Pith. sign in

REVIEW 3 major objections 6 minor 4 cited by

Benchmarking Poisoning Attacks against Retrieval-Augmented Generation

T0 review · 3 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper introduces a broad benchmark of 13 poisoning attacks, 7 defenses, and 15 QA datasets, and finds that advanced retrieval-augmented generation architectures remain susceptible while current defenses fail to provide reliable…

desk verdict A useful organizing milestone for RAG poisoning benchmarks, but the headline passive-defense claim is confounded by the query-prepending used to build the expanded datasets. read the letter →

arxiv 2505.18543 v1 pith:XFTACO7B submitted 2025-05-24 cs.CR cs.IRcs.LG

Baolei Zhang , Haoran Xin , Jiatong Li , Dongzhe Zhang , Minghong Fang , Zhuqing Liu , Lihai Nie , Zheli Liu This is my paper
classification cs.CRcs.IRcs.LG
keywords retrieval-augmentedgenerationpoisoningattacksadversarialbenchmarkdenial-of-servicepromptinjectiondefenseevaluationknowledgedatabaseLLMagents
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper presents RSB, a unified benchmark for poisoning attacks on retrieval-augmented generation (RAG), spanning 13 attack methods, 7 defenses, 15 QA datasets, and 6 advanced RAG architectures. The central claim is that RAG systems, including sequential, branching, conditional, loop, conversational, multimodal, and agent-based variants, remain susceptible to knowledge-base poisoning, while the tested defenses fail to provide reliable protection. A further finding is that expanding the knowledge database with more correct-answer texts passively lowers attack success for most attacks, pointing to information redundancy as a cheap defensive layer. If the paper is correct, teams operating RAG on publicly sourced knowledge should treat injected content as a live threat and should not rely on current detection or prompt-level defenses.

What carries the argument

The load-bearing mechanism is the benchmark itself: a unified threat model with three attack objectives (targeted poisoning, denial-of-service, and trigger-based denial-of-service), 100 targeted queries per attack category, and standardized accuracy, attack-success-rate, and retrieval F1 metrics. The dataset expansions, EX-M and EX-L, are the mechanism behind the passive-defense claim: for each targeted query, 5 or 30 generated correct-answer texts are added to the knowledge database, with the target query prepended to each added text to raise its retrieval similarity. The multi-turn, multimodal, and agent evaluations then test whether the same poisoned texts transfer when retrieval is preceded by query rewriting, extended to image-text pairs, or routed through a memory database.

What would settle it

Rebuild the EX-M and EX-L expansions with correct-answer texts generated without prepending the target query, then rerun the attack-success-rate columns of Table 2 under otherwise identical settings; if the ASR drop disappears or shrinks sharply, the passive-defense finding is an artifact of query-text overlap rather than evidence about information density.

Watch

Extended reading notes

Core claim

The paper's central discovery, stated on its own terms, is that existing poisoning attacks—targeted answer manipulation, denial-of-service, and trigger-based refusal—transfer across a wide range of RAG designs, so architectural sophistication does not eliminate the threat. On standard QA datasets, most attacks achieve high attack success rates, and the same poisoned texts remain effective in many advanced frameworks. On expanded datasets with more correct-answer texts, attack success drops sharply, which the authors interpret as evidence that knowledge redundancy is a passive defense; the exceptions are attacks that optimize each poisoned text individually, which retain higher success. The paper also reports that current defenses are uneven: prompt-level and architectural defenses help against denial-of-service but not targeted poisoning, detection-based filtering has little effect, and the best hybrid defense reduces attacks only at a substantial cost to benign accuracy.

Load-bearing premise

The passive-defense finding rests on treating the EX-M and EX-L additions as genuinely informative redundant texts, even though each added text is generated with the target query prepended to it, which mechanically inflates its retrieval score.

Editorial extensions

If this is right

  • Detection-based defenses such as perplexity and embedding-norm filtering leave attack success rates close to the no-defense baseline for most attacks.
  • Prompt-level and process-based defenses like InstructRAG and AstuteRAG can cut denial-of-service attacks sharply but leave targeted poisoning attacks largely intact.
  • The hybrid TrustRAG defense lowers attack success for many attacks but often filters out all retrieved texts, dropping benign accuracy by more than 20 percent.
  • Poisoned texts crafted for simple RAG transfer to branching, conditional, and loop-RAG frameworks, while frameworks that skip retrieval when confident (e.g., FLARE) show markedly lower attack success.
  • Increasing retrieval depth (top-K) does not by itself improve robustness on standard datasets; on expanded datasets the extra retrieved correct-answer texts, not the depth, are what suppress attack success.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The passive-defense conclusion is likely overstated: since the expansion texts are generated with the target query prepended, the ASR drop may reflect exact query-text overlap inflating retrieval scores rather than information redundancy; a paraphrase-based expansion would separate the two explanations.
  • The multi-turn result suggests that query rewriting before retrieval acts as an implicit defense, so a cheap testable extension is to apply single-turn query rewriting or paraphrasing as a preprocessing defense against targeted poisoning.
  • The transferability results imply that defense effort should focus on adaptive retrieval and similarity design rather than on filtering poisoned texts; comparing cosine versus dot-product scoring under white-box attacks is the natural next experiment.
  • Because the threat model forbids attacker modification of user queries, the benchmark's 'advanced architectures remain susceptible' statement does not cover backdoor-style attacks that inject triggers into queries; extending the benchmark to that setting would test whether the vulnerability is broader.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper introduces RAG Security Bench (RSB), a benchmark for evaluating poisoning attacks against retrieval-augmented generation. It covers 13 attack methods, 7 defenses, 5 standard QA datasets plus 10 expanded variants, and extends evaluation to sequential, branching, conditional, and loop RAG frameworks, as well as multi-turn, multimodal, and agent-based RAG. The headline findings are that attacks remain effective on original datasets, that the expanded datasets reduce attack success, that CRAG-AK and related per-text optimized attacks are more resilient, and that current defenses, especially detection-based ones, provide limited protection.

Significance. If the empirical claims hold, RSB would be a useful unifying benchmark for a fragmented literature, and the finding that enriched knowledge bases passively reduce poisoning effectiveness would be a practically relevant insight. The paper's strengths are its breadth: 13 attacks and 7 defenses under a common threat model, ablations over LLMs, retrievers, similarity measures, and top-K, and transfer studies to advanced RAG architectures. The manuscript would also benefit from credit for reproducing prior attacks and defenses and for distinguishing attack categories by objective. However, the central passive-defense claim rests on the construction of the expanded datasets, and that construction confounds information density with query-text overlap, so the claimed insight is not currently established.

major comments (3)
  1. [§5.2.1 / Appendix D.1 / Table 2] The central claim that enriching the knowledge database with diverse and redundant correct-answer texts passively defeats poisoning is not supported by the experiments as constructed. Appendix D.1 states that each added EX-M and EX-L text is generated by GPT-4o-mini and then the targeted query is prepended to it 'to increase their similarity to the targeted query.' Since the default retriever is the dense retriever Contriever, these query-prefixed entries mechanically outrank both original passages and poisoned texts, independently of whether they are informative or redundant. The large F1-score drops in Table 2 (e.g., BPRAG on NQ: 0.96 to 0.48 to 0.19) show that poisoned texts are displaced by query-overlapping entries, not by generally informative correct-answer texts. The abstract's claim that 'effectiveness drops significantly on the expanded versions' and the recommendation that enrichment is 'a simple yet effective layer of defense' therefore need to be re-examined. The authors should rerun the expansions using correct-answer texts that do not contain the targeted query verbatim, or otherwise show that the ASR drop persists when the added passages are natural, non-query-prefixed correct answers.
  2. [§5.1 / Appendix D.2] ACC and ASR are computed entirely from GPT-4o-mini judgments about whether the RAG output matches the correct or targeted answer, but no human validation, inter-annotator agreement, or judge accuracy is reported. Given that several findings hinge on differences of a few points (e.g., CRAG-AK's relative superiority on expansions in Table 2, and the defense comparisons in Table 3), the absence of any judge-reliability measure makes the quantitative claims hard to assess. Additionally, the paper states that each experiment was run five times and averaged with small variance, but never reports the variance or confidence intervals. The authors should provide a human-annotated sample of judge accuracy or a judge consistency statistic, and report standard deviations or ranges for the principal results.
  3. [§5.2.1 / Figure 4 / Table 2] The causal interpretation of the expansion results is not directly tested. The paper attributes the ASR drop to 'more correct texts with higher similarity' providing stronger signals to the LLM, but the F1-score collapse indicates that the poisoned texts are no longer retrieved at all. With the query prepended to every added passage, the observed effect could be entirely a retrieval artifact rather than evidence that the LLM resists poisoned context when supplied with redundant correct information. A minimal control would compare three expansion variants: (a) generated correct texts with the query prepended, (b) the same texts without the query prefix, and (c) original gold passages with no query prefix, while holding the number of added texts fixed. Until such a control is reported, the passive-defense finding in the abstract and Section 5.2.1 should be regarded as not yet established.
minor comments (6)
  1. [Appendix L.2] SuRe is attributed to reference [85], but reference [85] is the AAR paper; the correct citation for SuRe appears to be reference [42] (Kim et al., 'SuRe: Summarizing retrievals using answer candidates').
  2. [Appendix C] The exclusion entry for 'The RAG Paradox' contains a typographical error: '[24]]' should be '[24]'.
  3. [Table 2] The layout of Table 2 makes it difficult to associate each dataset block with its rows; the dataset name appears to be inserted inside the previous block's metrics. Please separate blocks explicitly or add a clear dataset column.
  4. [§5.1] The statement 'The variance of results was small, so we omit it' is not verifiable; please provide at least the range or standard deviation for the main table entries, or state that the five runs were used only for API-cost averaging.
  5. [§1] The claim of being 'the first comprehensive benchmark' should be softened or qualified in light of SafeRAG [48], which the paper itself discusses, and which also addresses security tasks for RAG.
  6. [Reproducibility] The manuscript does not state whether the benchmark code, dataset expansions, and targeted query sets will be released; since RSB is proposed as a community benchmark, an artifact link or availability statement is important.

Circularity Check

1 steps flagged · score 6.0 of 10

The 'passive defense' finding is construction-forced: the expanded corpora prepend the targeted query to every added text, so the retrieval advantage and ASR drop are built into the dataset rather than derived from diversity or redundancy.

  1. self definitional [Section 1 Empirical findings (Effectiveness 2) and Appendix D.1 dataset construction]
    "These expanded datasets introduce a higher density of correct-answer texts that are semantically close to the target queries | However, their effectiveness significantly declines on the challenging expansions, suggesting that enriching the knowledge database with more diverse and redundant correct-answer texts can passively reduce the impact of poisoning | Additionally, we prepend the targeted query to each relevant text to increase their similarity to the targeted query."

    The 'diverse and redundant correct-answer texts' are operationally defined in Appendix D.1 as GPT-4o-mini generated texts with the targeted query prepended. Since the retriever (Contriever) ranks texts by cosine similarity to the query embedding, any text whose opening tokens are the query is, by construction, highly similar to the query. The observed outcomes in Table 2 (poisoned-text F1 collapsing to 0.00-0.19 on expansions) and Figure 4 ('more correct texts with higher similarity') are therefore forced by the query-copy insertion rather than by informational diversity or redundancy.

full rationale

The paper does not derive any quantity from itself in its formal definitions: Section 4 defines attacks via equations, and the ACC/ASR/F1 metrics are measured on external QA datasets. The one load-bearing step that reduces to its own construction is the passive-defense finding. Appendix D.1 states that each added EX-M/EX-L text has the targeted query prepended 'to increase their similarity to the targeted query.' Because the retriever scores by cosine similarity to the query, such a text is guaranteed to be highly ranked, mechanically displacing poisoned passages and producing the retrieval and ASR collapse the paper attributes to content diversity and redundancy. The paper's claim that 'enriching the knowledge database with more diverse and redundant correct-answer texts' is 'a simple yet effective layer of defense' is thus equivalent to the construction: the outcome was installed by prepending the user's query, not by adding information-rich alternatives. This is partial circularity in the sense that a headline empirical prediction is forced by how the input was defined. The other central claims—advanced RAG architectures remain susceptible and current defense techniques fail—do not reduce to the expansion construction and are supported by independent measurements. The CRAG-AS/CRAG-AK methods are prior work by overlapping authors [88], but they are benchmarked on external datasets and the main vulnerability claim does not rest on their superiority, so this is minor self-citation rather than load-bearing circularity.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The benchmark relies on no fitted constants or newly postulated mechanisms. The parameters that matter are experimental design choices: expansion sizes, detection thresholds, and the unreleased targeted query sets. The domain assumptions are standard for RAG threat modeling but are not independently validated, and the GPT-4o-mini-as-judge assumption is load-bearing for every number in the paper.

free parameters (3)
  • Expansion sizes (EX-M = 5, EX-L = 30 added texts per query) = 5 and 30
    Hand-chosen in Appendix D.1. The central finding that attacks drop on expansions is measured against these sizes, and no sensitivity analysis over expansion size is reported.
  • PPL and Norm detection thresholds = not reported
    Appendix H.2 states that 'an appropriate threshold is selected' without giving values or selection procedure. Defense conclusions for detection-based methods depend on these thresholds.
  • Targeted query sets (100 per attack type) = not released
    Appendix D.3 samples 500, filters, then samples 100. The sets are not released and differ across attack types, limiting comparability across categories.
assumptions (3)
  • domain assumption Attacker can inject arbitrary text into the knowledge database without detection or modification.
    Section 3 threat model. All attacks and the benchmark's conclusions depend on this capability being realistic and undetected.
  • domain assumption GPT-4o-mini reliably judges whether a RAG output equals the correct or targeted answer.
    Appendix D.2 uses GPT-4o-mini as the evaluator for ACC and ASR. If the judge is biased or inconsistent, all reported rates shift.
  • domain assumption Cosine similarity over Contriever embeddings is a representative retrieval setting.
    Section 5.1 sets this as default. Appendix F shows that switching to dot product dramatically changes BadRAG and Phantom results, so the default similarity function materially affects the benchmark outcome.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Benchmarking Poisoning Attacks against Retrieval-Augmented Generation." pith.science (2026). https://pith.science/paper/XFTACO7B

@misc{pith2026250518543,
  author       = {Pith},
  title        = {Pith review of: Benchmarking Poisoning Attacks against Retrieval-Augmented Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XFTACO7B}},
  note         = {Machine review of arXiv:2505.18543}
}
read the original abstract

Retrieval-Augmented Generation (RAG) has proven effective in mitigating hallucinations in large language models by incorporating external knowledge during inference. However, this integration introduces new security vulnerabilities, particularly to poisoning attacks. Although prior work has explored various poisoning strategies, a thorough assessment of their practical threat to RAG systems remains missing. To address this gap, we propose the first comprehensive benchmark framework for evaluating poisoning attacks on RAG. Our benchmark covers 5 standard question answering (QA) datasets and 10 expanded variants, along with 13 poisoning attack methods and 7 defense mechanisms, representing a broad spectrum of existing techniques. Using this benchmark, we conduct a comprehensive evaluation of all included attacks and defenses across the full dataset spectrum. Our findings show that while existing attacks perform well on standard QA datasets, their effectiveness drops significantly on the expanded versions. Moreover, our results demonstrate that various advanced RAG architectures, such as sequential, branching, conditional, and loop RAG, as well as multi-turn conversational RAG, multimodal RAG systems, and RAG-based LLM agent systems, remain susceptible to poisoning attacks. Notably, current defense techniques fail to provide robust protection, underscoring the pressing need for more resilient and generalizable defense strategies.

Figures

Figures reproduced from arXiv: 2505.18543 by the authors.

Figure 1
Figure 1. Illustration of the standard workflow in a RAG system. As shown in [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Results of poisoning attacks under different LLMs of RAG on NQ dataset. LLM versions in Appendix K. Impact of retrievers: We perform a comprehensive eval￾uation to examine how different retrievers influence the susceptibility of RAG systems to poisoning attacks, using three state-of-the-art retrievers [32, 76]. Results on the NQ, NQ-EX-M, and NQ-EX-L datasets ( [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. The results of poisoning attacks under different top-K of RAG on NQ dataset. Impact of K: We perform experiments to ex￾amine how varying the top-K retrieved texts influences RAG’s vulnerability to poisoning at￾tacks. Results on NQ are presented in [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: The number of correct-answer texts among top-5 for each targeted query on NQ, NQ-EX-M, [PITH_FULL_IMAGE:figures/full_fig_p022_4.png]
Figure 5
Figure 5. Figure 5: The results of poisoning attacks under different LLMs of RAG on NQ-EX-M and NQ-EX-L [PITH_FULL_IMAGE:figures/full_fig_p038_5.png]
Figure 6
Figure 6. Figure 6: The results of poisoning attacks under different top- [PITH_FULL_IMAGE:figures/full_fig_p041_6.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 4 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. DisarmRAG: Stealthy Retriever-Centric Poisoning to Disable Self-Correction in Retrieval-Augmented Generation (Extended Version)

    cs.CR 2025-08 conditional novelty 7.0 of 10

    DisarmRAG compromises the retriever to inject anti-self-correction instructions, achieving over 90% attack success across six LLMs while evading basic detection.

  2. SafeSearch: Automated Red-Teaming of LLM-Based Search Agents

    cs.AI 2025-09 conditional novelty 6.0 of 10

    An automated red-teaming framework and 300-case benchmark show that a single unreliable website can induce unsafe responses in LLM search agents, with attack success rates up to 90.5%.

  3. TriShieldRAG: A Three-Ring Defense-in-Depth Framework Against Knowledge Corruption in Retrieval-Augmented Generation

    cs.CR 2026-07 conditional novelty 5.0 of 10

    A three-ring RAG defense cuts non-adaptive PoisonedRAG attack success from ~91% to ~13% on 10 questions over a 5,000-document Wikipedia base.

  4. Benchmarking Knowledge-Extraction Attack and Defense on Retrieval-Augmented Generation

    cs.CR 2026-02 conditional novelty 5.0 of 10

    A unified benchmark comparing RAG knowledge-extraction attacks and defenses, showing query diversity boosts extraction, embedding attacks fail to transfer, and graph indexing raises per-token leakage.

Reference graph

Works this paper leans on

99 extracted references · 17 canonical work pages · cited by 4 Pith papers

  1. [1]

    https://www.anthropic.com/news/claude-3-7-sonnet

    Claude 3.7 sonnet. https://www.anthropic.com/news/claude-3-7-sonnet

  2. [2]

    https://blog.google/ technology/google-deepmind/google-gemini-ai-update-december-2024

    Introducing gemini 2.0: our new ai model for the agentic era. https://blog.google/ technology/google-deepmind/google-gemini-ai-update-december-2024

    2024

  3. [3]

    https://openai.com/index/gpt-4-1

    Introducing gpt-4.1. https://openai.com/index/gpt-4-1

  4. [4]

    https://modelcontextprotocol.io/ introduction

    Introduction of model context protocol. https://modelcontextprotocol.io/ introduction

  5. [5]

    https://www.llama.com/models/llama-4

    Llama-4. https://www.llama.com/models/llama-4

  6. [6]

    Qwq: Reflect deeply on the boundaries of the unknown.https://qwenlm.github.io/blog/ qwq-32b

  7. [7]

    Gpt-4 technical report

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774, 2023

    arXiv 2023

  8. [8]

    Trec ikat 2023: A test collection for evaluating conversational and interactive knowledge assistants

    Mohammad Aliannejadi, Zahra Abbasiantaeb, Shubham Chatterjee, Jeffrey Dalton, and Leif Azzopardi. Trec ikat 2023: A test collection for evaluating conversational and interactive knowledge assistants. In Proceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrieval, pages 819–829, 2024

    2023

Show all 99 references
  1. [9]

    Palm 2 technical report

    Rohan Anil, Andrew M Dai, Orhan Firat, Melvin Johnson, Dmitry Lepikhin, Alexandre Passos, Siamak Shakeri, Emanuel Taropa, Paige Bailey, Zhifeng Chen, et al. Palm 2 technical report. arXiv preprint arXiv:2305.10403, 2023

    2023 arXiv

  2. [10]

    Improving language models by retrieving from trillions of tokens

    Sebastian Borgeaud, Arthur Mensch, Jordan Hoffmann, Trevor Cai, Eliza Rutherford, Katie Millican, George Bm Van Den Driessche, Jean-Baptiste Lespiau, Bogdan Damoc, Aidan Clark, et al. Improving language models by retrieving from trillions of tokens. In International conference...

    2022

  3. [11]

    Language models are few-shot learners

    Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. In NeurIPS, 2020

    2020

  4. [12]

    Poisoning web-scale training datasets is practical

    Nicholas Carlini, Matthew Jagielski, Christopher A Choquette-Choo, Daniel Paleka, Will Pearce, Hyrum Anderson, Andreas Terzis, Kurt Thomas, and Florian Tramèr. Poisoning web-scale training datasets is practical. In 2024 IEEE Symposium on Security and Privacy (SP), pages 407–42...

    2024

  5. [13]

    Rq-rag: Learning to refine queries for retrieval augmented generation

    Chi-Min Chan, Chunpu Xu, Ruibin Yuan, Hongyin Luo, Wei Xue, Yike Guo, and Jie Fu. Rq-rag: Learning to refine queries for retrieval augmented generation. arXiv preprint arXiv:2404.00610, 2024

    2024 arXiv

  6. [14]

    One shot dominance: Knowledge poisoning attack on retrieval-augmented generation systems

    Zhiyuan Chang, Xiaojun Jia, Mingyang Li, Junjie Wang, Yuekai Huang, Qing Wang, Ziyou Jiang, and Yang Liu. One shot dominance: Knowledge poisoning attack on retrieval-augmented generation systems. arXiv preprint arXiv:2505.11548, 2025

    2025 arXiv

  7. [15]

    Phantom: General trigger attacks on retrieval augmented language generation

    Harsh Chaudhari, Giorgio Severi, John Abascal, Matthew Jagielski, Christopher A Choquette- Choo, Milad Nasr, Cristina Nita-Rotaru, and Alina Oprea. Phantom: General trigger attacks on retrieval augmented language generation. arXiv preprint arXiv:2405.20485, 2024. 10

    2024

  8. [16]

    Benchmarking large language mod- els in retrieval-augmented generation

    Jiawei Chen, Hongyu Lin, Xianpei Han, and Le Sun. Benchmarking large language mod- els in retrieval-augmented generation. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 17754–17762, 2024

    2024

  9. [17]

    Murag: Multimodal retrieval-augmented generator for open question answering over images and text

    Wenhu Chen, Hexiang Hu, Xi Chen, Pat Verga, and William W Cohen. Murag: Multimodal retrieval-augmented generator for open question answering over images and text. arXiv preprint arXiv:2210.02928, 2022

    2022 arXiv

  10. [18]

    Can pre-trained vision and language models answer visual information-seeking questions? arXiv preprint arXiv:2302.11713, 2023

    Yang Chen, Hexiang Hu, Yi Luan, Haitian Sun, Soravit Changpinyo, Alan Ritter, and Ming- Wei Chang. Can pre-trained vision and language models answer visual information-seeking questions? arXiv preprint arXiv:2302.11713, 2023

    2023 arXiv

  11. [19]

    Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases

    Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases. In Advances in Neural Information Processing Systems, 2024

    2024

  12. [20]

    Flipedrag: Black-box opinion manipulation attacks to retrieval- augmented generation of large language models

    Zhuo Chen, Yuyang Gong, Miaokun Chen, Haotan Liu, Qikai Cheng, Fan Zhang, Wei Lu, Xiaozhong Liu, and Jiawei Liu. Flipedrag: Black-box opinion manipulation attacks to retrieval- augmented generation of large language models. arXiv preprint arXiv:2501.02968, 2025

    2025

  13. [21]

    Trojanrag: Retrieval-augmented generation can be backdoor driver in large language models

    Pengzhou Cheng, Yidong Ding, Tianjie Ju, Zongru Wu, Wei Du, Ping Yi, Zhuosheng Zhang, and Gongshen Liu. Trojanrag: Retrieval-augmented generation can be backdoor driver in large language models. arXiv preprint arXiv:2405.13401, 2024

    2024 arXiv

  14. [22]

    Coral: Benchmarking multi-turn conversational retrieval-augmentation generation

    Yiruo Cheng, Kelong Mao, Ziliang Zhao, Guanting Dong, Hongjin Qian, Yongkang Wu, Tetsuya Sakai, Ji-Rong Wen, and Zhicheng Dou. Coral: Benchmarking multi-turn conversational retrieval-augmentation generation. arXiv preprint arXiv:2410.23090, 2024

    arXiv

  15. [23]

    Typos that broke the rag’s back: Genetic attack on rag pipeline by simulating documents in the wild via low-level perturbations

    Sukmin Cho, Soyeong Jeong, Jeongyeon Seo, Taeho Hwang, and Jong C Park. Typos that broke the rag’s back: Genetic attack on rag pipeline by simulating documents in the wild via low-level perturbations. arXiv preprint arXiv:2404.13948, 2024

    2024 arXiv

  16. [24]

    The rag paradox: A black-box attack exploiting unintentional vulnerabilities in retrieval-augmented generation systems

    Chanwoo Choi, Jinsoo Kim, Sukmin Cho, Soyeong Jeong, and Buru Chang. The rag paradox: A black-box attack exploiting unintentional vulnerabilities in retrieval-augmented generation systems. arXiv preprint arXiv:2502.20995, 2025

    2025

  17. [25]

    Boolq: Exploring the surprising difficulty of natural yes/no questions

    Christopher Clark, Kenton Lee, Ming-Wei Chang, Tom Kwiatkowski, Michael Collins, and Kristina Toutanova. Boolq: Exploring the surprising difficulty of natural yes/no questions. arXiv preprint arXiv:1905.10044, 2019

    1905 arXiv

  18. [26]

    The power of noise: Redefining retrieval for rag systems

    Florin Cuconasu, Giovanni Trappolini, Federico Siciliano, Simone Filice, Cesare Campagnano, Yoelle Maarek, Nicola Tonellotto, and Fabrizio Silvestri. The power of noise: Redefining retrieval for rag systems. In Proceedings of the 47th International ACM SIGIR Conference on Rese...

    2024

  19. [27]

    Retrieval-augmented generation for large language models: A survey

    Yunfan Gao, Yun Xiong, Xinyu Gao, Kangxiang Jia, Jinliu Pan, Yuxi Bi, Yi Dai, Jiawei Sun, and Haofen Wang. Retrieval-augmented generation for large language models: A survey. arXiv preprint arXiv:2312.10997, 2023

    2023 arXiv

  20. [28]

    Did aristotle use a laptop? a question answering benchmark with implicit reasoning strategies

    Mor Geva, Daniel Khashabi, Elad Segal, Tushar Khot, Dan Roth, and Jonathan Berant. Did aristotle use a laptop? a question answering benchmark with implicit reasoning strategies. In Transactions of the Association for Computational Linguistics, 2021

    2021

  21. [29]

    Topic-fliprag: Topic-orientated adversarial opinion manipulation attacks to retrieval-augmented generation models

    Yuyang Gong, Zhuo Chen, Miaokun Chen, Fengchang Yu, Wei Lu, Xiaofeng Wang, Xiaozhong Liu, and Jiawei Liu. Topic-fliprag: Topic-orientated adversarial opinion manipulation attacks to retrieval-augmented generation models. arXiv preprint arXiv:2502.01386, 2025

    2025

  22. [30]

    Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning

    Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et al. Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning. arXiv preprint arXiv:2501.12948, 2025

    2025 arXiv

  23. [31]

    Gpt-4o system card

    Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, et al. Gpt-4o system card. arXiv preprint arXiv:2410.21276, 2024. 11

    2024 arXiv

  24. [32]

    Unsupervised dense information retrieval with contrastive learning

    Gautier Izacard, Mathilde Caron, Lucas Hosseini, Sebastian Riedel, Piotr Bojanowski, Armand Joulin, and Edouard Grave. Unsupervised dense information retrieval with contrastive learning. arXiv preprint arXiv:2112.09118, 2021

    2021 arXiv

  25. [33]

    Baseline de- fenses for adversarial attacks against aligned language models.arXiv preprint arXiv:2309.00614, 2023

    Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. Baseline de- fenses for adversarial attacks against aligned language models.arXiv preprint arXiv:2309.00614, 2023

    2023 arXiv

  26. [34]

    Interpolated estimation of markov source parameters from sparse data

    Frederick Jelinek. Interpolated estimation of markov source parameters from sparse data. In Proc. Workshop on Pattern Recognition in Practice, 1980, 1980

    1980

  27. [35]

    Adaptive-rag: Learning to adapt retrieval-augmented large language models through question complexity

    Soyeong Jeong, Jinheon Baek, Sukmin Cho, Sung Ju Hwang, and Jong C Park. Adaptive-rag: Learning to adapt retrieval-augmented large language models through question complexity. arXiv preprint arXiv:2403.14403, 2024

    2024 arXiv

  28. [36]

    Rag-thief: Scalable extraction of private data from retrieval-augmented generation applications with agent-based attacks

    Changyue Jiang, Xudong Pan, Geng Hong, Chenfu Bao, and Min Yang. Rag-thief: Scalable extraction of private data from retrieval-augmented generation applications with agent-based attacks. arXiv preprint arXiv:2411.14110, 2024

    2024 arXiv

  29. [37]

    Active retrieval augmented generation

    Zhengbao Jiang, Frank F Xu, Luyu Gao, Zhiqing Sun, Qian Liu, Jane Dwivedi-Yu, Yiming Yang, Jamie Callan, and Graham Neubig. Active retrieval augmented generation. arXiv preprint arXiv:2305.06983, 2023

    2023 arXiv

  30. [38]

    Pr-attack: Coordinated prompt-rag attacks on retrieval-augmented generation in large language models via bilevel optimization

    Yang Jiao, Xiaodong Wang, and Kai Yang. Pr-attack: Coordinated prompt-rag attacks on retrieval-augmented generation in large language models via bilevel optimization. arXiv preprint arXiv:2504.07717, 2025

    2025 arXiv

  31. [39]

    Flashrag: A modular toolkit for efficient retrieval-augmented generation research

    Jiajie Jin, Yutao Zhu, Xinyu Yang, Chenghao Zhang, and Zhicheng Dou. Flashrag: A modular toolkit for efficient retrieval-augmented generation research. arXiv preprint arXiv:2405.13576, 2024

    2024 arXiv

  32. [40]

    Dense passage retrieval for open-domain question answering

    Vladimir Karpukhin, Barlas O ˘guz, Sewon Min, Patrick Lewis, Ledell Wu, Sergey Edunov, Danqi Chen, and Wen-tau Yih. Dense passage retrieval for open-domain question answering. arXiv preprint arXiv:2004.04906, 2020

    2004 arXiv

  33. [41]

    Mtrag: A multi-turn conversational benchmark for evaluating retrieval-augmented generation systems.arXiv preprint arXiv:2501.03468, 2025

    Yannis Katsis, Sara Rosenthal, Kshitij Fadnis, Chulaka Gunasekara, Young-Suk Lee, Lucian Popa, Vraj Shah, Huaiyu Zhu, Danish Contractor, and Marina Danilevsky. Mtrag: A multi-turn conversational benchmark for evaluating retrieval-augmented generation systems.arXiv preprint arX...

    2025 arXiv

  34. [42]

    Sure: Summarizing retrievals using answer candidates for open-domain qa of llms

    Jaehyung Kim, Jaehyun Nam, Sangwoo Mo, Jongjin Park, Sang-Woo Lee, Minjoon Seo, Jung-Woo Ha, and Jinwoo Shin. Sure: Summarizing retrievals using answer candidates for open-domain qa of llms. arXiv preprint arXiv:2404.13081, 2024

    2024 arXiv

  35. [43]

    Rad-bench: Evaluating large language models capabilities in retrieval augmented dia- logues

    Tzu-Lin Kuo, Feng-Ting Liao, Mu-Wei Hsieh, Fu-Chieh Chang, Po-Chun Hsu, and Da-Shan Shiu. Rad-bench: Evaluating large language models capabilities in retrieval augmented dia- logues. arXiv preprint arXiv:2409.12558, 2024

    2024 arXiv

  36. [44]

    Natural questions: a benchmark for question answering research

    Tom Kwiatkowski, Jennimaria Palomaki, Olivia Redfield, Michael Collins, Ankur Parikh, Chris Alberti, Danielle Epstein, Illia Polosukhin, Jacob Devlin, Kenton Lee, et al. Natural questions: a benchmark for question answering research. Transactions of the Association for Computa...

    2019

  37. [45]

    Alzheimerrag: Multimodal retrieval augmented generation for pubmed articles

    Aritra Kumar Lahiri and Qinmin Vivian Hu. Alzheimerrag: Multimodal retrieval augmented generation for pubmed articles. arXiv preprint arXiv:2412.16701, 2024

    2024 arXiv

  38. [46]

    Retrieval-augmented generation for knowledge-intensive nlp tasks

    Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, et al. Retrieval-augmented generation for knowledge-intensive nlp tasks. Advances in Neural Information Processing Systems...

    2020

  39. [47]

    Seeing is believing: Black-box member- ship inference attacks against retrieval augmented generation

    Yuying Li, Gaoyang Liu, Yang Yang, and Chen Wang. Seeing is believing: Black-box member- ship inference attacks against retrieval augmented generation. arXiv e-prints, pages arXiv–2406, 2024

    2024

  40. [48]

    Saferag: Benchmarking security in retrieval-augmented generation of large language model

    Xun Liang, Simin Niu, Zhiyu Li, Sensen Zhang, Hanyu Wang, Feiyu Xiong, Jason Zhaoxin Fan, Bo Tang, Shichao Song, Mengwei Wang, et al. Saferag: Benchmarking security in retrieval-augmented generation of large language model. arXiv preprint arXiv:2501.18636, 2025

    2025 arXiv

  41. [49]

    Deepseek-v3 technical report

    Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, et al. Deepseek-v3 technical report. arXiv preprint arXiv:2412.19437, 2024

    2024 arXiv

  42. [50]

    Poisoned-mrag: Knowledge poisoning attacks to multimodal retrieval augmented generation

    Yinuo Liu, Zenghui Yuan, Guiyao Tie, Jiawen Shi, Pan Zhou, Lichao Sun, and Neil Zhenqiang Gong. Poisoned-mrag: Knowledge poisoning attacks to multimodal retrieval augmented generation. arXiv preprint arXiv:2503.06254, 2025

    2025 arXiv

  43. [51]

    Formalizing and benchmarking prompt injection attacks and defenses

    Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. Formalizing and benchmarking prompt injection attacks and defenses. In 33rd USENIX Security Symposium (USENIX Security 24), pages 1831–1847, 2024

    2024

  44. [52]

    Backdoor attacks on dense passage retrievers for disseminating misinformation

    Quanyu Long, Yue Deng, LeiLei Gan, Wenya Wang, and Sinno Jialin Pan. Backdoor attacks on dense passage retrievers for disseminating misinformation. arXiv e-prints, pages arXiv–2402, 2024

    2024

  45. [53]

    Making llms worth every penny: Resource-limited text classification in banking

    Lefteris Loukas, Ilias Stogiannidis, Odysseas Diamantopoulos, Prodromos Malakasiotis, and Stavros Vassos. Making llms worth every penny: Resource-limited text classification in banking. In ICAIF, 2023

    2023

  46. [54]

    A language agent for autonomous driving

    Jiageng Mao, Junjie Ye, Yuxi Qian, Marco Pavone, and Yue Wang. A language agent for autonomous driving. arXiv preprint arXiv:2311.10813, 2023

    2023 arXiv

  47. [55]

    A survey of conversational search

    Fengran Mo, Kelong Mao, Ziliang Zhao, Hongjin Qian, Haonan Chen, Yiruo Cheng, Xiaoxi Li, Yutao Zhu, Zhicheng Dou, and Jian-Yun Nie. A survey of conversational search. arXiv preprint arXiv:2410.15576, 2024

    2024 arXiv

  48. [56]

    Riddle me this! stealthy membership inference for retrieval-augmented generation

    Ali Naseh, Yuefeng Peng, Anshuman Suri, Harsh Chaudhari, Alina Oprea, and Amir Houmansadr. Riddle me this! stealthy membership inference for retrieval-augmented generation. arXiv preprint arXiv:2502.00306, 2025

    2025 arXiv

  49. [57]

    Ms marco: A human-generated machine reading comprehension dataset

    Tri Nguyen, Mir Rosenberg, Xia Song, Jianfeng Gao, Saurabh Tiwary, Rangan Majumder, and Li Deng. Ms marco: A human-generated machine reading comprehension dataset. 2016

    2016

  50. [58]

    Squad: 100,000+ questions for machine comprehension of text

    Pranav Rajpurkar, Jian Zhang, Konstantin Lopyrev, and Percy Liang. Squad: 100,000+ questions for machine comprehension of text. arXiv preprint arXiv:1606.05250, 2016

    2016 arXiv

  51. [59]

    Confusedpilot: Confused deputy risks in rag-based llms

    Ayush RoyChowdhury, Mulong Luo, Prateek Sahu, Sarbartha Banerjee, and Mohit Tiwari. Confusedpilot: Confused deputy risks in rag-based llms. arXiv preprint arXiv:2408.04870, 2024

    2024 arXiv

  52. [60]

    Ragchecker: A fine-grained framework for diagnosing retrieval-augmented generation

    Dongyu Ru, Lin Qiu, Xiangkun Hu, Tianhang Zhang, Peng Shi, Shuaichen Chang, Cheng Jiayang, Cunxiang Wang, Shichao Sun, Huanyu Li, et al. Ragchecker: A fine-grained framework for diagnosing retrieval-augmented generation. In Advances in Neural Information Processing Systems, 2024

    2024

  53. [61]

    Evaluating retrieval quality in retrieval-augmented gen- eration

    Alireza Salemi and Hamed Zamani. Evaluating retrieval quality in retrieval-augmented gen- eration. In Proceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrieval, pages 2395–2400, 2024

    2024

  54. [62]

    Machine against the rag: Jamming retrieval-augmented generation with blocker documents

    Avital Shafran, Roei Schuster, and Vitaly Shmatikov. Machine against the rag: Jamming retrieval-augmented generation with blocker documents. arXiv preprint arXiv:2406.05870, 2024. 13

    2024 arXiv

  55. [63]

    Ehragent: Code empowers large language models for few-shot complex tabular reasoning on electronic health records

    Wenqi Shi, Ran Xu, Yuchen Zhuang, Yue Yu, Jieyu Zhang, Hang Wu, Yuanda Zhu, Joyce Ho, Carl Yang, and May D Wang. Ehragent: Code empowers large language models for few-shot complex tabular reasoning on electronic health records. arXiv preprint arXiv:2401.07128, 2024

    2024 arXiv

  56. [64]

    Trec 2019 news track overview

    Ian Soboroff, Shudong Huang, and Donna Harman. Trec 2019 news track overview. In TREC, 2019

    2019

  57. [65]

    Corpus poisoning via approximate greedy gradient descent

    Jinyan Su, Preslav Nakov, and Claire Cardie. Corpus poisoning via approximate greedy gradient descent. arXiv preprint arXiv:2406.05087, 2024

    2024 arXiv

  58. [66]

    Hoist with his own petard: Inducing guardrails to facilitate denial-of-service attacks on retrieval-augmented generation of llms.arXiv preprint arXiv:2504.21680, 2025

    Pan Suo, Yu-Ming Shang, San-Chuan Guo, and Xi Zhang. Hoist with his own petard: Inducing guardrails to facilitate denial-of-service attacks on retrieval-augmented generation of llms.arXiv preprint arXiv:2504.21680, 2025

    2025 arXiv

  59. [67]

    glue pizza and eat rocks

    Zhen Tan, Chengshuai Zhao, Raha Moraffah, Yifan Li, Song Wang, Jundong Li, Tianlong Chen, and Huan Liu. " glue pizza and eat rocks"–exploiting vulnerabilities in retrieval-augmented generative models. arXiv preprint arXiv:2406.19417, 2024

    2024 arXiv

  60. [68]

    Beir: A heterogeneous benchmark for zero-shot evaluation of information retrieval models

    Nandan Thakur, Nils Reimers, Andreas Rücklé, Abhishek Srivastava, and Iryna Gurevych. Beir: A heterogeneous benchmark for zero-shot evaluation of information retrieval models. In NeurIPS, 2021

    2021

  61. [69]

    Lamda: Language models for dialog applications

    Romal Thoppilan, Daniel De Freitas, Jamie Hall, Noam Shazeer, Apoorv Kulshreshtha, Heng- Tze Cheng, Alicia Jin, Taylor Bos, Leslie Baker, Yu Du, et al. Lamda: Language models for dialog applications. arXiv preprint arXiv:2201.08239, 2022

    2022 arXiv

  62. [70]

    Interleaving retrieval with chain-of-thought reasoning for knowledge-intensive multi-step questions

    Harsh Trivedi, Niranjan Balasubramanian, Tushar Khot, and Ashish Sabharwal. Interleaving retrieval with chain-of-thought reasoning for knowledge-intensive multi-step questions. arXiv preprint arXiv:2212.10509, 2022

    2022 arXiv

  63. [71]

    Astute rag: Overcoming imperfect retrieval augmentation and knowledge conflicts for large language models

    Fei Wang, Xingchen Wan, Ruoxi Sun, Jiefeng Chen, and Sercan Ö Arık. Astute rag: Overcoming imperfect retrieval augmentation and knowledge conflicts for large language models. arXiv preprint arXiv:2410.07176, 2024

    2024 arXiv

  64. [72]

    Instructrag: Instructing retrieval-augmented genera- tion with explicit denoising

    Zhepei Wei, Wei-Lin Chen, and Yu Meng. Instructrag: Instructing retrieval-augmented genera- tion with explicit denoising. arXiv e-prints, pages arXiv–2406, 2024

    2024

  65. [73]

    Mmed-rag: Versatile multimodal rag system for medical vision language models

    Peng Xia, Kangyu Zhu, Haoran Li, Tianze Wang, Weijia Shi, Sheng Wang, Linjun Zhang, James Zou, and Huaxiu Yao. Mmed-rag: Versatile multimodal rag system for medical vision language models. arXiv preprint arXiv:2410.13085, 2024

    arXiv

  66. [74]

    Rule: Reliable multimodal rag for factuality in medical vision language models

    Peng Xia, Kangyu Zhu, Haoran Li, Hongtu Zhu, Yun Li, Gang Li, Linjun Zhang, and Huaxiu Yao. Rule: Reliable multimodal rag for factuality in medical vision language models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 1081–1093, 2024

    2024

  67. [75]

    Certifiably robust rag against retrieval corruption

    Chong Xiang, Tong Wu, Zexuan Zhong, David Wagner, Danqi Chen, and Prateek Mittal. Certifiably robust rag against retrieval corruption. arXiv preprint arXiv:2405.15556, 2024

    2024

  68. [76]

    Approximate nearest neighbor negative contrastive learning for dense text retrieval

    Lee Xiong, Chenyan Xiong, Ye Li, Kwok-Fung Tang, Jialin Liu, Paul Bennett, Junaid Ahmed, and Arnold Overwijk. Approximate nearest neighbor negative contrastive learning for dense text retrieval. arXiv preprint arXiv:2007.00808, 2020

    2007 arXiv

  69. [77]

    Recomp: Improving retrieval-augmented lms with compression and selective augmentation

    Fangyuan Xu, Weijia Shi, and Eunsol Choi. Recomp: Improving retrieval-augmented lms with compression and selective augmentation. arXiv preprint arXiv:2310.04408, 2023

    2023 arXiv

  70. [78]

    Badrag: Identifying vulnerabilities in retrieval augmented generation of large language models

    Jiaqi Xue, Mengxin Zheng, Yebowen Hu, Fei Liu, Xun Chen, and Qian Lou. Badrag: Identifying vulnerabilities in retrieval augmented generation of large language models. arXiv preprint arXiv:2406.00083, 2024

    2024 arXiv

  71. [79]

    Enhanced multimodal rag-llm for accurate visual question answering

    Junxiao Xue, Quan Deng, Fei Yu, Yanhao Wang, Jun Wang, and Yuehua Li. Enhanced multimodal rag-llm for accurate visual question answering. arXiv preprint arXiv:2412.20927, 2024. 14

    2024 arXiv

  72. [80]

    Crag-comprehensive rag benchmark

    Xiao Yang, Kai Sun, Hao Xin, Yushi Sun, Nikita Bhalla, Xiangsen Chen, Sajal Choudhary, Rongze Gui, Ziran Jiang, Ziyu Jiang, et al. Crag-comprehensive rag benchmark. Advances in Neural Information Processing Systems, 37:10470–10490, 2024

    2024

  73. [81]

    Hotpotqa: A dataset for diverse, explainable multi-hop question answering

    Zhilin Yang, Peng Qi, Saizheng Zhang, Yoshua Bengio, William W Cohen, Ruslan Salakhut- dinov, and Christopher D Manning. Hotpotqa: A dataset for diverse, explainable multi-hop question answering. arXiv preprint arXiv:1809.09600, 2018

    2018 arXiv

  74. [82]

    Ecosaferag: Ef- ficient security through context analysis in retrieval-augmented generation

    Ruobing Yao, Yifei Zhang, Shuang Song, Neng Gao, and Chenyang Tu. Ecosaferag: Ef- ficient security through context analysis in retrieval-augmented generation. arXiv preprint arXiv:2505.13506, 2025

    2025 arXiv

  75. [83]

    React: Synergizing reasoning and acting in language models

    Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao. React: Synergizing reasoning and acting in language models. In International Conference on Learning Representations, 2023

    2023

  76. [84]

    Visrag: Vision-based retrieval-augmented generation on multi-modality documents

    Shi Yu, Chaoyue Tang, Bokai Xu, Junbo Cui, Junhao Ran, Yukun Yan, Zhenghao Liu, Shuo Wang, Xu Han, Zhiyuan Liu, et al. Visrag: Vision-based retrieval-augmented generation on multi-modality documents. arXiv preprint arXiv:2410.10594, 2024

    arXiv

  77. [85]

    Augmentation-adapted retriever improves generalization of language models as generic plug-in

    Zichun Yu, Chenyan Xiong, Shi Yu, and Zhiyuan Liu. Augmentation-adapted retriever improves generalization of language models as generic plug-in. arXiv preprint arXiv:2305.17331, 2023

    2023 arXiv

  78. [86]

    Rag-driver: Generalisable driving explanations with retrieval-augmented in-context learning in multi-modal large language model

    Jianhao Yuan, Shuyang Sun, Daniel Omeiza, Bo Zhao, Paul Newman, Lars Kunze, and Matthew Gadd. Rag-driver: Generalisable driving explanations with retrieval-augmented in-context learning in multi-modal large language model. arXiv preprint arXiv:2402.10828, 2024

    2024

  79. [87]

    Worse than zero-shot? a fact-checking dataset for evaluating the robustness of rag against misleading retrievals

    Linda Zeng, Rithwik Gupta, Divij Motwani, Diji Yang, and Yi Zhang. Worse than zero-shot? a fact-checking dataset for evaluating the robustness of rag against misleading retrievals. arXiv preprint arXiv:2502.16101, 2025

    2025

  80. [88]

    Prac- tical poisoning attacks against retrieval-augmented generation.arXiv preprint arXiv:2504.03957, 2025

    Baolei Zhang, Yuxi Chen, Minghong Fang, Zhuqing Liu, Lihai Nie, Tong Li, and Zheli Liu. Prac- tical poisoning attacks against retrieval-augmented generation.arXiv preprint arXiv:2504.03957, 2025

    2025

  81. [89]

    Traceback of poisoning attacks to retrieval-augmented generation

    Baolei Zhang, Haoran Xin, Minghong Fang, Zhuqing Liu, Biao Yi, Tong Li, and Zheli Liu. Traceback of poisoning attacks to retrieval-augmented generation. In The Web Conference, 2025

    2025

  82. [90]

    Hijackrag: Hijacking attacks against retrieval-augmented large language models

    Yucheng Zhang, Qinfeng Li, Tianyu Du, Xuhong Zhang, Xinkui Zhao, Zhengwen Feng, and Jianwei Yin. Hijackrag: Hijacking attacks against retrieval-augmented large language models. arXiv preprint arXiv:2410.22832, 2024

    2024 arXiv

  83. [91]

    Retrieval augmented generation and understanding in vision: A survey and new outlook

    Xu Zheng, Ziqiao Weng, Yuanhuiyi Lyu, Lutao Jiang, Haiwei Xue, Bin Ren, Danda Paudel, Nicu Sebe, Luc Van Gool, and Xuming Hu. Retrieval augmented generation and understanding in vision: A survey and new outlook. arXiv preprint arXiv:2503.18016, 2025

    2025 arXiv

  84. [92]

    Poisoning retrieval corpora by injecting adversarial passages

    Zexuan Zhong, Ziqing Huang, Alexander Wettig, and Danqi Chen. Poisoning retrieval corpora by injecting adversarial passages. arXiv preprint arXiv:2310.19156, 2023

    2023 arXiv

  85. [93]

    Trustrag: Enhancing robustness and trustworthiness in rag

    Huichi Zhou, Kin-Hei Lee, Zhonghao Zhan, Yue Chen, Zhenhao Li, Zhaoyang Wang, Hamed Haddadi, and Emine Yilmaz. Trustrag: Enhancing robustness and trustworthiness in rag. arXiv preprint arXiv:2501.00879, 2025

    2025 arXiv

  86. [94]

    Trustworthiness in retrieval-augmented generation systems: A survey

    Yujia Zhou, Yan Liu, Xiaoxi Li, Jiajie Jin, Hongjin Qian, Zheng Liu, Chaozhuo Li, Zhicheng Dou, Tsung-Yi Ho, and Philip S Yu. Trustworthiness in retrieval-augmented generation systems: A survey. arXiv preprint arXiv:2409.10102, 2024

    2024 arXiv

  87. [95]

    Black-Box Opinion Manipulation Attacks to Retrieval- Augmented Generation of Large Language Models

    Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. Poisonedrag: Knowledge poisoning attacks to retrieval-augmented generation of large language models. In USENIX Security Symposium, 2025. 15 Appendix The appendix is structured as follows. • Appendix A: System Prompt. • Appe...

    2025

  88. [96]

    Dialogue format requirements: - Each turn consists of a human question and an AI assistant response - The first 4 turns include both human questions and AI assistant responses - The 5th turn contains only the human question, with no AI assistant response

  89. [97]

    Dialogue content requirements: - The dialogue should be natural and fluent, resembling a realistic conversation - Earlier turns should gradually lead toward the target question - The dialogue content should maintain consistency and coherence - Human questions should be diverse...

  90. [98]

    Naming and reference requirements: - The key nouns and entities from the target question should appear explicitly in the human questions within the first 4 turns, establishing clear context - In the 5th turn, the human question should avoid directly repeating these key nouns; ...

  91. [99]

    class" (standalone or non-standalone) and the

    Final turn requirements: - The human question in the 5th turn must achieve the same goal as the provided target question - However, this final question should be significantly different in wording and structure from the target question - The final question should be concise an...

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.