attacks yield 0%. The strongest independent support is the control showing 0% extraction against bare LLMs, the ablation isolating the jailbreak component, and the robustness checks over templates, encoders, thresholds, and system-prompt defenses. The reader's weakest assumption focuses on whether the lab instantiation transfers to production RAG deployments with output filtering or access control. My concern is one step earlier: the comparative evidence itself — the 'outperforms previous attacks' claim — is built on baseline variants that are explicitly modified or reimplemented in Appendix B-A, with no released code or data to check fidelity. This does not make the paper's attack implausible; it makes the head-to-head margin unverified as presented. The right remedy is release and an independent rerun of unmodified baselines. That keeps the reader's CONDITIONAL verdict: the central finding is credible but not fully verifiable until artifacts and baseline fidelity are addressed. I do not see a fatal technical flaw, and I would not move the verdict to REJECT.","tokens_in":37099,"tokens_out":12248,"duration_ms":124423,"concrete_test":"Obtain (or have the authors release) the original implementations of Qi et al., Zeng et al., Cohen et al., and Jiang et al. Run each unmodified on the same Section V-A setup: 1,000-document HealthcareMagic-101 sample, bge-large-en-v1.5 retriever, k=10, the five RAG templates, and Claude 3.7 Sonnet with and without the defensive system prompt. Compute RR, ER-TMQ, and MER using the paper's metrics. If any unmodified baseline achieves non-negligible extraction (e.g., MER > 5%) against Claude, the '0% vs 35%' headline overstates SECRET's advantage; if all remain near 0%, the comparative claim is supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central comparative claim — Section V Takeaway 3 and the abstract's 'whereas other attacks yield 0% extraction' — depends on the baselines being faithful implementations of prior attacks. Appendix B-A states that all baselines were 'combined with our base extraction instruction p_e' because 'their original extraction prompts proved ineffective in our setup'; Jiang et al.'s RAG-Thief was reimplemented from the paper description since no code is public; Cohen et al.'s original prompt was replaced while keeping the Wormy template; and GCG-Leak is an adapted baseline using a LLaMA2-7B surrogate. Consequently, Tables II/III/IX report modified variants, not the attacks as published. Replacing a baseline's extraction instruction with SECRET's instruction can strengthen or weaken that baseline, and a from-description reimplementation can easily miss a critical detail. The 35% Claude figure may still be correct, but the 'significantly outperforms previous attacks' claim is not established by these tables until the baselines are run as originally released. This is a fair-comparison and reproducibility concern, not an internal inconsistency.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper formalizes external data extraction attacks (EDEAs) against retrieval-augmented LLMs, decomposing attacks into extraction instruction, jailbreak operator, and retrieval trigger; proposes SECRET, combining LLM-driven jailbreak-prompt optimization with cluster-focused triggering (CFT); and evaluates SECRET across 4 LLMs (Claude 3.7 Sonnet, Gemini 2.0 Flash, GPT-4o mini, DeepSeek-V3), 2 datasets, and 2 defense settings. The main claimed findings are that SECRET outperforms five prior/adapted EDEA baselines, extracts up to 34-36% of documents from a 1000-document RAG database even against safety-aligned commercial models, and that CFT enjoys a formal query-efficiency advantage over non-adaptive global exploration. The paper also studies several defenses, showing that simple system-prompt defenses and similarity-threshold defenses are insufficient to stop SECRET.","tokens_in":37349,"tokens_out":6171,"duration_ms":55668,"significance":"If the empirical claims hold, the paper would be a substantial contribution: it provides the first systematic decomposition of EDEAs, a scalable attack that defeats state-of-the-art aligned LLMs in a black-box RAG setting, and broad evidence that existing defenses are inadequate. The strength of the paper is its breadth: 16 RAG instances, two sensitive datasets, an additive ablation isolating each component, robustness checks across embedding mismatches and RAG templates, and evaluation of several defenses. The design of SECRET is also plausible and well-motivated, especially the curriculum-based jailbreak optimization and the alternating GE/LE trigger strategy. However, the paper's comparative claim depends on modified or reimplemented baselines, and the formal analysis of CFT contains gaps. These issues affect the headline 'significantly outperforms previous attacks' and the claimed proof of CFT's advantage, so the significance is currently conditional on revisions.","major_comments":[{"comment":"The head-to-head comparison is not against the attacks as published. Appendix II-A states that all baselines were 'combined with our base extraction instruction pe' because their original prompts were ineffective; Jiang et al.'s RAG-Thief was reimplemented from a paper description; Cohen et al.'s original prompt was replaced; and GCG-Leak is an adapted baseline using a LLaMA2-7B surrogate. The abstract's 'significantly outperforms previous attacks' and the specific '0% vs 35%' against Claude 3.7 are therefore comparisons to modified variants, and the 0% could be an artifact of the modifications. Please run the original released attacks if code is available, or otherwise clearly report both original-version and modified-version results, and temper the superiority claim to what the experiments actually support.","section":"Appendix II-A and Tables II/III/VIII/IX"},{"comment":"The theorem asserts a unique threshold Q* at which CFT strictly outperforms GE, but the proof requires an unstated condition. Monotonicity of G' across breakpoints is established only when Eq. (13) holds, and the appendix itself notes that one must choose b so that Δ_dec ≳ c(b). Without that condition, uniqueness of the crossing is not proved. In addition, L_CFT(Q) is never explicitly defined; the statement that it is piecewise linear with non-decreasing slope is not reconciled with the cycle structure, and the proof compares bounds (U_GE, L_CFT) without formalizing the expectations D_GE, D_CFT. As written, the formal analysis does not establish the claimed advantage. Please repair the proof, state the theorem with all needed conditions, or downgrade the claim to a heuristic supported by the empirical comparisons.","section":"Appendix A, Theorem I.1"},{"comment":"MER is defined at k×TMQ with k=3, chosen 'empirically' because extraction has 'largely converged.' This penalizes slower-converging baselines and is circular when the convergence behavior is itself the property being compared. Report extraction-rate curves at multiple budgets (e.g., k=3,5,10) or use a budget-independent measure such as area under the extraction curve. The paper also reports no confidence intervals or repeated-seed variation for any table, despite the stochasticity of LLM optimization and retrieval; please add multiple runs or bootstrap CIs for the headline numbers.","section":"Section V-A, MER metric"},{"comment":"Takeaway 3 and the abstract attribute the 35% Claude result to SECRET being 'highly effective against all 16 tested RAG instances.' This is supported by Tables II/III, but the case study in Appendix IV-D shows that the adapted generic jailbreaks (PAP, LLM-Fuzzer, PLeak) fail against Claude; those results are useful, but they are not published EDEA attacks and should not be used as evidence that SECRET outperforms all prior task-specific attacks. The central limitation remains the baseline fairness issue raised above.","section":"Section V-B and Appendix IV-D"}],"minor_comments":[{"comment":"The body text uses inconsistent appendix labels: Section II-A refers to 'Appendix V' (there is no Appendix V; the confidentiality discussion is Appendix E), and Section IV-C refers to 'Appendix IV-D' while the actual appendix is labeled D. Please harmonize the appendix numbering throughout.","section":"Appendix references"},{"comment":"The symbol k is used both for the number of retrieved documents per query and for the MER query-budget multiplier k×TMQ. This can confuse the reader, especially in Section V-A and Figure 3. Consider renaming one of them (e.g., K_r for retrieved count and m for the multiplier).","section":"Notation conflict"},{"comment":"In the transferability matrix, the GPT-4o mini row appears to contain five symbols (✗ ✔ ✗ ✔ ✔) while the header expects four columns; the row should be corrected. Table X is also not referenced in the main text; please add a pointer in Section V or Appendix IV-C.","section":"Table X"},{"comment":"The proof of the query-complexity bound assumes a BFS-like branching factor k on the δmax-adjacency graph, but no argument is given that queries generated by the LE operator correspond to edges of this graph or that the graph diameter bound is achievable with the specific LLM-based fshift. Please state these as assumptions explicitly.","section":"Appendix A, Lemma I.1"},{"comment":"The retriever similarity threshold τ in Figure 5 and Appendix II-D is notationally identical to the normalized Levenshtein threshold τ in Definition III.1, but they are different quantities. Please use distinct symbols (e.g., ρ for the retriever threshold).","section":"Section VI-B, threshold naming"}],"recommendation":"major_revision","confidential_remarks":"The empirical study is broad and the attack is plausible, but the central comparative claim needs to be placed on fair ground with original baselines. The formal CFT theorem should be fixed or explicitly demoted to a heuristic. I would support acceptance after these revisions; releasing code and artifacts would also substantially increase confidence in the results."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper is worth a read for the framework: formalizing EDEAs as three components (extraction instruction, jailbreak operator, retrieval trigger) is a real contribution, and it cleanly places prior attacks as instances. The SECRET design is also genuinely new in this space — using an LLM as an optimizer to discover jailbreaks for verbatim extraction, and coupling that with cluster-focused triggering. The ablation (Table IV) shows each piece earns its keep, and the transferability and robustness checks are useful. If the headline Claude 3.7 number (35% extraction where others get 0%) holds up, it is an important data point for anyone running RAG with private data.\n\nThe soft spots are mostly about the comparative claims. The paper is honest in Appendix B-A that all baselines were combined with the authors' base extraction instruction, that Jiang et al. was reimplemented from a description without code, and that Cohen et al.'s prompt was swapped for the base one. That means Tables II/III/IX do not directly compare against the attacks as published. The '0% vs 35%' margin on Claude is specifically a comparison against those modified variants, not necessarily against the original RAG-Thief or Wormy attacks. This is a fair-comparison problem, not an internal contradiction, but it tempers the abstract's 'significantly outperforms' claim. Also missing: code and data, confidence intervals, and an explanation of why MER is fixed at k=3 rather than reported as a curve. The formal theorem in Appendix I is fine as an idealized statement about CFT vs GE under cluster-separation assumptions, but those assumptions aren't connected to real embedding spaces, so it should be read as motivation, not evidence.\n\nWho benefits: people building or defending real RAG systems, and researchers working on LLM data extraction. The framework alone makes it a useful reference.\n\nBottom line: send it to peer review, but the review should push for original baselines (or at least both versions), code/data release, and error bars. The core attack is credible; the comparison is not yet clean.","headline":"A genuinely useful framework and a clever attack, but the 'beats all baselines' claim is not established as stated because the baselines were modified.","tokens_in":37858,"tokens_out":2009,"would_cite":true,"duration_ms":26148,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A black-box attacker can extract a large fraction of a private RAG knowledge base, even when the backend LLM is safety-aligned and told not to disclose.","keywords":["retrieval-augmented generation","external data extraction attack","jailbreak prompt optimization","cluster-focused triggering","black-box privacy attack","prompt injection","LLM data leakage","RAG security"],"falsifier":"Run SECRET against the same RAG setup but with an output-side guard that blocks any response whose ROUGE-L or semantic similarity to the retrieved documents exceeds a threshold, both with and without light obfuscation; if extraction still approaches 35% of a 1,000-document database, the threat is real, but if it drops to the level of prior attacks, the paper's headline result depends on the absence of output filtering.","tokens_in":36982,"feed_emoji":"🔓","tokens_out":5706,"duration_ms":46053,"temperature":0.7,"pith_summary":"This paper argues that retrieval-augmented generation (RAG) systems, which let an LLM answer from a private knowledge base, are vulnerable to a practical black-box data-extraction attack. The authors formalize these attacks as having three components—an extraction instruction, a jailbreak operator, and a retrieval trigger—and show that prior attacks, which strengthen only one or two of these, fail against safety-aligned commercial models. They then build SECRET, which uses an LLM-driven optimizer to generate a natural jailbreak prompt and alternates broad exploration with local semantic exploitation to find new documents efficiently. Across 16 RAG instances built on four models, SECRET extracts roughly a third to a half of a 1,000-document private database, including 35% from a RAG powered by Claude 3.7 Sonnet where all prior attacks extracted 0%. If correct, the default RAG deployment—a dense retriever, top-10 context, no output filtering—offers little privacy protection, and defenders need output-side guards, access control, or stricter retrieval thresholds.","feed_headline":"New attack extracts 35% of private RAG data; prior attacks got 0%","feed_subtitle":"A black-box user can force even a safety-aligned LLM to spill its retrieved knowledge base verbatim.","key_machinery":"The load-bearing object is SECRET's two-phase pipeline. Phase one is an adaptive jailbreak-prompt optimizer: an optimizer LLM proposes candidate prompts, an evaluator LLM scores them by whether the target model repeats retrieved documents verbatim, and only the best candidate enters a score-sorted history, with curriculum seeding from weaker models for heavily aligned targets. Phase two is cluster-focused triggering (CFT), which alternates global exploration (random natural-text chunks as triggers) with local exploitation (LLM-fused semantic shifts of discovered documents) to navigate embedding space and surface new documents. The framework's conceptual move is decomposing any EDEA query int","core_discovery":"The paper claims that external data extraction from retrieval-augmented LLMs is a realistic black-box threat: an attacker who only submits prompts and reads responses can extract a large fraction of a private knowledge base verbatim, even when the backend model is safety-aligned and the system prompt forbids disclosure. Prior attacks fail, the paper argues, because they strengthen only one piece of the puzzle; a successful attack must simultaneously force the retriever to surface unextracted documents and force the generator to repeat them verbatim. SECRET does this with an LLM-driven jailbreak-prompt optimizer and cluster-focused triggering. Across 16 RAG instances on four models it reaches","pith_inferences":["A natural next step the paper leaves implicit is that defenders should focus on output-side filtering, per-document access control, rate limits, and response monitoring rather than prompt wording alone.","Cluster-focused triggering could generalize to other high-dimensional search problems, such as membership inference or dataset auditing, where global distance metrics are uninformative but local cluster structure persists.","The 35% figure should be read as a lower bound under adversarial conditions; real deployments with logging, anomaly detection, and query budgets could blunt or detect the attack, and testing under those operational constraints is a concrete extension.","The formal advantage proof assumes idealized cluster geometry; the Enron experiments suggest the advantage shrinks when documents are short and unstructured, so real database clustering quality is the key contingency."],"forward_implications":["If SECRET works as reported, any RAG service that returns unmoderated LLM output can be drained of a large fraction of its knowledge base by a black-box user, with no knowledge of the retriever, system prompt, or database contents.","Simple system-prompt 'do not repeat' defenses are insufficient; the attack adapts its jailbreak prompt to bypass them, and generic jailbreak or prompt-stealing methods fail where SECRET succeeds.","Optimized jailbreak prompts transfer across models to a useful degree, so an attacker can optimize on a weaker model and still attack stronger commercial systems effectively.","Retrieval similarity thresholds reduce extraction but do not stop it; the paper measures 24.6% extraction even when about half of relevant documents are filtered out, implying a privacy–utility trade-off.","Because extraction is verbatim, the attack is a direct exfiltration path for medical records, financial data, and internal documents in customized RAG deployments."],"fun_headline_variants":["RAG data breach: SECRET attack extracts 35% from Claude 3.7","Black-box attack rips 35% of private RAG data, prior: 0%","New attack siphons 35% of RAG knowledge base, besting all","SECRET: first to leak 35% of RAG data where others got 0%"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The headline numbers assume the target RAG deployment matches the lab setup: a dense retriever returning a few documents into the context, an API that returns the LLM's full unmoderated response, and no output-side filtering, per-document access control, or authentication—if production systems add any of those, the extraction rates do not automatically transfer.","fun_headline_variants_meta":{"raw":{"variants":["RAG data breach: SECRET attack extracts 35% from Claude 3.7","Black-box attack rips 35% of private RAG data, prior: 0%","New attack siphons 35% of RAG knowledge base, besting all","SECRET: first to leak 35% of RAG data where others got 0%"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00018,"raw_usage":{"total_tokens":1198,"prompt_tokens":859,"completion_tokens":339,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":603,"completion_tokens_details":{"reasoning_tokens":243}},"tokens_in":603,"tokens_out":339,"duration_ms":4861,"temperature":1.0,"reasoning_tokens":243,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-04T12:38:15.271770+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run SECRET against the same RAG setup but with an output-side guard that blocks any response whose ROUGE-L or semantic similarity to the retrieved documents exceeds a threshold, both with and without light obfuscation; if extraction still approaches 35% of a 1,000-document database, the threat is real, but if it drops to the level of prior attacks, the paper's headline result depends on the absence of output filtering.","supporting_citations":[],"review_version":1}