{"as_of":"2026-08-08T15:27:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:52a5787e70b8e7602c46af1d795931062af0f2586c03180d9404a16930ccc7b8","coverage":[{"denominator":99,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":99,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-07T14:33:01.360877Z","state":"measured"},{"denominator":108,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":108,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-08T06:32:00.761636+00:00","state":"measured"},{"denominator":9,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":9,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-05T15:18:36.938530Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":1,"source":"arxiv_reference","source_observed_at":"2026-08-05T02:28:24.338817Z","state":"measured"}],"external_citation_measurements":[{"count":0,"observed_at":"2026-08-05T02:28:24.338817Z","source":"arxiv_reference"}],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.18543","snapshot_observed_at":"2026-08-05T15:18:36.938530Z","title":"Benchmarking poi- soning attacks against retrieval-augmented generation","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2508.20083","last_updated":"2026-07-19T08:24:06Z","snapshot_observed_at":"2026-08-06T12:59:49.846974Z","submitted_at":"2025-08-27T17:49:28Z","title":"DisarmRAG: Stealthy Retriever-Centric Poisoning to Disable Self-Correction in Retrieval-Augmented Generation (Extended Version)","version":2},"reference_index":81,"source":"pdf_text","source_observed_at":"2026-08-05T15:18:36.938530Z"},"links":{"cited_paper":"/paper/2505.18543","citing_paper":"/paper/2508.20083"},"observation_digest":"sha256:a5db76a3600f2a156a867baeb79010cf420cc77a31c6a70283b32695885c7c7f","observation_id":"ad58ddcf-7096-454f-a151-4e085f27729b","resolution":{"observed_at":"2026-08-05T15:18:36.938530Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.18543","snapshot_observed_at":"2026-08-04T14:43:56.610925Z","title":"Benchmarking poisoning attacks against retrieval-augmented generation","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.23694","last_updated":"2026-06-03T04:13:57Z","snapshot_observed_at":"2026-08-04T14:43:33.365212Z","submitted_at":"2025-09-28T07:05:17Z","title":"SafeSearch: Automated Red-Teaming of LLM-Based Search Agents","version":6},"reference_index":69,"source":"arxiv_source","source_observed_at":"2026-08-04T14:43:56.610925Z"},"links":{"cited_paper":"/paper/2505.18543","citing_paper":"/paper/2509.23694"},"observation_digest":"sha256:9ca6b40b7022de48b648695ebd0ff24211adda2a7c00723a3e394dab01c27065","observation_id":"ab14dd36-08ab-453a-9f47-4b60ddb3c842","resolution":{"observed_at":"2026-08-04T14:43:56.610925Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.18543","snapshot_observed_at":"2026-08-03T03:04:47.779862Z","title":"Benchmarking poisoning attacks against retrieval- augmented generation.arXiv preprint arXiv:2505.18543, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2602.09319","last_updated":"2026-06-08T20:08:22Z","snapshot_observed_at":"2026-08-08T00:41:54.596301Z","submitted_at":"2026-02-10T01:27:46Z","title":"Benchmarking Knowledge-Extraction Attack and Defense on Retrieval-Augmented Generation","version":3},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-03T03:04:47.779862Z"},"links":{"cited_paper":"/paper/2505.18543","citing_paper":"/paper/2602.09319"},"observation_digest":"sha256:586f4942e11c4b402aa9bb67fa15ca3db80409335119530388dfeb83697524ad","observation_id":"1717e7d8-6ee6-49d4-8634-cf2877b4504e","resolution":{"observed_at":"2026-08-03T03:04:47.779862Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"cited_work":{"arxiv_id":"2505.18543","doi":"10.48550/arxiv.2505.18543","metadata_source":"arxiv_reference","pith_arxiv_id":"2505.18543","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Benchmarking poisoning attacks against retrieval- augmented generation","venue":"ArXiv.org","work_id":"ed956317-f245-44d0-b530-4f127e4f452d","year":2025},"citing_paper":{"arxiv_id":"2604.00387","last_updated":"2026-04-04T07:18:50Z","snapshot_observed_at":"2026-08-04T09:28:38.404006Z","submitted_at":"2026-04-01T02:16:42Z","title":"RAGShield: Detecting Numerical Claim Manipulation in Government RAG Systems","version":2},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-05-13T23:14:47.704353Z"},"links":{"cited_paper":"/paper/2505.18543","citing_paper":"/paper/2604.00387"},"observation_digest":"sha256:2d8374c0a1cf33b31cd743d3bd98336d4413d9e97ec98eca7a399000b9f4f82f","observation_id":"d62086f3-1289-4a9d-9122-28d30bf569f6","resolution":{"observed_at":"2026-05-13T23:18:25.905684Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"cited_work":{"arxiv_id":"2505.18543","doi":"10.48550/arxiv.2505.18543","metadata_source":"arxiv_reference","pith_arxiv_id":"2505.18543","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Benchmarking poisoning attacks against retrieval- augmented generation","venue":"ArXiv.org","work_id":"ed956317-f245-44d0-b530-4f127e4f452d","year":2025},"citing_paper":{"arxiv_id":"2604.18663","last_updated":"2026-04-20T12:33:52Z","snapshot_observed_at":"2026-07-06T23:05:30.879164Z","submitted_at":"2026-04-20T12:33:52Z","title":"Beyond Explicit Refusals: Soft-Failure Attacks on Retrieval-Augmented Generation","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-05-10T04:56:37.758533Z"},"links":{"cited_paper":"/paper/2505.18543","citing_paper":"/paper/2604.18663"},"observation_digest":"sha256:292bd0dc2fa3e0aa9865e2a32da6473f45a878eb67323679d32e88d633026043","observation_id":"34db4841-77b2-405e-9cc4-9e5b2f3cae30","resolution":{"observed_at":"2026-05-10T11:05:08.995921Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"cited_work":{"arxiv_id":"2505.18543","doi":"10.48550/arxiv.2505.18543","metadata_source":"arxiv_reference","pith_arxiv_id":"2505.18543","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Benchmarking poisoning attacks against retrieval- augmented generation","venue":"ArXiv.org","work_id":"ed956317-f245-44d0-b530-4f127e4f452d","year":2025},"citing_paper":{"arxiv_id":"2605.01782","last_updated":"2026-05-03T08:42:29Z","snapshot_observed_at":"2026-07-31T09:19:52.528360Z","submitted_at":"2026-05-03T08:42:29Z","title":"Needle-in-RAG: Prompt-Conditioned Character-Level Traceback of Poisoned Spans in Retrieved Evidence","version":1},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-05-10T14:52:32.202125Z"},"links":{"cited_paper":"/paper/2505.18543","citing_paper":"/paper/2605.01782"},"observation_digest":"sha256:8b4a65543b17f9df6bafcf5bad24db083ee94f427f23d3bbcf1b56c2bb248b81","observation_id":"1a48d20e-4d14-47e9-8eec-0afedf1b35b6","resolution":{"observed_at":"2026-05-11T11:31:00.568084Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"cited_work":{"arxiv_id":"2505.18543","doi":"10.48550/arxiv.2505.18543","metadata_source":"arxiv_reference","pith_arxiv_id":"2505.18543","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Benchmarking poisoning attacks against retrieval- augmented generation","venue":"ArXiv.org","work_id":"ed956317-f245-44d0-b530-4f127e4f452d","year":2025},"citing_paper":{"arxiv_id":"2605.09822","last_updated":"2026-05-10T23:55:13Z","snapshot_observed_at":"2026-08-05T13:34:08.474381Z","submitted_at":"2026-05-10T23:55:13Z","title":"Oracle Poisoning: Corrupting Knowledge Graphs to Weaponise AI Agent Reasoning","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-05-12T02:27:06.805794Z"},"links":{"cited_paper":"/paper/2505.18543","citing_paper":"/paper/2605.09822"},"observation_digest":"sha256:2cf12470eadc6c6097eacc59dd9d5b3745b9e4fbda82e0256b07d0758eefdf1b","observation_id":"83afcb06-1e9c-4027-a6cc-d3f14ce00e72","resolution":{"observed_at":"2026-05-12T07:37:03.462355Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"cited_work":{"arxiv_id":"2505.18543","doi":"10.48550/arxiv.2505.18543","metadata_source":"arxiv_reference","pith_arxiv_id":"2505.18543","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Benchmarking poisoning attacks against retrieval- augmented generation","venue":"ArXiv.org","work_id":"ed956317-f245-44d0-b530-4f127e4f452d","year":2025},"citing_paper":{"arxiv_id":"2605.28074","last_updated":"2026-05-27T07:30:30Z","snapshot_observed_at":"2026-08-02T21:44:55.814873Z","submitted_at":"2026-05-27T07:30:30Z","title":"SilentRetrieval: Hijacking Retrieval-Augmented Generation via Semantically-Preserving Adversarial Data Poisoning","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-06-29T11:49:32.880569Z"},"links":{"cited_paper":"/paper/2505.18543","citing_paper":"/paper/2605.28074"},"observation_digest":"sha256:c0e2292a1411337b8f273efc867a8bf95bebc6013044e390eda3b8bc14eb1d02","observation_id":"d41c560b-076f-4b89-bed5-7b7230de202b","resolution":{"observed_at":"2026-06-29T11:53:23.247611Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.18543","snapshot_observed_at":"2026-07-30T10:56:48.116996Z","title":"Benchmarking poisoning attacks against retrieval- augmented generation,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.23838","last_updated":"2026-07-26T20:52:23Z","snapshot_observed_at":"2026-08-05T00:15:21.105413Z","submitted_at":"2026-07-26T20:52:23Z","title":"TriShieldRAG: A Three-Ring Defense-in-Depth Framework Against Knowledge Corruption in Retrieval-Augmented Generation","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-07-30T10:56:48.116996Z"},"links":{"cited_paper":"/paper/2505.18543","citing_paper":"/paper/2607.23838"},"observation_digest":"sha256:a9b44f2529a2e7ee516381164d89e10032f99b733d6b9c3a3af9a929eeb5cec7","observation_id":"61e0e649-2c5d-45e0-ba93-81d2ba35811d","resolution":{"observed_at":"2026-07-30T10:56:48.116996Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2505.18543/citation-record","integrity":"/paper/2505.18543/integrity","json":"/paper/2505.18543/citation-record.json","paper":"/paper/2505.18543"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:54.584518Z","title":"https://www.anthropic.com/news/claude-3-7-sonnet","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:54.584518Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:c24228d5d8647e1390c11c48b4f24f0e8af17f4b6b70d207c560756bee408b07","observation_id":"eb515526-36eb-4ddb-ac1d-6403d158fcc6","resolution":{"observed_at":"2026-08-07T14:32:54.584518Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:54.611951Z","title":"https://blog.google/ technology/google-deepmind/google-gemini-ai-update-december-2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:54.611951Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:bec25627fb106483ed3b971338309b3378211a72c8d34ce4395761b16c0b0308","observation_id":"ae8db373-cc3f-40cb-a7de-59a73978ca30","resolution":{"observed_at":"2026-08-07T14:32:54.611951Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:54.633958Z","title":"https://openai.com/index/gpt-4-1","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:54.633958Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:366e624be0e5b7e803703d880c779970d257426673bf7090aa2cddbb53e17860","observation_id":"0857b61f-942c-4c97-bef6-67570aa588ab","resolution":{"observed_at":"2026-08-07T14:32:54.633958Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:54.681873Z","title":"https://modelcontextprotocol.io/ introduction","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:54.681873Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:84a6fdf7a4cf12145c2ff89880ed85f543a0f093a186ff9fa70904080228fb60","observation_id":"643ff895-629f-499f-ac38-a81905bcf1a5","resolution":{"observed_at":"2026-08-07T14:32:54.681873Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:54.740720Z","title":"https://www.llama.com/models/llama-4","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:54.740720Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:22e7fae32586be94bb76c46331f76e08af41216081d4c8b98c86c652c33ba2af","observation_id":"58c03155-f4a8-40ac-9815-68c44326f6db","resolution":{"observed_at":"2026-08-07T14:32:54.740720Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:54.758341Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:54.758341Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:c92a3ae4690879e7d6f60c0c5194d6b6853551c1c3a72fc27669df8b76588cb8","observation_id":"6e4f394b-0e7b-49e4-93df-4e9fc216083a","resolution":{"observed_at":"2026-08-07T14:32:54.758341Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2303.08774","last_updated":"2024-03-04T06:01:33Z","snapshot_observed_at":"2026-08-07T07:30:12.213965Z","submitted_at":"2023-03-15T17:15:04Z","title":"GPT-4 Technical Report","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.08774","snapshot_observed_at":"2026-08-07T14:32:54.807646Z","title":"Gpt-4 technical report","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:54.807646Z"},"links":{"cited_paper":"/paper/2303.08774","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:cd278839df7ccc8ce8c5e7725f35b3193d02e3d3e1e97ad723a97864a21182e4","observation_id":"7023bea6-c370-4cc5-a31c-916988a544f6","resolution":{"observed_at":"2026-08-07T14:32:54.807646Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:54.846051Z","title":"Trec ikat 2023: A test collection for evaluating conversational and interactive knowledge assistants","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:54.846051Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:c7b61e82b91b4dfbbd1947ab7b9b55ec412fa50d7f2456fafe3747cf392099ba","observation_id":"64299fff-671c-49d4-aaf4-19f231b63137","resolution":{"observed_at":"2026-08-07T14:32:54.846051Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.10403","last_updated":"2023-09-13T20:35:45Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-05-17T17:46:53Z","title":"PaLM 2 Technical Report","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.10403","snapshot_observed_at":"2026-08-07T14:32:54.871001Z","title":"Palm 2 technical report","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:54.871001Z"},"links":{"cited_paper":"/paper/2305.10403","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:12e5c3fab47612e1145f591d82f112351073f19016111a76643219114b7e1a40","observation_id":"aba5cffd-0f26-43ef-92b9-ea45c14f564c","resolution":{"observed_at":"2026-08-07T14:32:54.871001Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:54.920453Z","title":"Improving language models by retrieving from trillions of tokens","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:54.920453Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:6d45c16243ba48e3dff1965c0c3096a24c61a01c3f7df65e6a18b2e6868da955","observation_id":"c43278b2-fc8d-4757-b363-d31da86312d4","resolution":{"observed_at":"2026-08-07T14:32:54.920453Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:55.070616Z","title":"Language models are few-shot learners","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:55.070616Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:a8a222d8933ee646435d113ad2e5b7094a6f1ea2d288f5d71e7c1c374899ac67","observation_id":"23918784-0ac5-4ee5-b537-342b8cfdf8ea","resolution":{"observed_at":"2026-08-07T14:32:55.070616Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:55.208722Z","title":"Poisoning web-scale training datasets is practical","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:55.208722Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:3481d15c186a4aa5f57c4d0e8761e3920045de66ed83032a1df4b561a72b7420","observation_id":"38dc0dc6-1b9b-4457-8321-342623c23181","resolution":{"observed_at":"2026-08-07T14:32:55.208722Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.00610","last_updated":"2024-03-31T08:58:54Z","snapshot_observed_at":"2026-08-07T00:34:30.401578Z","submitted_at":"2024-03-31T08:58:54Z","title":"RQ-RAG: Learning to Refine Queries for Retrieval Augmented Generation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.00610","snapshot_observed_at":"2026-08-07T14:32:55.354259Z","title":"Rq-rag: Learning to refine queries for retrieval augmented generation","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:55.354259Z"},"links":{"cited_paper":"/paper/2404.00610","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:d4ca6f049ab7a167fa1470f0c087de171c994f4f6558c6d7a121a9255acd8e7e","observation_id":"fa32781c-72a6-42de-83ed-2a3ed211942f","resolution":{"observed_at":"2026-08-07T14:32:55.354259Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.11548","last_updated":"2026-04-09T01:58:59Z","snapshot_observed_at":"2026-07-06T21:25:13.481613Z","submitted_at":"2025-05-15T08:14:58Z","title":"One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.11548","snapshot_observed_at":"2026-08-07T14:32:55.442214Z","title":"One shot dominance: Knowledge poisoning attack on retrieval-augmented generation systems","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:55.442214Z"},"links":{"cited_paper":"/paper/2505.11548","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:397d1e71425b46a2c5a4626654d01659cfebe9fc118e77f075c889c78d37a599","observation_id":"64cfae5a-c39a-413e-966f-63f4d9274ef6","resolution":{"observed_at":"2026-08-07T14:32:55.442214Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:55.545101Z","title":"Phantom: General trigger attacks on retrieval augmented language generation","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:55.545101Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:2cf665b4d31120d05681679aae3be69fcd93e05b56db3a3002db54ee98b4a4a9","observation_id":"4c67b0c5-ddc2-4d7f-acf8-be75083c4300","resolution":{"observed_at":"2026-08-07T14:32:55.545101Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:55.637930Z","title":"Benchmarking large language mod- els in retrieval-augmented generation","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:55.637930Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:307ac99856366326180d32452c0a941be4d9bde6bd9dabd1419286b660fbe1b4","observation_id":"50c12053-cd4b-4c95-ba21-572ceb7fb9e2","resolution":{"observed_at":"2026-08-07T14:32:55.637930Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2210.02928","last_updated":"2022-10-20T17:16:27Z","snapshot_observed_at":"2026-08-06T23:46:49.824788Z","submitted_at":"2022-10-06T13:58:03Z","title":"MuRAG: Multimodal Retrieval-Augmented Generator for Open Question Answering over Images and Text","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2210.02928","snapshot_observed_at":"2026-08-07T14:32:55.658464Z","title":"Murag: Multimodal retrieval-augmented generator for open question answering over images and text","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:55.658464Z"},"links":{"cited_paper":"/paper/2210.02928","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:bd7eb8fc21e01fafee29b5c7cec75f9d83ca9704eadf667d45783380678e1b4b","observation_id":"cc5f52d0-1f83-43f5-b11b-3be84cc33e1f","resolution":{"observed_at":"2026-08-07T14:32:55.658464Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2302.11713","last_updated":"2023-10-17T14:19:13Z","snapshot_observed_at":"2026-08-07T03:19:53.953867Z","submitted_at":"2023-02-23T00:33:54Z","title":"Can Pre-trained Vision and Language Models Answer Visual Information-Seeking Questions?","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2302.11713","snapshot_observed_at":"2026-08-07T14:32:55.697518Z","title":"Can pre-trained vision and language models answer visual information-seeking questions? arXiv preprint arXiv:2302.11713, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:55.697518Z"},"links":{"cited_paper":"/paper/2302.11713","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:ed8b7f3aff3417d5de32cf6143afb738ec64ce27262e8e235644e805726be902","observation_id":"c1780cfb-b22e-4278-807b-4b7dcdd9248a","resolution":{"observed_at":"2026-08-07T14:32:55.697518Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:55.773914Z","title":"Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:55.773914Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:de7f6c762dfccdb2ddb2333dca23c04e7beec0641f0555bdb23678c2ba660a6b","observation_id":"cd8320f5-4d1a-443a-9a54-047f25fc888a","resolution":{"observed_at":"2026-08-07T14:32:55.773914Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:55.887118Z","title":"Flipedrag: Black-box opinion manipulation attacks to retrieval- augmented generation of large language models","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:55.887118Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:fb394a3d129602d093e55215b49441f229b3ef9a19651623be53b54e98ccc4aa","observation_id":"d4bf530a-d7be-4bf1-8238-a5dbb768c4b2","resolution":{"observed_at":"2026-08-07T14:32:55.887118Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.13401","last_updated":"2024-07-07T05:03:53Z","snapshot_observed_at":"2026-07-06T18:17:46.369537Z","submitted_at":"2024-05-22T07:21:32Z","title":"TrojanRAG: Retrieval-Augmented Generation Can Be Backdoor Driver in Large Language Models","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.13401","snapshot_observed_at":"2026-08-07T14:32:55.989945Z","title":"Trojanrag: Retrieval-augmented generation can be backdoor driver in large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:55.989945Z"},"links":{"cited_paper":"/paper/2405.13401","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:a5bd62a16ab2f03b44c91a8cdeb635a719155b119f9bb3c87dbaf4dadbd1670d","observation_id":"c6a40ba3-7413-49b3-ba06-8121ceb5ab82","resolution":{"observed_at":"2026-08-07T14:32:55.989945Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.23090","last_updated":"2024-10-30T15:06:32Z","snapshot_observed_at":"2026-07-06T19:42:16.943127Z","submitted_at":"2024-10-30T15:06:32Z","title":"CORAL: Benchmarking Multi-turn Conversational Retrieval-Augmentation Generation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.23090","snapshot_observed_at":"2026-08-07T14:32:56.150927Z","title":"Coral: Benchmarking multi-turn conversational retrieval-augmentation generation","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.150927Z"},"links":{"cited_paper":"/paper/2410.23090","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:4675f45fc708489e25fd16bbb1216be9855757caf99122b1ef840ca64a6b560c","observation_id":"c2dcd335-ad68-4fca-a280-e63feeea52f7","resolution":{"observed_at":"2026-08-07T14:32:56.150927Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.13948","last_updated":"2024-10-22T14:07:57Z","snapshot_observed_at":"2026-07-06T18:03:33.406287Z","submitted_at":"2024-04-22T07:49:36Z","title":"Typos that Broke the RAG's Back: Genetic Attack on RAG Pipeline by Simulating Documents in the Wild via Low-level Perturbations","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.13948","snapshot_observed_at":"2026-08-07T14:32:56.319699Z","title":"Typos that broke the rag’s back: Genetic attack on rag pipeline by simulating documents in the wild via low-level perturbations","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.319699Z"},"links":{"cited_paper":"/paper/2404.13948","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:72ae1fe5700aa9e351d06919728fd46380d5592c015079b411f8e9cff93b0dda","observation_id":"5e4051a2-0940-449c-bbcc-940cfc2150f4","resolution":{"observed_at":"2026-08-07T14:32:56.319699Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:56.452133Z","title":"The rag paradox: A black-box attack exploiting unintentional vulnerabilities in retrieval-augmented generation systems","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.452133Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:d5ba34681bb5471e121a63abb55e6e0766739247dce995b7b517b49a2d44a3cc","observation_id":"af08a444-e465-442d-913d-d06fea622b93","resolution":{"observed_at":"2026-08-07T14:32:56.452133Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1905.10044","last_updated":"2019-05-24T05:48:49Z","snapshot_observed_at":"2026-07-06T07:55:12.121264Z","submitted_at":"2019-05-24T05:48:49Z","title":"BoolQ: Exploring the Surprising Difficulty of Natural Yes/No Questions","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1905.10044","snapshot_observed_at":"2026-08-07T14:32:56.493361Z","title":"Boolq: Exploring the surprising difficulty of natural yes/no questions","venue":null,"work_id":null,"year":1905},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.493361Z"},"links":{"cited_paper":"/paper/1905.10044","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:36d496256e54662c0a55fcfdedd78be4b1e79c3891e20e1796ffe44de548b5e7","observation_id":"0cd633ec-05aa-4362-ab10-094ec0fb47af","resolution":{"observed_at":"2026-08-07T14:32:56.493361Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:56.531007Z","title":"The power of noise: Redefining retrieval for rag systems","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.531007Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:ff141b5cb82031225639b213adf91006f22f8d923f09c31f4477386a1822f1bb","observation_id":"2e4aeb03-d6d5-4a7a-92dc-0872acf117ef","resolution":{"observed_at":"2026-08-07T14:32:56.531007Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.10997","last_updated":"2024-03-27T09:16:57Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-12-18T07:47:33Z","title":"Retrieval-Augmented Generation for Large Language Models: A Survey","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.10997","snapshot_observed_at":"2026-08-07T14:32:56.573813Z","title":"Retrieval-augmented generation for large language models: A survey","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.573813Z"},"links":{"cited_paper":"/paper/2312.10997","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:5d8ade88d4e215862b7dfc4ed8d5294ab3befd2f281c55a7fcee9d4f6e5961d3","observation_id":"9d2fd507-02b2-4ea7-b9a0-48579515f91d","resolution":{"observed_at":"2026-08-07T14:32:56.573813Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:56.680823Z","title":"Did aristotle use a laptop? a question answering benchmark with implicit reasoning strategies","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.680823Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:085d1bb9ea9e9563be1322f335e2c652da3dbf16924199a4da2292db66123bb5","observation_id":"3a2643ec-c27c-4d98-971e-af52f1cc1db8","resolution":{"observed_at":"2026-08-07T14:32:56.680823Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:56.692225Z","title":"Topic-fliprag: Topic-orientated adversarial opinion manipulation attacks to retrieval-augmented generation models","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.692225Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:55ab8680be69ed4f491198b945ce4dbb88f4139c9803503d35ae97100bceb059","observation_id":"e8743175-d732-43ce-b914-a907cefe0218","resolution":{"observed_at":"2026-08-07T14:32:56.692225Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2501.12948","last_updated":"2026-01-04T03:57:36Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-01-22T15:19:35Z","title":"DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2501.12948","snapshot_observed_at":"2026-08-07T14:32:56.696425Z","title":"Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.696425Z"},"links":{"cited_paper":"/paper/2501.12948","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:5fa55d50f5e968597fe9614b9fe87a638c126e474fe8af1b3930b30a8576e029","observation_id":"c0b00558-31dd-4191-a7ce-c8bbc7b5da10","resolution":{"observed_at":"2026-08-07T14:32:56.696425Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.21276","last_updated":"2024-10-25T17:43:01Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-10-25T17:43:01Z","title":"GPT-4o System Card","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.21276","snapshot_observed_at":"2026-08-07T14:32:56.786445Z","title":"Gpt-4o system card","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.786445Z"},"links":{"cited_paper":"/paper/2410.21276","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:d554f5b6b1315ace9b2a679cd8b4c90f1ded196866371adcfb121e0ff4975059","observation_id":"da75b75a-9208-4cc9-a5a5-c2e6981ba25d","resolution":{"observed_at":"2026-08-07T14:32:56.786445Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2112.09118","last_updated":"2022-08-29T12:17:32Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2021-12-16T18:57:37Z","title":"Unsupervised Dense Information Retrieval with Contrastive Learning","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2112.09118","snapshot_observed_at":"2026-08-07T14:32:56.815949Z","title":"Unsupervised dense information retrieval with contrastive learning","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.815949Z"},"links":{"cited_paper":"/paper/2112.09118","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:f6333deb3c4a2fda6cdd6425a25364129ab14b27dce00536d1ec720fd34eaf2f","observation_id":"fbd9e164-e37c-4b57-956f-3305db231dda","resolution":{"observed_at":"2026-08-07T14:32:56.815949Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.00614","last_updated":"2023-09-04T17:47:36Z","snapshot_observed_at":"2026-07-06T16:13:23.343694Z","submitted_at":"2023-09-01T17:59:44Z","title":"Baseline Defenses for Adversarial Attacks Against Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.00614","snapshot_observed_at":"2026-08-07T14:32:56.855487Z","title":"Baseline de- fenses for adversarial attacks against aligned language models.arXiv preprint arXiv:2309.00614, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.855487Z"},"links":{"cited_paper":"/paper/2309.00614","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:ad7d651dc21f36ec946528406f54839faf5ee6e0822f3c78a68b7d201840e380","observation_id":"f16bfc5d-3549-4832-ab58-81d609ddc017","resolution":{"observed_at":"2026-08-07T14:32:56.855487Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:56.885628Z","title":"Interpolated estimation of markov source parameters from sparse data","venue":null,"work_id":null,"year":1980},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.885628Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:6232483250e21fb0622de5b40de53bd900a303d29c5b3fca301c12c277bafbd1","observation_id":"b5043607-4dc8-4f12-bf13-abc547788d41","resolution":{"observed_at":"2026-08-07T14:32:56.885628Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.14403","last_updated":"2024-03-28T06:45:11Z","snapshot_observed_at":"2026-08-04T09:23:59.079378Z","submitted_at":"2024-03-21T13:52:30Z","title":"Adaptive-RAG: Learning to Adapt Retrieval-Augmented Large Language Models through Question Complexity","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.14403","snapshot_observed_at":"2026-08-07T14:32:56.955402Z","title":"Adaptive-rag: Learning to adapt retrieval-augmented large language models through question complexity","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:56.955402Z"},"links":{"cited_paper":"/paper/2403.14403","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:a2d6dce6bbaa872996111fe5087f0c1011b8553a8a2a8841daf101728b24f621","observation_id":"00b2ce9f-8a68-46c1-9a83-0d7152b1a3bf","resolution":{"observed_at":"2026-08-07T14:32:56.955402Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.14110","last_updated":"2025-08-08T11:56:30Z","snapshot_observed_at":"2026-08-02T10:24:11.927887Z","submitted_at":"2024-11-21T13:18:03Z","title":"Feedback-Guided Extraction of Knowledge Base from Retrieval-Augmented LLM Applications","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2411.14110","snapshot_observed_at":"2026-08-07T14:32:57.001435Z","title":"Rag-thief: Scalable extraction of private data from retrieval-augmented generation applications with agent-based attacks","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.001435Z"},"links":{"cited_paper":"/paper/2411.14110","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:997ff6ed4d64143e84cd00b713b773a184f821a778c51a0103432074ccfea4cc","observation_id":"11ef88db-0564-4add-aea8-30e540ca2488","resolution":{"observed_at":"2026-08-07T14:32:57.001435Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.06983","last_updated":"2023-10-22T00:11:13Z","snapshot_observed_at":"2026-07-06T15:26:06.998516Z","submitted_at":"2023-05-11T17:13:40Z","title":"Active Retrieval Augmented Generation","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.06983","snapshot_observed_at":"2026-08-07T14:32:57.036232Z","title":"Active retrieval augmented generation","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.036232Z"},"links":{"cited_paper":"/paper/2305.06983","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:6295fd930352add8180fff6b0dd723bf44839e8397221b74d55d78078ea13ecf","observation_id":"ce9e1479-6608-4898-b3ed-06f61f811288","resolution":{"observed_at":"2026-08-07T14:32:57.036232Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.07717","last_updated":"2025-06-20T10:23:40Z","snapshot_observed_at":"2026-08-07T16:06:52.667333Z","submitted_at":"2025-04-10T13:09:50Z","title":"PR-Attack: Coordinated Prompt-RAG Attacks on Retrieval-Augmented Generation in Large Language Models via Bilevel Optimization","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.07717","snapshot_observed_at":"2026-08-07T14:32:57.110743Z","title":"Pr-attack: Coordinated prompt-rag attacks on retrieval-augmented generation in large language models via bilevel optimization","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.110743Z"},"links":{"cited_paper":"/paper/2504.07717","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:2b12911972abd730928511ec96d08b4bf557b9fdcbdb5a6afee4ed0959c5cd12","observation_id":"78610109-bc3a-4a30-a63e-a61d16299297","resolution":{"observed_at":"2026-08-07T14:32:57.110743Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.13576","last_updated":"2025-02-24T02:46:52Z","snapshot_observed_at":"2026-08-08T09:22:36.004067Z","submitted_at":"2024-05-22T12:12:40Z","title":"FlashRAG: A Modular Toolkit for Efficient Retrieval-Augmented Generation Research","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.13576","snapshot_observed_at":"2026-08-07T14:32:57.144351Z","title":"Flashrag: A modular toolkit for efficient retrieval-augmented generation research","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.144351Z"},"links":{"cited_paper":"/paper/2405.13576","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:6cba199a69a2a85b421d2f77c62ee7eeac0e495b22f06f93b517d048fe67dd97","observation_id":"e3930e9d-7551-46ad-b14b-e66ab494071f","resolution":{"observed_at":"2026-08-07T14:32:57.144351Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2004.04906","last_updated":"2020-09-30T21:27:13Z","snapshot_observed_at":"2026-07-06T09:11:26.109763Z","submitted_at":"2020-04-10T04:53:17Z","title":"Dense Passage Retrieval for Open-Domain Question Answering","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2004.04906","snapshot_observed_at":"2026-08-07T14:32:57.180310Z","title":"Dense passage retrieval for open-domain question answering","venue":null,"work_id":null,"year":2004},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.180310Z"},"links":{"cited_paper":"/paper/2004.04906","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:bf1d53ffab6a3a0548a5c7b09f48a9f1537680e122394607ba3ab9894177341f","observation_id":"759c364f-7a02-4b20-9ba5-983c77c6b480","resolution":{"observed_at":"2026-08-07T14:32:57.180310Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2501.03468","last_updated":"2025-01-07T01:52:56Z","snapshot_observed_at":"2026-07-06T20:17:24.683086Z","submitted_at":"2025-01-07T01:52:56Z","title":"MTRAG: A Multi-Turn Conversational Benchmark for Evaluating Retrieval-Augmented Generation Systems","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2501.03468","snapshot_observed_at":"2026-08-07T14:32:57.233051Z","title":"Mtrag: A multi-turn conversational benchmark for evaluating retrieval-augmented generation systems.arXiv preprint arXiv:2501.03468, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.233051Z"},"links":{"cited_paper":"/paper/2501.03468","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:3632e8a59d2522b876e2b20129f11166daf8439f1f39ab81a567f15b85b28141","observation_id":"b814be3e-e3fc-48e9-8bed-c17ed713b0eb","resolution":{"observed_at":"2026-08-07T14:32:57.233051Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.13081","last_updated":"2024-04-17T01:15:54Z","snapshot_observed_at":"2026-07-06T18:02:53.240463Z","submitted_at":"2024-04-17T01:15:54Z","title":"SuRe: Summarizing Retrievals using Answer Candidates for Open-domain QA of LLMs","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.13081","snapshot_observed_at":"2026-08-07T14:32:57.295105Z","title":"Sure: Summarizing retrievals using answer candidates for open-domain qa of llms","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.295105Z"},"links":{"cited_paper":"/paper/2404.13081","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:f317ca4291830a5ce8db75eda589a2b840bcf5859fd9bea98c4898dad880f467","observation_id":"752c2593-87c5-4ba8-a28c-f27132dbc365","resolution":{"observed_at":"2026-08-07T14:32:57.295105Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2409.12558","last_updated":"2025-02-21T19:04:28Z","snapshot_observed_at":"2026-07-06T19:18:04.618039Z","submitted_at":"2024-09-19T08:26:45Z","title":"RAD-Bench: Evaluating Large Language Models Capabilities in Retrieval Augmented Dialogues","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.12558","snapshot_observed_at":"2026-08-07T14:32:57.345015Z","title":"Rad-bench: Evaluating large language models capabilities in retrieval augmented dia- logues","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.345015Z"},"links":{"cited_paper":"/paper/2409.12558","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:f2a04928d61b3ac37d85f44a0c4999b2d7dac4336d7f34c0432e4b006b2d4624","observation_id":"3748f086-724c-41fd-a4f5-1bb7ec0b7c11","resolution":{"observed_at":"2026-08-07T14:32:57.345015Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:57.398975Z","title":"Natural questions: a benchmark for question answering research","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.398975Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:bec71b6478066df6b67941a5fe7582b5fb9253484cd2bc653a82572708c9456f","observation_id":"f386655e-c817-471e-9fe2-c9f55c3f2ae5","resolution":{"observed_at":"2026-08-07T14:32:57.398975Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.16701","last_updated":"2025-08-30T16:41:13Z","snapshot_observed_at":"2026-08-04T23:45:22.277732Z","submitted_at":"2024-12-21T16:59:00Z","title":"AlzheimerRAG: Multimodal Retrieval Augmented Generation for Clinical Use Cases using PubMed articles","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.16701","snapshot_observed_at":"2026-08-07T14:32:57.426171Z","title":"Alzheimerrag: Multimodal retrieval augmented generation for pubmed articles","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.426171Z"},"links":{"cited_paper":"/paper/2412.16701","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:178cd906075715e046b43d6f6d803b8616566a0903841eaf53b9bbb6f8b7fd12","observation_id":"0edb92d7-7eee-4ece-8bd8-34a34f868674","resolution":{"observed_at":"2026-08-07T14:32:57.426171Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:57.461562Z","title":"Retrieval-augmented generation for knowledge-intensive nlp tasks","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.461562Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:0d04cb75031335257e76c4daf0420c8f1ce7653889992677a232c28aba21b601","observation_id":"894c6faf-ea8b-46d8-b131-31dafac7bfc8","resolution":{"observed_at":"2026-08-07T14:32:57.461562Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:57.498679Z","title":"Seeing is believing: Black-box member- ship inference attacks against retrieval augmented generation","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.498679Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:366eb0c4f32cd85b84bb770dfbb6dda8cbf3fb6c24cdee08ff02d35b3830f67f","observation_id":"729a7a0f-0f24-42ec-a575-6b483fbbb14c","resolution":{"observed_at":"2026-08-07T14:32:57.498679Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2501.18636","last_updated":"2025-02-23T10:46:28Z","snapshot_observed_at":"2026-07-06T20:28:38.345613Z","submitted_at":"2025-01-28T17:01:31Z","title":"SafeRAG: Benchmarking Security in Retrieval-Augmented Generation of Large Language Model","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2501.18636","snapshot_observed_at":"2026-08-07T14:32:57.580657Z","title":"Saferag: Benchmarking security in retrieval-augmented generation of large language model","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.580657Z"},"links":{"cited_paper":"/paper/2501.18636","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:632c1c04b0304516defee0764ee51c3e0d8caa0e4cbc59ad525fd7356503bafb","observation_id":"68520974-af71-4bd0-88a9-2bde47f4dfa4","resolution":{"observed_at":"2026-08-07T14:32:57.580657Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.19437","last_updated":"2025-02-18T17:26:38Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-12-27T04:03:16Z","title":"DeepSeek-V3 Technical Report","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.19437","snapshot_observed_at":"2026-08-07T14:32:57.638696Z","title":"Deepseek-v3 technical report","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.638696Z"},"links":{"cited_paper":"/paper/2412.19437","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:ae9d4a8b70bcbbef9ba64d88c8d26c9ae996f743d910ce7664c08ed679b661ae","observation_id":"d958df5b-73a0-4c35-8156-ce0fa693c920","resolution":{"observed_at":"2026-08-07T14:32:57.638696Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.06254","last_updated":"2025-03-14T04:16:23Z","snapshot_observed_at":"2026-08-07T17:20:04.863802Z","submitted_at":"2025-03-08T15:46:38Z","title":"Poisoned-MRAG: Knowledge Poisoning Attacks to Multimodal Retrieval Augmented Generation","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.06254","snapshot_observed_at":"2026-08-07T14:32:57.726747Z","title":"Poisoned-mrag: Knowledge poisoning attacks to multimodal retrieval augmented generation","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.726747Z"},"links":{"cited_paper":"/paper/2503.06254","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:3c561b9ac44f8d03f8e46e442d13b06af88454a7daf70744950e585ed5e496db","observation_id":"a97f2a88-7634-424f-851f-340b3af38c68","resolution":{"observed_at":"2026-08-07T14:32:57.726747Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:57.761534Z","title":"Formalizing and benchmarking prompt injection attacks and defenses","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.761534Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:fe2104504db166500ca2b358aea759da7fe5e3749cef84a8a0dfaba79cb0926f","observation_id":"4a77545b-7d76-4a18-9cbe-493bd037948d","resolution":{"observed_at":"2026-08-07T14:32:57.761534Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:05.100454Z","title":"Backdoor attacks on dense passage retrievers for disseminating misinformation","venue":null,"work_id":"b0d83c49-f580-4dea-809d-8ac1df58589e","year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.811453Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:b772616af4ffbd053ffa7eaf681d996910b1dbbfca33b62e8e861266caffc9b1","observation_id":"33ab162c-ddc5-420f-8af4-294eeee17022","resolution":{"observed_at":"2026-08-07T14:33:05.173215Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:04.904600Z","title":"Making llms worth every penny: Resource-limited text classification in banking","venue":null,"work_id":"90fde44f-d627-4d9c-9052-0cfb37e14059","year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.873477Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:d6d882d62ec0e04f12482c06a3b05e8b75a5d017569b981f235e073b2d2d8b09","observation_id":"5e2d1d09-bd51-4d8c-b069-5f0ea0f5f0ef","resolution":{"observed_at":"2026-08-07T14:33:04.999994Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2311.10813","last_updated":"2024-07-28T23:37:51Z","snapshot_observed_at":"2026-08-08T06:09:45.949093Z","submitted_at":"2023-11-17T18:59:56Z","title":"A Language Agent for Autonomous Driving","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.10813","snapshot_observed_at":"2026-08-07T14:32:57.939867Z","title":"A language agent for autonomous driving","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:57.939867Z"},"links":{"cited_paper":"/paper/2311.10813","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:beec2182f241aa527ae6c7db1b428ef3a2e0da21bf12905705bed5439a3300a4","observation_id":"9f49b828-256e-4597-8975-7a03c49259bd","resolution":{"observed_at":"2026-08-07T14:32:57.939867Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.15576","last_updated":"2025-08-05T18:18:07Z","snapshot_observed_at":"2026-08-03T13:22:50.970205Z","submitted_at":"2024-10-21T01:54:46Z","title":"A Survey of Conversational Search","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.15576","snapshot_observed_at":"2026-08-07T14:32:58.003425Z","title":"A survey of conversational search","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.003425Z"},"links":{"cited_paper":"/paper/2410.15576","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:eae9c3d9b27da53c09f9584ff5fdb458d260b3cb83c2b8ea56c16cb1f9577353","observation_id":"a66ddbce-4b21-4dfe-bb4f-fcc24468d40a","resolution":{"observed_at":"2026-08-07T14:32:58.003425Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.00306","last_updated":"2025-06-30T16:37:59Z","snapshot_observed_at":"2026-08-07T04:41:37.464741Z","submitted_at":"2025-02-01T04:01:18Z","title":"Riddle Me This! Stealthy Membership Inference for Retrieval-Augmented Generation","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.00306","snapshot_observed_at":"2026-08-07T14:32:58.039510Z","title":"Riddle me this! stealthy membership inference for retrieval-augmented generation","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.039510Z"},"links":{"cited_paper":"/paper/2502.00306","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:e043073b247ebdb41cf84a9af4806b1e5fd8631799725709b515891bd240e9da","observation_id":"ef56b0a2-998e-459a-8780-63760ddd077d","resolution":{"observed_at":"2026-08-07T14:32:58.039510Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:58.065588Z","title":"Ms marco: A human-generated machine reading comprehension dataset","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.065588Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:66884cc22c09e132750d8b6301bac3f74250973618e497cbb3fe1d51b5272e88","observation_id":"088a6e46-0538-449b-a100-58205d8fc4ba","resolution":{"observed_at":"2026-08-07T14:32:58.065588Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1606.05250","last_updated":"2016-10-11T02:42:36Z","snapshot_observed_at":"2026-08-08T11:05:45.903773Z","submitted_at":"2016-06-16T16:36:00Z","title":"SQuAD: 100,000+ Questions for Machine Comprehension of Text","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1606.05250","snapshot_observed_at":"2026-08-07T14:32:58.087928Z","title":"Squad: 100,000+ questions for machine comprehension of text","venue":null,"work_id":null,"year":2016},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.087928Z"},"links":{"cited_paper":"/paper/1606.05250","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:28f0c373c324835ef087202d0f3b4edb2fd6391e610fa0023e4bb791907e1df4","observation_id":"6fe3f7de-d08f-40df-b732-c9742e05cb1b","resolution":{"observed_at":"2026-08-07T14:32:58.087928Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.04870","last_updated":"2024-10-23T05:55:31Z","snapshot_observed_at":"2026-07-06T18:58:43.349175Z","submitted_at":"2024-08-09T05:20:05Z","title":"ConfusedPilot: Confused Deputy Risks in RAG-based LLMs","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.04870","snapshot_observed_at":"2026-08-07T14:32:58.142259Z","title":"Confusedpilot: Confused deputy risks in rag-based llms","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.142259Z"},"links":{"cited_paper":"/paper/2408.04870","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:1e7317090c7a32d602382219c5ad8f6d6391ce7336ea8ce87f4e7410042b73b8","observation_id":"cb8b98b8-0102-46c7-8d13-1c1f8179ec3a","resolution":{"observed_at":"2026-08-07T14:32:58.142259Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:04.747171Z","title":"Ragchecker: A fine-grained framework for diagnosing retrieval-augmented generation","venue":null,"work_id":"182185d4-0439-40a5-94ca-60fb1cb308ea","year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.217110Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:a6f772f7a17f045aca303fcff7587938c8e44fefeb457655ab7ed52490561032","observation_id":"949958ee-935c-452c-af47-0e47b10c7c1a","resolution":{"observed_at":"2026-08-07T14:33:04.834256Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:04.574010Z","title":"Evaluating retrieval quality in retrieval-augmented gen- eration","venue":null,"work_id":"08775735-f02a-4d07-a3ac-be2d26e3133c","year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.286145Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:f46b6788e0cc9d2886a500b8dc06c606dfe118fb572ce9da445fbac7ae3781e1","observation_id":"61cde023-59f1-48aa-91e2-9cd438cb00ab","resolution":{"observed_at":"2026-08-07T14:33:04.673482Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.05870","last_updated":"2025-03-10T12:56:54Z","snapshot_observed_at":"2026-07-06T18:27:50.189771Z","submitted_at":"2024-06-09T17:55:55Z","title":"Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.05870","snapshot_observed_at":"2026-08-07T14:32:58.335827Z","title":"Machine against the rag: Jamming retrieval-augmented generation with blocker documents","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.335827Z"},"links":{"cited_paper":"/paper/2406.05870","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:2fc8e0fb6a914e263c589afbd4051ce8dbbf4f3d48dfd26e379f283d81e048c0","observation_id":"280d1d1c-91cd-405a-b6ca-2e22dfb36e5c","resolution":{"observed_at":"2026-08-07T14:32:58.335827Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.07128","last_updated":"2024-10-04T05:56:56Z","snapshot_observed_at":"2026-08-08T00:41:08.811604Z","submitted_at":"2024-01-13T18:09:05Z","title":"EHRAgent: Code Empowers Large Language Models for Few-shot Complex Tabular Reasoning on Electronic Health Records","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.07128","snapshot_observed_at":"2026-08-07T14:32:58.376475Z","title":"Ehragent: Code empowers large language models for few-shot complex tabular reasoning on electronic health records","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.376475Z"},"links":{"cited_paper":"/paper/2401.07128","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:42959058f12c2f7f08b2f916efb764a96c0e4c98ece6da4b741c5156f0f8c7ff","observation_id":"44637546-37a4-45af-9f19-36450d15649f","resolution":{"observed_at":"2026-08-07T14:32:58.376475Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:04.405754Z","title":"Trec 2019 news track overview","venue":null,"work_id":"1f6303f6-bd06-4feb-9f54-aa0fc4f76bde","year":2019},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.417532Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:e612f27252694a994b73c39f4311a62df9482b8f2977d5f35940f1653c0a6cb2","observation_id":"1e7a13bf-88d0-4fc8-b588-1283af6c392b","resolution":{"observed_at":"2026-08-07T14:33:04.479907Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.05087","last_updated":"2024-10-25T03:57:07Z","snapshot_observed_at":"2026-08-07T19:09:35.400977Z","submitted_at":"2024-06-07T17:02:35Z","title":"Corpus Poisoning via Approximate Greedy Gradient Descent","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.05087","snapshot_observed_at":"2026-08-07T14:32:58.465950Z","title":"Corpus poisoning via approximate greedy gradient descent","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.465950Z"},"links":{"cited_paper":"/paper/2406.05087","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:17bfcd62b0ba2da02d89695750af252384b7ba781a857afb8c7619435f677019","observation_id":"01b51a31-8c53-41c4-82da-36c89d5806a2","resolution":{"observed_at":"2026-08-07T14:32:58.465950Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.21680","last_updated":"2025-04-30T14:18:11Z","snapshot_observed_at":"2026-08-07T15:57:39.217854Z","submitted_at":"2025-04-30T14:18:11Z","title":"Hoist with His Own Petard: Inducing Guardrails to Facilitate Denial-of-Service Attacks on Retrieval-Augmented Generation of LLMs","version":1},"cited_work":{"arxiv_id":"2504.21680","doi":null,"metadata_source":"pith","pith_arxiv_id":"2504.21680","snapshot_observed_at":"2026-08-07T14:33:02.104918Z","title":"Hoist with His Own Petard: Inducing Guardrails to Facilitate Denial-of-Service Attacks on Retrieval-Augmented Generation of LLMs","venue":"cs.CR","work_id":"0084bcc6-eea2-45b2-adaa-693bb61664c1","year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.527972Z"},"links":{"cited_paper":"/paper/2504.21680","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:206ed85de3917b3d36c03e95a3ae88bebd5fc71f4d210b41434ff5c98f5fd5d8","observation_id":"cbad8f2e-2d8e-4b62-bb0a-ba33a3ec1543","resolution":{"observed_at":"2026-08-07T14:33:02.217503Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.19417","last_updated":"2024-06-26T05:36:23Z","snapshot_observed_at":"2026-08-07T17:25:16.874120Z","submitted_at":"2024-06-26T05:36:23Z","title":"\"Glue pizza and eat rocks\" -- Exploiting Vulnerabilities in Retrieval-Augmented Generative Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.19417","snapshot_observed_at":"2026-08-07T14:32:58.562417Z","title":"glue pizza and eat rocks","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.562417Z"},"links":{"cited_paper":"/paper/2406.19417","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:9546eae9d97dd3ac98116301d7da3a7f82896a85c1bc9964565ca0c79a0c5ed8","observation_id":"75222880-261e-4c65-8a19-c9aa0d4cc94e","resolution":{"observed_at":"2026-08-07T14:32:58.562417Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:04.234151Z","title":"Beir: A heterogeneous benchmark for zero-shot evaluation of information retrieval models","venue":null,"work_id":"519d86c8-0e18-4ecb-ae9e-e40fe40de779","year":2021},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.621428Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:58ba284ab4971ac4db764737a6a9033a6c55df64a090bf43de4545e726fd80b2","observation_id":"bcd31753-1910-4442-a9b9-d4de92e25569","resolution":{"observed_at":"2026-08-07T14:33:04.330229Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2201.08239","last_updated":"2022-02-10T16:30:11Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-01-20T15:44:37Z","title":"LaMDA: Language Models for Dialog Applications","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2201.08239","snapshot_observed_at":"2026-08-07T14:32:58.663864Z","title":"Lamda: Language models for dialog applications","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":69,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.663864Z"},"links":{"cited_paper":"/paper/2201.08239","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:d5d6a225a52f8d14b7e28608439ab54b04651a4be1575324e22a71055ebb7302","observation_id":"917588d1-f70d-4afd-8621-b167c17b6a8e","resolution":{"observed_at":"2026-08-07T14:32:58.663864Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2212.10509","last_updated":"2023-06-23T00:59:13Z","snapshot_observed_at":"2026-07-06T14:33:08.041820Z","submitted_at":"2022-12-20T18:26:34Z","title":"Interleaving Retrieval with Chain-of-Thought Reasoning for Knowledge-Intensive Multi-Step Questions","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2212.10509","snapshot_observed_at":"2026-08-07T14:32:58.713934Z","title":"Interleaving retrieval with chain-of-thought reasoning for knowledge-intensive multi-step questions","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":70,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.713934Z"},"links":{"cited_paper":"/paper/2212.10509","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:f37f23cbd74853df29f5e7f6b85266f379cb0465e0359bc62cee1309d08a3f18","observation_id":"49dde00f-fef8-4e05-8ceb-a73949af8933","resolution":{"observed_at":"2026-08-07T14:32:58.713934Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.07176","last_updated":"2025-05-31T04:07:21Z","snapshot_observed_at":"2026-07-06T19:30:39.426499Z","submitted_at":"2024-10-09T17:59:58Z","title":"Astute RAG: Overcoming Imperfect Retrieval Augmentation and Knowledge Conflicts for Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.07176","snapshot_observed_at":"2026-08-07T14:32:58.813809Z","title":"Astute rag: Overcoming imperfect retrieval augmentation and knowledge conflicts for large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":71,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.813809Z"},"links":{"cited_paper":"/paper/2410.07176","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:8c2530f474b2645ab98c086475041367b5229f8459176a43dfa727a0f64d470c","observation_id":"b094a397-d9c0-48d4-9396-90462ab27fff","resolution":{"observed_at":"2026-08-07T14:32:58.813809Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:04.061410Z","title":"Instructrag: Instructing retrieval-augmented genera- tion with explicit denoising","venue":null,"work_id":"0fe3f5d3-d682-44f5-aef4-bf5ae7a78188","year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":72,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.883795Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:838e45db69dcc175e91ce3f9a624a3344822b8f9a17226aba22fcdf43e09a987","observation_id":"bab4faa9-f060-4f28-8b19-f0627f7af40a","resolution":{"observed_at":"2026-08-07T14:33:04.155188Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.13085","last_updated":"2025-03-03T03:08:28Z","snapshot_observed_at":"2026-08-02T03:49:38.796672Z","submitted_at":"2024-10-16T23:03:27Z","title":"MMed-RAG: Versatile Multimodal RAG System for Medical Vision Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.13085","snapshot_observed_at":"2026-08-07T14:32:58.946846Z","title":"Mmed-rag: Versatile multimodal rag system for medical vision language models","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":73,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.946846Z"},"links":{"cited_paper":"/paper/2410.13085","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:2070b7c8850334fefa06bd3bf15bbf9be3c13134198abff248f45c5d007fff30","observation_id":"69e9cec2-5a46-42f0-af9d-c514275dfb14","resolution":{"observed_at":"2026-08-07T14:32:58.946846Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:03.888134Z","title":"Rule: Reliable multimodal rag for factuality in medical vision language models","venue":null,"work_id":"bf85c523-338b-4494-98b9-195d677aad68","year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":74,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:58.983915Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:fdec33da10156d0fbd15ebe14a5b6cb105fa7e3c7df9f6a8e8227701702a4251","observation_id":"aad991db-5542-4be9-84e5-a84ddb59b9d6","resolution":{"observed_at":"2026-08-07T14:33:03.986860Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:59.042846Z","title":"Certifiably robust rag against retrieval corruption","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:59.042846Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:3e2c6a16bb19831d59d12ace3f76f7c0f45818ee44c3ac43f3505edb62318a6e","observation_id":"36f41795-19dd-4f66-a508-f3d77d94cd33","resolution":{"observed_at":"2026-08-07T14:32:59.042846Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2007.00808","last_updated":"2020-10-20T22:17:19Z","snapshot_observed_at":"2026-08-06T15:45:53.027828Z","submitted_at":"2020-07-01T23:15:56Z","title":"Approximate Nearest Neighbor Negative Contrastive Learning for Dense Text Retrieval","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2007.00808","snapshot_observed_at":"2026-08-07T14:32:59.112188Z","title":"Approximate nearest neighbor negative contrastive learning for dense text retrieval","venue":null,"work_id":null,"year":2007},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":76,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:59.112188Z"},"links":{"cited_paper":"/paper/2007.00808","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:431b28db2df321e8f93d2fa37706f60b8396d76f3c63056b3d2224a923792c07","observation_id":"35dd4be1-c704-4bc1-ac10-5a8f157b14a0","resolution":{"observed_at":"2026-08-07T14:32:59.112188Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.04408","last_updated":"2023-10-06T17:55:36Z","snapshot_observed_at":"2026-08-05T10:28:11.033488Z","submitted_at":"2023-10-06T17:55:36Z","title":"RECOMP: Improving Retrieval-Augmented LMs with Compression and Selective Augmentation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.04408","snapshot_observed_at":"2026-08-07T14:32:59.202577Z","title":"Recomp: Improving retrieval-augmented lms with compression and selective augmentation","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":77,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:59.202577Z"},"links":{"cited_paper":"/paper/2310.04408","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:3ab10eb3e23503436ec81870601433ba0c5bb54cd23e2ffe8586790ea26c198d","observation_id":"9dfdf5fe-7b53-4217-8534-df99030e04b0","resolution":{"observed_at":"2026-08-07T14:32:59.202577Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.00083","last_updated":"2024-06-06T13:38:42Z","snapshot_observed_at":"2026-08-06T22:05:18.163179Z","submitted_at":"2024-06-03T02:25:33Z","title":"BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.00083","snapshot_observed_at":"2026-08-07T14:32:59.243279Z","title":"Badrag: Identifying vulnerabilities in retrieval augmented generation of large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":78,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:59.243279Z"},"links":{"cited_paper":"/paper/2406.00083","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:a9cc264653e07117667b34c5e1029a6bcb516ecd9868db0d897c2d5cbf05e72a","observation_id":"328b8b7c-44b9-4a1d-b583-a54246d7c18b","resolution":{"observed_at":"2026-08-07T14:32:59.243279Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.20927","last_updated":"2024-12-30T13:16:08Z","snapshot_observed_at":"2026-07-06T20:14:40.579474Z","submitted_at":"2024-12-30T13:16:08Z","title":"Enhanced Multimodal RAG-LLM for Accurate Visual Question Answering","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.20927","snapshot_observed_at":"2026-08-07T14:32:59.328846Z","title":"Enhanced multimodal rag-llm for accurate visual question answering","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":79,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:59.328846Z"},"links":{"cited_paper":"/paper/2412.20927","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:9a3676f1063c623928b5af3e607b67f8b12c9e2e91d3fb3a490c7b593c045de0","observation_id":"5fb72a77-095b-4c06-bc10-d5c4256a4135","resolution":{"observed_at":"2026-08-07T14:32:59.328846Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:03.721252Z","title":"Crag-comprehensive rag benchmark","venue":null,"work_id":"d2fb585f-1ee3-47d2-88e5-ffb11fa719f9","year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":80,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:59.436766Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:55b83122cf4efefb403cd9bf5e91c1c791279b729520280c100d458eaf5ffcf9","observation_id":"3c9dd4a4-71a5-4be1-9b76-4be3947826da","resolution":{"observed_at":"2026-08-07T14:33:03.785713Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"1809.09600","last_updated":"2018-09-25T17:28:20Z","snapshot_observed_at":"2026-07-31T11:19:06.421362Z","submitted_at":"2018-09-25T17:28:20Z","title":"HotpotQA: A Dataset for Diverse, Explainable Multi-hop Question Answering","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1809.09600","snapshot_observed_at":"2026-08-07T14:32:59.543585Z","title":"Hotpotqa: A dataset for diverse, explainable multi-hop question answering","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":81,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:59.543585Z"},"links":{"cited_paper":"/paper/1809.09600","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:aba4afe5caf026c6700d209c9817e65a53ac4a0174a61cdcad99b5fa01b2509e","observation_id":"3da186e8-03a7-42e3-a4fc-11b50ab9f50f","resolution":{"observed_at":"2026-08-07T14:32:59.543585Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.13506","last_updated":"2025-05-16T11:40:32Z","snapshot_observed_at":"2026-08-07T15:44:43.526387Z","submitted_at":"2025-05-16T11:40:32Z","title":"EcoSafeRAG: Efficient Security through Context Analysis in Retrieval-Augmented Generation","version":1},"cited_work":{"arxiv_id":"2505.13506","doi":null,"metadata_source":"pith","pith_arxiv_id":"2505.13506","snapshot_observed_at":"2026-08-07T14:33:01.757663Z","title":"EcoSafeRAG: Efficient Security through Context Analysis in Retrieval-Augmented Generation","venue":"cs.CL","work_id":"127d786e-f35b-465c-a67d-0f23fd4361a8","year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":82,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:59.652064Z"},"links":{"cited_paper":"/paper/2505.13506","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:bc18a659e7bb5fd61e8469cb0384e116fc72faab0fc3c26f4d48e33b14aae0e0","observation_id":"a24b545a-b500-4a86-ba09-7fe218373904","resolution":{"observed_at":"2026-08-07T14:33:01.824614Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:32:59.762327Z","title":"React: Synergizing reasoning and acting in language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":83,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:59.762327Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:be402453f5d2e5d0f8229fa60af1881d1eec47b82ab4bbee737bdf32e368e1fe","observation_id":"3c3dd768-3858-4b86-a3ae-64f0cbae3c84","resolution":{"observed_at":"2026-08-07T14:32:59.762327Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.10594","last_updated":"2025-03-02T01:19:51Z","snapshot_observed_at":"2026-08-02T13:24:00.339129Z","submitted_at":"2024-10-14T15:04:18Z","title":"VisRAG: Vision-based Retrieval-augmented Generation on Multi-modality Documents","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.10594","snapshot_observed_at":"2026-08-07T14:32:59.883563Z","title":"Visrag: Vision-based retrieval-augmented generation on multi-modality documents","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":84,"source":"pdf_text","source_observed_at":"2026-08-07T14:32:59.883563Z"},"links":{"cited_paper":"/paper/2410.10594","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:560d9c47cbc31ec92152c7738fef556a4638b49a6240482b33ecca1332f497c0","observation_id":"4abb05db-97fe-44d8-8124-7054cf98dd77","resolution":{"observed_at":"2026-08-07T14:32:59.883563Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.17331","last_updated":"2023-05-27T02:26:52Z","snapshot_observed_at":"2026-08-07T22:14:33.402938Z","submitted_at":"2023-05-27T02:26:52Z","title":"Augmentation-Adapted Retriever Improves Generalization of Language Models as Generic Plug-In","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.17331","snapshot_observed_at":"2026-08-07T14:33:00.003486Z","title":"Augmentation-adapted retriever improves generalization of language models as generic plug-in","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":85,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:00.003486Z"},"links":{"cited_paper":"/paper/2305.17331","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:5840f83fc2559b50a4ab33ba6066007dc94b4b03e405eacb0f44bdd7a6e0210d","observation_id":"126e37ed-acf7-4ace-89db-519f13d9ed63","resolution":{"observed_at":"2026-08-07T14:33:00.003486Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:00.106610Z","title":"Rag-driver: Generalisable driving explanations with retrieval-augmented in-context learning in multi-modal large language model","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":86,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:00.106610Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:4518d1b31ff21fde05b2ee688d28f934b1126431124f8b5df070d0655569cc5a","observation_id":"82062636-8a73-4d13-bf89-ec7da18732a9","resolution":{"observed_at":"2026-08-07T14:33:00.106610Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:00.174389Z","title":"Worse than zero-shot? a fact-checking dataset for evaluating the robustness of rag against misleading retrievals","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":87,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:00.174389Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:08cfd465aa7b95a5189ec720144fc2508d4aa1e8533f23bb49dd1c63453e48b3","observation_id":"5807f233-d77a-478e-9990-9eda9eb5250e","resolution":{"observed_at":"2026-08-07T14:33:00.174389Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:00.291225Z","title":"Prac- tical poisoning attacks against retrieval-augmented generation.arXiv preprint arXiv:2504.03957, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":88,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:00.291225Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:1c1dfa35c303d7775e0a4a99d93c1f0d359b54fcfbbd26c541425bd98aed21ee","observation_id":"5405aeb7-8c82-41ac-afbe-09cf504416b0","resolution":{"observed_at":"2026-08-07T14:33:00.291225Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:03.568234Z","title":"Traceback of poisoning attacks to retrieval-augmented generation","venue":null,"work_id":"aca3d760-30a7-4eb4-a241-2f100eedd5d9","year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":89,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:00.401057Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:47c56cc447ecfb69e436b2a346c642c86ec28e760aae2cc7101f51b9619f6313","observation_id":"43ee4f78-7ab8-46b4-b85b-c2fe9fa0e5e6","resolution":{"observed_at":"2026-08-07T14:33:03.643093Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.22832","last_updated":"2024-10-30T09:15:51Z","snapshot_observed_at":"2026-08-08T06:11:31.040933Z","submitted_at":"2024-10-30T09:15:51Z","title":"HijackRAG: Hijacking Attacks against Retrieval-Augmented Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.22832","snapshot_observed_at":"2026-08-07T14:33:00.474010Z","title":"Hijackrag: Hijacking attacks against retrieval-augmented large language models","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":90,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:00.474010Z"},"links":{"cited_paper":"/paper/2410.22832","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:8d64393c9080f48887a4e5a7b501bc1c71280dfb8dd527065130e32185601f7a","observation_id":"762e2534-1435-43ae-8809-1f94fcf01c5a","resolution":{"observed_at":"2026-08-07T14:33:00.474010Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18016","last_updated":"2025-03-23T10:33:28Z","snapshot_observed_at":"2026-08-07T16:43:26.281359Z","submitted_at":"2025-03-23T10:33:28Z","title":"Retrieval Augmented Generation and Understanding in Vision: A Survey and New Outlook","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18016","snapshot_observed_at":"2026-08-07T14:33:00.592379Z","title":"Retrieval augmented generation and understanding in vision: A survey and new outlook","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":91,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:00.592379Z"},"links":{"cited_paper":"/paper/2503.18016","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:3323ce5af9292c527f91b0e01b9bc94c5b1814810dae6c0f878a08621a5f5b7c","observation_id":"3039fba3-61c1-4592-a67f-e6dc240e32cb","resolution":{"observed_at":"2026-08-07T14:33:00.592379Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.19156","last_updated":"2023-10-29T21:13:31Z","snapshot_observed_at":"2026-07-06T16:40:12.014275Z","submitted_at":"2023-10-29T21:13:31Z","title":"Poisoning Retrieval Corpora by Injecting Adversarial Passages","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.19156","snapshot_observed_at":"2026-08-07T14:33:00.710112Z","title":"Poisoning retrieval corpora by injecting adversarial passages","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":92,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:00.710112Z"},"links":{"cited_paper":"/paper/2310.19156","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:fcd61e5939406bfcd992a21d54d3fd114407b726df4a55121aab7bf213551620","observation_id":"98309379-6233-4c3a-a018-9a47b5a839bd","resolution":{"observed_at":"2026-08-07T14:33:00.710112Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2501.00879","last_updated":"2025-05-22T22:00:19Z","snapshot_observed_at":"2026-07-06T20:15:31.955797Z","submitted_at":"2025-01-01T15:57:34Z","title":"TrustRAG: Enhancing Robustness and Trustworthiness in Retrieval-Augmented Generation","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2501.00879","snapshot_observed_at":"2026-08-07T14:33:00.835351Z","title":"Trustrag: Enhancing robustness and trustworthiness in rag","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":93,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:00.835351Z"},"links":{"cited_paper":"/paper/2501.00879","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:d925eb1f38935000796d11d0a93eadf88db37f29699deda6eb30ff3c0e46f5ff","observation_id":"ff9632c2-972f-46cc-9595-ad9beed8f68c","resolution":{"observed_at":"2026-08-07T14:33:00.835351Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2409.10102","last_updated":"2026-05-16T07:15:07Z","snapshot_observed_at":"2026-08-04T19:12:49.508911Z","submitted_at":"2024-09-16T09:06:44Z","title":"Trustworthiness in Retrieval-Augmented Generation Systems: A Survey","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.10102","snapshot_observed_at":"2026-08-07T14:33:00.919539Z","title":"Trustworthiness in retrieval-augmented generation systems: A survey","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":94,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:00.919539Z"},"links":{"cited_paper":"/paper/2409.10102","citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:766740d6936ea993d043b2beabdddf9d31f3c45d3bf79bbc38d9b39d8061244b","observation_id":"326fd7ad-7c2b-4b08-8ad2-78965bd338d8","resolution":{"observed_at":"2026-08-07T14:33:00.919539Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:03.424225Z","title":"Black-Box Opinion Manipulation Attacks to Retrieval- Augmented Generation of Large Language Models","venue":null,"work_id":"874888fb-5128-433f-a8f1-61eb039a3d82","year":2025},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":95,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:00.983684Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:1ef2d6a50afabc3d08d1265cc9ce96bb26343e8adb1069c1c80e3a0c5112fbc3","observation_id":"bb8f74b6-d050-4ddb-90ca-f43407a4faae","resolution":{"observed_at":"2026-08-07T14:33:03.498516Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:03.254961Z","title":null,"venue":null,"work_id":"1c865bd8-d3ee-4769-be3d-724d43d75176","year":null},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":96,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:01.071775Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:750813eb27445fffca9763ef74426fae06138203a669959fd3287b46e25bae97","observation_id":"5d67b7c0-c373-4489-9c4d-1f2d00a4253b","resolution":{"observed_at":"2026-08-07T14:33:03.346808Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:03.079576Z","title":null,"venue":null,"work_id":"e7cc3c44-cffd-49c4-b7a1-d0e0197a646e","year":null},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":97,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:01.170470Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:b48e23a307e8f898268ddbee4c59ee7324683129a32a9e3cc2e38474e9ce693f","observation_id":"6951ad8d-3dae-4e5f-8580-95152a033014","resolution":{"observed_at":"2026-08-07T14:33:03.171172Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:02.903391Z","title":null,"venue":null,"work_id":"a3551035-7eef-49a7-99f5-02565c45da44","year":null},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":98,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:01.247518Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:02782262aeadd3a0ccd0f39636cdcad27ee6ddb4f4ef08c747edc7944fdb0888","observation_id":"35d8ab91-5b40-4207-8dea-15bfd4730770","resolution":{"observed_at":"2026-08-07T14:33:03.009966Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T14:33:02.765628Z","title":"class\" (standalone or non-standalone) and the","venue":null,"work_id":"dcd0c581-dbec-4b3c-aaa9-470621cdd518","year":null},"citing_paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","version":1},"reference_index":99,"source":"pdf_text","source_observed_at":"2026-08-07T14:33:01.360877Z"},"links":{"citing_paper":"/paper/2505.18543"},"observation_digest":"sha256:9e7ca240bd91030ec96154bcfc549c56516145cb72d36edafb52264138161e21","observation_id":"9a6c75c7-028d-4474-94b1-d707242aa2c3","resolution":{"observed_at":"2026-08-07T14:33:02.825102Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-08T06:32:00.761636+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2505.18543","last_updated":"2025-05-24T06:17:59Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-08T00:41:28.430373Z","submitted_at":"2025-05-24T06:17:59Z","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation"},"reference_resolution":{"displayed":99,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":85,"verified_exact":2,"verified_fuzzy":12},"total_outbound_references":99},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-08T06:32:00.761636+00:00","source":"crossref"},{"observed_at":"2026-08-08T06:31:55.24221+00:00","source":"retraction_watch"}],"thesis":"As of 8 August 2026, this Paper Citation Record lists 99 of 99 outbound references and 9 inbound Pith citation observations for arXiv:2505.18543."}