{"id":"1c56e4ba-e3ef-40d0-9448-cf15173c10d2","arxiv_id":"2603.03919","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"TabooRAG crafts a single adversarial document on a surrogate model that transfers across black-box RAG systems, causing many modern LLMs to refuse benign queries and reaching 96% ASR on GPT-5.2/HotpotQA.","lead":"This paper introduces TabooRAG, an attack that makes RAG systems refuse to answer harmless questions by injecting one specially written document into the knowledge base. The attack works because modern safety-aligned AI models share overlapping refusal rules, so a document built on one model often works on an unseen target model.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"In-sample strategy-library reuse likely inflates the headline ASR; the reported transfer numbers are not a cold-start measure of a one-shot attack.","rationale":"The reader's stated weakest assumption is that the three hand-selected strategy preferences (Physical Harm, Social Bias, Compliance Risk) span all target refusal criteria. That is a generalization concern and is partially addressed by the broad model set. A more load-bearing issue is the evaluation protocol for the strategy library: the library is constructed and evaluated on the same query set, so the reported ASR conflates single-shot transfer with warm-start reuse of prior successes on the same distribution. This directly affects the headline numbers and the strength of the central claim. I still credit the paper's independent support: human verification of the refusal judge (Appendix E.3) shows low error, the representation-engineering analysis in Appendix B provides a mechanistic illustration, and the cross-template/top-k robustness checks are useful. However, no code or data are released, and the abstract/full-text inconsistency (nine vs seven LLMs, missing 67.3%) further reduces confidence in the exact figures. The in-sample library concern is concrete and testable; it does not warrant rejection, but it keeps the verdict conditional pending a cold-start or held-out-library rerun.","tokens_in":25579,"tokens_out":7884,"duration_ms":99378,"concrete_test":"Re-run the main evaluation in strict cold-start mode: either reset the strategy library to empty for every query, or build the library on a disjoint set of queries and never update it with strategies from the 150 evaluation queries. Compare the resulting ASR against Table 1. If HotpotQA GPT-5.2 ASR drops by more than about 10 points, or if TabooRAG no longer exceeds all baselines, the headline transferability is substantially attributable to in-sample library reuse rather than to single-document alignment-homogeneity transfer.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The method's query-aware strategy library is initialized empty and populated during the same 150-query evaluation run: Algorithm 1 (lines 13-15) adds a successful strategy to L, and later queries retrieve those strategies as warm starts via Eq. (2). Thus the ASR reported in Table 1 aggregates cold-start queries (early in the run) with warm-start queries (later in the run) that benefit from strategies discovered on the very same test set. Figure 2 shows the library lifts surrogate optimization success from roughly 48-53% to 94-98%, and Table 6 shows warm-start improves transferred ASR by 8.9-19.1 percentage points. Since the paper's central claim is that an attacker can generate a single blocking document per query and directly transfer it to an unknown target, the evaluation must separate the intrinsic transferability of the document from the transferability of previously learned strategies on the same query distribution. As reported, the headline 96.1% ASR on GPT-5.2 (HotpotQA) may substantially reflect in-sample library reuse rather than the single-document, cold-start attack. This does not invalidate the mechanism, but it means the strength of the central claim is not yet cleanly established.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes TabooRAG, a transferable blocking attack against RAG systems. The attacker constructs a single blocking document per query in a surrogate RAG environment, using an attacker LLM to fabricate query-relevant restricted risk context that triggers safety-aligned refusal, and then transfers the document to an unknown black-box target RAG system. A query-aware strategy library stores successful strategies and retrieves them as warm starts for similar queries. The paper reports experiments on three BEIR datasets (NQ, MS-MARCO, HotpotQA) and seven target LLMs, claiming state-of-the-art ASR with up to 96.1% on GPT-5.2 (HotpotQA), stable cross-model transferability, low optimization cost, and limited effectiveness of PPL filtering, paraphrasing, and Prompt-Guard defenses.","tokens_in":25863,"tokens_out":5837,"duration_ms":66239,"significance":"If the transfer claim holds, the paper identifies a practically relevant denial-of-service vulnerability: standardized safety alignment across LLMs creates a shared, transferable attack surface in RAG. The work is timely and the attack surface is novel relative to suffix-based or instruction-injection attacks, which the paper shows degrade on modern models. Strengths include multi-model and multi-dataset experiments, human-verified judge labels with low error rates (Appendix E.3), ablations on attacker LLM and surrogate retriever, a cost analysis showing orders-of-magnitude fewer LLM calls than Jamming Attack, and representation-engineering evidence (Appendix B) connecting the attack to refusal-direction activations. However, the central quantitative claim — that a single document generated against an unknown target transfers without target access — is undermined by three experimental design choices: in-sample strategy-library reuse, same-model contamination for the GPT-5.2 headline, and exclusion of no-attack refusals from the ASR denominator. These are fixable and do not invalidate the core mechanism, but they must be addressed before the strength of the claim is established.","major_comments":[{"comment":"The reported ASR aggregates cold-start and warm-start queries because the strategy library is initialized empty and populated during the same 150-query evaluation run. Algorithm 1 (lines 13–15) adds successful strategies during the run, and later queries retrieve them via Eq. (2). Figure 2 shows the library lifts surrogate optimization success from roughly 48–53% to 94–98%, and Table 6 shows warm-start improves transferred ASR by 8.9–19.1 percentage points. The paper's central claim is a single-document, cold-start transfer to an unknown target; the headline numbers in Table 1 are therefore not a clean measure of that claim. Please report cold-start transfer ASR (e.g., library empty or built on a disjoint query set), and separate early vs. late queries in the evaluation.","section":"Section 5.2, Table 1; Algorithm 1 (lines 13–15); Eq. (2)"},{"comment":"The default attacker and judge LLM is GPT-5.2, and GPT-5.2 is also a target model. For the headline 96.1% ASR on GPT-5.2 (HotpotQA), the attacker uses GPT-5.2 itself to generate documents and to judge refusals; this is not a transfer to an unknown target and is inconsistent with the strict black-box claim in Section 3. The result may reflect same-model familiarity rather than alignment homogeneity. Please report GPT-5.2-target results with a non-GPT-5.2 attacker/judge, or exclude same-model pairs from the headline. Table 2 partially addresses this with cross-model transfer, but the main ASR table does not.","section":"Section 5.1 Implementation Details; Table 1"},{"comment":"ASR for blocking attacks excludes queries that the LLM fails to answer under the no-attack condition. The no-attack refusal rate is not reported. If the base refusal rate is non-negligible, the reported 'blocking' success partly reflects pre-existing over-refusal. Please report the no-attack refusal rate per target model and dataset, and report an absolute blocking rate (e.g., ASR minus no-attack refusal rate) or the raw fraction of all queries blocked. This is necessary to interpret the 77–96% figures.","section":"Section 5.1 Metric; Table 1"}],"minor_comments":[{"comment":"The abstract says 'nine LLMs' but the evaluation includes seven target LLMs; the attacker/judge models are also LLMs. Please clarify the count to avoid confusion.","section":"Abstract and Section 5.1"},{"comment":"The figure is hard to read: the two-panel layout and overlaid lines/labels are dense. Please separate the OSR plot and the iteration count plot, and label the strategies condition more clearly.","section":"Figure 2"},{"comment":"The bold-face rule 'exceeding all baselines in Table 1' is not visually consistent across entries; some entries that appear not bold may satisfy the rule. Please check the typesetting.","section":"Table 2"},{"comment":"The refusal-direction construction uses a Weighted Mean Difference, but the notation is slightly unclear (e.g., the definition of v^(l) versus v_refuse). Please define all symbols and clarify the layer-selection step.","section":"Appendix B, Eq. (7)–(8)"},{"comment":"The preference-distribution analysis uses only three hand-selected categories. This is fine for the experiments, but the claim of 'alignment homogeneity' would be strengthened by also reporting consistency across models for the NQ and HotpotQA distributions, not just MS-MARCO.","section":"Section 6, Figure 3"}],"recommendation":"major_revision","confidential_remarks":"The most serious issue is the same-model contamination for GPT-5.2: with GPT-5.2 as attacker and judge and also as target, the headline 96.1% does not support the 'unknown target' claim. The in-sample library reuse is related and also needs a clean cold-start measurement. I would encourage the editor to request a revised version that separates cold-start transfer from warm-start and reports no-attack refusal rates; the core idea is interesting and likely salvageable."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know before you read it. The attack idea is genuinely new: actively fabricating query-specific \"restricted risk context\" on a surrogate model and transferring a single document to a black-box target RAG with zero target feedback. And the headline 96.1% ASR is inflated, because the query-aware strategy library fills up during the same 150-query evaluation run (Algorithm 1, lines 13-15), so Table 1 mixes cold-start queries with later ones warm-started by strategies discovered on the same test set. The paper is transparent about the library's value—Figure 2 shows optimization success climbing from ~50% to ~96%, Table 6 shows warm start adding 8.9-19.1 ASR points—but never reports the cold-start version of the headline. A cold-start column or an evaluation with a library built on disjoint queries is required before the \"single blocking document per query\" claim is clean. My read: the attack would still clear every baseline cold, since even the cold-start numbers in Table 6 (44-61%) beat all Table 1 baselines bar none, so this is a fixable measurement problem, not a broken mechanism.\n\nWhat's good. It's the first blocking attack that weaponizes over-refusal into a transferable, single-document attack, going beyond the passive OR-Bench/COVER/XSTest line. Strict black-box, no target probing—a real step past Jamming. Evaluation is unusually thorough: seven LLMs, three datasets, ablations, robustness to gold docs/top-k/templates, and human-verified judge labels (FP 1.14%, FN 0.59%), which is genuine evidence the metric is sound. The defense results are honest: PPL, paraphrasing, and Prompt-Guard all fail.\n\nSoft spots beyond the library. ASR excludes no-attack refusals but no-attack rates are never reported, so the marginal effect is unclear; show the denominator. The judge LLM doubles as a target model; human verification cushions, but a separate judge would be cleaner. The \"alignment homogeneity\" explanation is inferred largely from the very transfer results it explains; Figure 3's preference analysis helps but isn't fully independent. The manuscript is a rough draft: abstract says nine LLMs, body says seven; the abstract's 67.3% relative-gain figure never appears in the body; the author list has a \"Bob Simons\" at an outlook.com address; the ACM template still says Conference'17; no code or data either, which matters here because the library confound needs re-running to settle. All fixable hygiene. The weakest substantive assumption—three hand-picked strategy preferences spanning every model's refusal taxonomy—is real but cushioned by the seven-model transfer evidence.\n\nThis is a RAG-security/alignment paper for both communities, and it deserves serious referee time, conditional on a cold-start evaluation and the consistency fixes. I'd want the revision; the preprint as-is, less so.","headline":"Genuinely new transferable RAG blocking attack whose headline ASR is inflated by in-sample strategy-library reuse; deserves a serious referee, with a mandatory cold-start evaluation.","tokens_in":26361,"tokens_out":9473,"would_cite":true,"duration_ms":100810,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Safety alignment itself is the shared vulnerability: a single crafted document can make unknown RAG systems refuse benign queries.","keywords":["Retrieval-Augmented Generation","blocking attacks","alignment homogeneity","transferable attacks","denial of service","LLM safety alignment","over-refusal","poisoning attacks"],"falsifier":"Take a safety-aligned model whose refusal training is limited to categories outside those three, such as privacy, economic harm, or animal welfare. Run TabooRAG against it using the standard three preferences: if attack success falls to the no-attack baseline, the shared-category assumption is the load-bearing part; if it stays high, the attack exploits a more general over-refusal tendency.","tokens_in":25441,"feed_emoji":"🚫","tokens_out":7909,"duration_ms":78208,"temperature":0.7,"pith_summary":"The paper argues that the safety alignment meant to stop LLMs from producing harmful content creates a shared, transferable vulnerability in retrieval-augmented generation, the question-answering pipelines that retrieve external documents. Because mainstream alignment trains models on overlapping risk categories and refusal criteria, a document that makes one model refuse is likely to make another refuse. TabooRAG exploits this by optimizing, in an accessible surrogate RAG environment, a single document per query that is both retrievable and refusal-inducing, then injecting it into a target system without ever probing it. Across seven modern LLMs and three question-answering datasets, it reports attack success rates up to 96.1% on a frontier model, with a strategy library that cuts optimization cost by roughly 70–80%. If this is right, standardized safety alignment is a double-edged sword: it improves harm prevention while creating a common denial-of-service surface.","feed_headline":"One crafted document blocks AI assistants up to 96%","feed_subtitle":"Safety alignment is so similar across models that a refusal trigger built on one transfers to unseen systems.","key_machinery":"Alignment homogeneity is the named mechanism: the shared risk taxonomy that safety-aligned models inherit from similar alignment practices. The operational engine is a bi-objective iterative optimization loop run in a surrogate RAG environment. An attacker LLM generates candidate documents that must (1) rank within a threshold under a surrogate retriever and (2) induce refusal in a surrogate LLM, with a judge LLM deciding refusal. The central construct is restricted risk context: fabricated, detailed, timestamped narratives that anchor a benign query to a prohibited scenario, making the model over-refuse without any injected instruction. A query-aware strategy library stores successful refus","core_discovery":"The core claim is that alignment homogeneity—the overlap in risk categories and refusal criteria across safety-aligned LLMs—can be weaponized. The paper shows that query-relevant restricted risk context, text that frames a benign query as involving physical harm, social bias, or compliance risk, triggers refusal in modern models even though it contains no instructions and no adversarial suffix. The attack formalizes success as retrievability and refusal and optimizes both in a surrogate environment, yielding a single blocking document per query that transfers to unknown black-box targets. The reported headline numbers are up to 96.1% attack success on a frontier model and stable transfer eve","pith_inferences":["If alignment homogeneity holds, any future model trained on a similar safety taxonomy inherits the vulnerability by default; diversifying refusal categories across vendors would reduce transferability but may be hard to reconcile with consistent safety standards.","The mechanism likely extends beyond RAG to any pipeline that conditions generation on untrusted context, such as agentic tools, where risk-framed context could induce similar refusals.","The warm-start result suggests an asymmetry: a strong attacker can build a reusable strategy library that weaker attackers inherit, lowering the skill and compute barrier for denial-of-service.","A pointed test would be to fine-tune a model on a deliberately disjoint safety taxonomy; if transferability collapses, homogeneity is the cause, and if it persists, over-refusal is broader than the paper's three categories."],"forward_implications":["A single injected document per query is enough to make an unknown RAG system refuse benign queries, with no feedback from the target.","The attack transfers across model families, including from small surrogate models to larger, more capable targets.","The strategy library makes the attack practical under strict query budgets by reusing effective refusal strategies across similar queries.","Perplexity filtering, query paraphrasing, and prompt-injection classifiers do not reliably stop the attack; a safety-focused RAG template can even amplify it.","Standardized safety alignment increases the shared attack surface, so defenses must address transferable risk context rather than only injection syntax."],"fun_headline_variants":["One document triggers refusal across nine LLMs","Alignment homogeneity weaponized: single text blocks AI","Exploiting shared refusal criteria for transferable blocking","TabooRAG: crafted risk context blocks unseen LLMs","Shared alignment rules make LLMs vulnerable to one-doc attack"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The attack assumes the three strategy preferences—physical harm, social bias, and compliance risk—cover the refusal categories that every target model shares; if a target model's safety policy is organized around other categories, the crafted risk context may not trigger refusal.","fun_headline_variants_meta":{"raw":{"variants":["One document triggers refusal across nine LLMs","Alignment homogeneity weaponized: single text blocks AI","Exploiting shared refusal criteria for transferable blocking","TabooRAG: crafted risk context blocks unseen LLMs","Shared alignment rules make LLMs vulnerable to one-doc attack"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000861,"raw_usage":{"total_tokens":3572,"prompt_tokens":740,"completion_tokens":2832,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":484,"completion_tokens_details":{"reasoning_tokens":2755}},"tokens_in":484,"tokens_out":2832,"duration_ms":22991,"temperature":1.0,"reasoning_tokens":2755,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-03T01:17:20.001265+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a safety-aligned model whose refusal training is limited to categories outside those three, such as privacy, economic harm, or animal welfare. Run TabooRAG against it using the standard three preferences: if attack success falls to the no-attack baseline, the shared-category assumption is the load-bearing part; if it stays high, the attack exploits a more general over-refusal tendency.","supporting_citations":[],"review_version":1}