Pith. sign in

REVIEW 4 major objections 5 minor 51 references

Safeguarding RAG Pipelines with GMTP: A Gradient-based Masked Token Probability Method for Poisoned Document Detection

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Poisoned documents in RAG pipelines can be caught by masking the tokens that most strongly drive retrieval similarity and checking how hard a language model finds it to reconstruct them.

desk verdict A useful but oversold retriever-side filter for token-injection poisoning; clean-retrieval costs and a missing adaptive attacker keep it from being a general safeguard. read the letter →

arxiv 2507.18202 v1 pith:TKTUBDUL submitted 2025-07-24 cs.CL cs.AI

San Kim , Jonghwi Kim , Yejin Jeon , Gary Geunbae Lee This is my paper
classification cs.CLcs.AI
keywords retrieval-augmentedgenerationcorpuspoisoningattackpoisoneddocumentdetectiongradient-basedtokenselectionmaskedlanguagemodelprobabilityadversarialdefenseRAGsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that adversarially poisoned documents injected into a retrieval-augmented generation (RAG) knowledge base can be detected before generation by combining two signals: find the tokens whose embeddings most strongly drive the retriever's similarity score, then mask those tokens and ask a masked language model how predictable they are. Cheating tokens inserted to inflate similarity are typically unnatural and receive very low masked-token probabilities, while tokens in clean or relevant documents remain predictable. The proposed GMTP method filters any retrieved document whose average probability over the lowest-scoring masked tokens falls below a calibrated threshold. Across three poisoning attacks and three retriever architectures, the paper reports filtering over 90% of poisoned documents while keeping retrieval performance nearly intact, and reducing generation attack success rates to below 10%.

What carries the argument

Gradient-based key-token selection combined with masked-token probability scoring. For each candidate document, GMTP computes $g_t = \|\nabla_{e_t} \mathrm{Sim}(E_Q(q), E_D(d))\|_2$ for every token, keeps the tokens with above-average gradient magnitude (capped at $N$), masks each of them, and uses BERT as the masked language model to score the probability of predicting the original token. It then selects the $M$ lowest-probability tokens, averages their probabilities into the P-score, and filters the document when the P-score falls below $ au = \lambda \cdot \frac{1}{K}\sum_{i=1}^{K} \text{P-score}_i$, where the threshold is calibrated on sampled query-document pairs from the target domain.

What would settle it

Design an adaptive poisoning attack that optimizes each candidate document under two objectives at once, high retriever similarity and high masked-token probability (for example, by using an LLM-based scorer as a naturalness regularizer), then measure whether poisoned P-scores still separate from clean P-scores on NQ, HotpotQA, and MS MARCO; the central claim fails if the separation collapses and the filtering rate drops below 90% at the paper's reported false-positive level.

Watch

Extended reading notes

Core claim

GMTP establishes that the reliable signature of corpus poisoning is not the document's semantic content but the optimization artifact: tokens added to make a document resemble a target query are statistically abnormal under a masked language model. By computing the gradient of the similarity score with respect to each token embedding, selecting the highest-gradient tokens, masking them, and averaging the probabilities of the most unpredictable among them (the P-score), GMTP separates poisoned documents from clean and relevant documents with a large margin, often two orders of magnitude. The paper claims this separation holds across Hotflip-based attacks such as PoisonedRAG and Phantom, and also against AdvDecoding, a naturalness-constrained attack, and that filtering on this signal removes almost all poisoned content while falsely filtering only about 5% or fewer legitimate documents.

Load-bearing premise

The method assumes that poisoned documents necessarily contain tokens that are simultaneously high-impact for retrieval similarity and hard for a language model to predict; if an attacker produces false documents that read naturally and still rank well, GMTP's signal disappears, a gap the authors acknowledge in Section 8 when they note that naturally crafted false information is out of scope.

Editorial extensions

If this is right

  • GMTP can be inserted into an existing RAG pipeline with only gradient access to the retriever and a small masked language model, removing poisoned documents before the expensive generator runs.
  • Retrieval-phase filtering alone keeps attack success below 10% under PoisonedRAG, Phantom, and AdvDecoding, outperforming generation-phase defenses while preserving higher clean accuracy.
  • The method transfers across retriever families, including bi-encoders such as DPR and Contriever and the late-interaction ColBERT, because it relies only on gradients of the similarity function.
  • The defense remains above a 90% filtering rate across a wide range of hyperparameter settings, and even when the threshold is estimated from random documents rather than precisely relevant ones.
  • The paper's own limitation is that naturally crafted false documents, such as biased news articles that were never optimized for retrieval, are outside the method's tested scope.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the P-score gap is as robust as reported, the same gradient-plus-MLM check could be applied at ingestion time to every document above a similarity cutoff, turning GMTP from a post-retrieval filter into a pre-filter that never lets poisoned passages enter the candidate pool.
  • The method's real boundary is fluency-preserving attacks: a poisoning scheme that optimizes for both retrieval similarity and high masked-token probability would likely erode the observed probability gap, and testing GMTP against such adaptive attackers would settle how durable the signal is.
  • Because the threshold is calibrated on a domain sample, deployment would need a policy for threshold drift as the knowledge base or query distribution shifts; the reported wide margin suggests some drift is tolerable, but the safety factor is unspecified.
  • GMTP could be combined with generation-side verification: filtering by P-score removes the bulk of optimized poison, while a lightweight consistency check on the remaining documents could cover the natural false-information cases the paper leaves untested.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes GMTP, a retrieval-time defense that filters poisoned documents from RAG knowledge bases. GMTP computes gradients of the retriever's similarity function with respect to document token embeddings, selects high-gradient tokens, masks them, and uses an external MLM (BERT) to measure the probability of recovering the original tokens. Documents whose average masked-token probability over the M lowest-probability selected tokens falls below a threshold are filtered out. The threshold is derived from clean relevant documents and scaled by a factor λ. Experiments are reported for three retrievers (DPR, Contriever, ColBERT), three attacks (PoisonedRAG, Phantom, AdvDecoding), and three datasets (NQ, HotpotQA, MS MARCO), with the headline finding that filtering rates approach 1.0 and attack success rates drop below 10%. The authors also report key-token precision, false positive rates, latency, and ablations over N, M, and λ.

Significance. If the claims held in the stated generality, GMTP would be a useful lightweight defense: it operates at retrieval time with a small MLM, does not require retraining the retriever or generator, and has public code. A genuine strength is that the detection signal is not circular in the narrow sense: the MLM is an external model not fitted to poisoned/clean labels, and the gradient-based token selection is tied to the retriever's actual similarity computation. The paper also evaluates across several retrievers and three attack families, which is more than many defense papers do. The central claim, however, is broader than what is demonstrated. The method exploits low masked-token probabilities left by HotFlip-style optimization, and the clean-setting retrieval cost on Contriever/MS MARCO is substantial. With a narrowed claim, an adaptive-attacker experiment, and a principled treatment of λ and the evaluation protocol, the contribution would be solid.

major comments (4)
  1. [§3.2, §4.2, Appendix I, §8] The load-bearing assumption is that retriever-optimized poisoned documents necessarily contain 'cheating tokens' with abnormally low masked-token probabilities. Appendix I (Table 11) shows that when the number of adversarial tokens is reduced to one, PoisonedRAG's filtering rate falls to 0.504–0.702, and for Phantom and AdvDecoding the number of retrieved poisoned documents collapses to zero, so an FR of 1.0 is computed over a near-empty set. Section 8 also acknowledges that naturally crafted false information is not tested. Because the abstract claims GMTP 'eliminate[s] over 90% of poisoned content,' the scope should be narrowed to optimization-based attacks. In addition, the paper should evaluate an adaptive attacker that optimizes entire documents under a combined loss of retrieval similarity and MLM-likelihood or perplexity regularization; without such an experiment, the core premise that similarity optimization forces detectable unnaturalness is not established beyond the specific HotFlip/AdvDecoding family.
  2. [§6.1, Table 6, §6.4] The clean-setting retrieval cost is larger than the text acknowledges. Using Contriever on MS MARCO, GMTP reduces clean nDCG@10 from 0.515 to 0.386 for PoisonedRAG and from 0.468 to 0.332 for Phantom and AdvDecoding (Table 6). With DPR on NQ, clean nDCG@10 falls from 0.418 to 0.389 for Phantom and AdvDecoding (Table 1), while for PoisonedRAG it rises to 0.478, a non-monotonic pattern the authors should explain. The 'less than 10% drop' statement in §6.4 is reported only for ColBERT on NQ. Because preserving relevant-document retrieval is half of the central claim, the paper should report the full clean-pipeline nDCG for every retriever and dataset and justify why the observed drops are acceptable.
  3. [Eq. (2), §5.2, §6.3] The threshold τ is not determined by a principled, parameter-free procedure. The default λ = 0.1 is justified in §6.3 by observing that 'the filtering rate consistently exceeds 0.9,' which is a selection made with knowledge of the attack outcomes. Figure 6 shows a direct trade-off between filtering rate and clean nDCG as λ varies, and Appendix E shows that the P-score used in τ can differ by up to nearly 60% between relevant and random documents. The authors should either provide a selection rule for λ that uses only clean validation data or report the full λ sweep for all datasets and retrievers, including the clean nDCG cost at each λ.
  4. [§5, Table 1, Table 7, Appendix F] The evaluation protocol for trigger-based attacks rests on very small counts and an unclear replacement step. Section 5.1 states that Phantom and AdvDecoding use five poisoned documents per trigger, and Table 7 shows that with DPR the total numbers of retrieved poisoned documents across 200 queries are as low as 70–84 for these attacks. An FR of 1.0 can therefore mean filtering only a handful of documents, and the corresponding ASR estimates have high variance. In addition, Section 5 says that removed documents are replaced with 'similar alternatives,' which can change the nDCG computation after filtering; this may explain why GMTP's poisoned-environment nDCG sometimes exceeds the clean Naive nDCG (e.g., 0.476 > 0.418 in Table 1). The paper should report per-cell poisoned-document counts, confidence intervals, and a precise description of how replacement affects FR and nDCG.
minor comments (5)
  1. [Appendix F, Eq. (3)] There is a typo ('enviornment'), and the notation dN avp / dD p is difficult to parse; please define the variables in prose and use a cleaner subscript convention.
  2. [§6.1] The sentence beginning 'whil PPL generally keeps a filtering rate of 1.0' contains a typo ('whil').
  3. [Table 5] The header 'HoptotQA' should be 'HotpotQA'.
  4. [Algorithm 1, line 11] The variable 'P-scored' should be written consistently as 'P-score_d' to avoid confusion with the P-score of other documents.
  5. [Figures 4, 10, 11] The density plots lack axis labels and do not specify the kernel density bandwidth or smoothing parameters; please add these details for reproducibility.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: GMTP's P-score signal is measured by an external MLM, the threshold is calibrated on clean documents, and the headline filtering rates are not forced by construction.

full rationale

The GMTP derivation is self-contained with respect to its inputs. The detection signal (Sections 4.1 and 4.2, Eq. 1 and the P-score definition) is computed from retriever gradients and masked-token probabilities from an external BERT MLM; no parameter is fitted to the poisoned-document labels. The threshold tau in Eq. 2 is estimated from randomly sampled clean query-relevant document pairs from the training data and scaled by lambda = 0.1, an explicitly tuned hyperparameter whose effect is reported in Figures 6, 12, and 13 across a range of values, so the FR close to 1.0 results reflect a robust separation rather than a fit to the attack set. Table 2's token precision and Table 3's probability margins use attack labels only for evaluation, not in the filtering decision. The Section 8 limitation that naturally crafted false documents are out of scope is a scope restriction, not circularity: GMTP explicitly targets optimization-based poisoning, and whether retriever optimization necessarily leaves detectable masked-token anomalies is an empirical premise tested against three concrete attacks, not a definitional identity. There are no load-bearing self-citations; the cited GradMask inspiration is external prior work, and the attack implementations come from independent research groups. The only mild caveat is that the headline figures are reported at a selected operating point, but the paper discloses the full lambda sweep and shows that the separation margin is orders of magnitude, so this does not rise to fitted-input-called-prediction circularity.

Assumptions & free parameters 4 free parameters · 6 assumptions · 0 invented entities

The central claim rests on a domain assumption about attack artifacts (cheating tokens), an empirical separation of MLM probabilities, and a threshold fitted to clean data. No new scientific entities are posited.

free parameters (4)
  • N = 10
    Number of high-gradient tokens selected; tuned in Section 6.3 (Figure 5).
  • M = 5
    Number of lowest masked-token probabilities averaged into P-score; tuned in Section 6.3.
  • lambda = 0.1
    Scaling factor for threshold tau in Eq. 2; chosen via trade-off analysis in Section 6.3 and Appendix E.
  • K = 1000
    Number of query-document pairs sampled to estimate P-score distribution; default set in Section 4.2.
assumptions (6)
  • domain assumption Poisoned documents optimized for retrieval contain unnatural tokens with low MLM probabilities.
    Central detection hypothesis, stated in Section 3.2 and used in Section 4.2; validated only for the three attacks tested.
  • domain assumption Clean and relevant documents have substantially higher masked-token probabilities than poisoned documents.
    Empirical basis for threshold; supported by Table 3 and Figure 4 on the evaluated datasets.
  • standard math The retriever's similarity function is differentiable with respect to document token embeddings.
    Required to compute gradients in Eq. 1; holds for DPR, Contriever, and ColBERT encoders used.
  • domain assumption The attacker can inject documents but cannot retrain the retriever or generator.
    Adopted from prior attack work, stated in Section 4; does not cover adaptive attackers who know GMTP.
  • domain assumption GPT-4o as judge provides reliable correctness and attack-success labels.
    Relies on LLM-as-a-judge (Section 5.3, Appendix G); known to be imperfect, no human validation reported.
  • domain assumption The P-score threshold computed on K sampled relevant documents transfers to the test distribution.
    Required for Eq. 2; Appendix E shows sensitivity up to ~60% between relevant and random document estimates.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Safeguarding RAG Pipelines with GMTP: A Gradient-based Masked Token Probability Method for Poisoned Document Detection." pith.science (2026). https://pith.science/paper/TKTUBDUL

@misc{pith2026250718202,
  author       = {Pith},
  title        = {Pith review of: Safeguarding RAG Pipelines with GMTP: A Gradient-based Masked Token Probability Method for Poisoned Document Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TKTUBDUL}},
  note         = {Machine review of arXiv:2507.18202}
}
read the original abstract

Retrieval-Augmented Generation (RAG) enhances Large Language Models (LLMs) by providing external knowledge for accurate and up-to-date responses. However, this reliance on external sources exposes a security risk, attackers can inject poisoned documents into the knowledge base to steer the generation process toward harmful or misleading outputs. In this paper, we propose Gradient-based Masked Token Probability (GMTP), a novel defense method to detect and filter out adversarially crafted documents. Specifically, GMTP identifies high-impact tokens by examining gradients of the retriever's similarity function. These key tokens are then masked, and their probabilities are checked via a Masked Language Model (MLM). Since injected tokens typically exhibit markedly low masked-token probabilities, this enables GMTP to easily detect malicious documents and achieve high-precision filtering. Experiments demonstrate that GMTP is able to eliminate over 90% of poisoned content while retaining relevant documents, thus maintaining robust retrieval and generation performance across diverse datasets and adversarial settings.

Figures

Figures reproduced from arXiv: 2507.18202 by the authors.

Figure 1
Figure 1. Various corpus poisoning attacks on a Naïve [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Distribution of clean documents, poisoned [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Overview of the RAG pipeline incorporating the GMTP method to identify and exclude potentially [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (9 more)
Figure 4
Figure 4. Figure 4: Density plot showing the effects of different attack methods on the NQ dataset using the DPR model. [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: nDCG@10 and Filtering Rate using various [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 7
Figure 7. Figure 7: Latency of each method across the datasets. [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 8
Figure 8. Figure 8: Examples of poisoned documents for each attack method. Words in red indicate cheating tokens, while black words denote incorrect information or ad￾versarial commands. Attacks based on Hotflip exhibit significant unnatural text patterns, whereas AdvDecod￾ing generates m…
Figure 9
Figure 9. Figure 9: Evaluation prompt using GPT-4o [PITH_FULL_IMAGE:figures/full_fig_p015_9.png]
Figure 10
Figure 10. Figure 10: Density plot of masked token probability using DPR. [PITH_FULL_IMAGE:figures/full_fig_p017_10.png]
Figure 11
Figure 11. Figure 11: Density plot of masked token probability using Contriever. [PITH_FULL_IMAGE:figures/full_fig_p017_11.png]
Figure 12
Figure 12. Figure 12: nDCG@10 and filtering rate across various [PITH_FULL_IMAGE:figures/full_fig_p018_12.png]
Figure 13
Figure 13. Figure 13: nDCG@10 and filtering rate across various [PITH_FULL_IMAGE:figures/full_fig_p018_13.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

51 extracted references · 16 canonical work pages

  1. [1]

    Akari Asai, Zeqiu Wu, Yizhong Wang, Avi Sil, and Hannaneh Hajishirzi. 2024. Self-rag: Learning to retrieve, generate, and critique through self-reflection. In International Conference on Learning Representations

    work page 2024

  2. [2]

    Sebastian Borgeaud, Arthur Mensch, Jordan Hoffmann, Trevor Cai, Eliza Rutherford, Katie Millican, George Bm Van Den Driessche, Jean-Baptiste Lespiau, Bogdan Damoc, Aidan Clark, et al. 2022. Improving language models by retrieving from trillions of tokens. In International conference on machine learning, pages 2206--2240. PMLR

    2022

  3. [3]

    Harsh Chaudhari, Giorgio Severi, John Abascal, Matthew Jagielski, Christopher A Choquette-Choo, Milad Nasr, Cristina Nita-Rotaru, and Alina Oprea. 2024. Phantom: General trigger attacks on retrieval augmented language generation. CoRR

    work page 2024

  4. [4]

    Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. 2024. Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases. Advances in Neural Information Processing Systems, 37:130185--130213

    2024

  5. [5]

    Pengzhou Cheng, Yidong Ding, Tianjie Ju, Zongru Wu, Wei Du, Ping Yi, Zhuosheng Zhang, and Gongshen Liu. 2024. Trojanrag: Retrieval-augmented generation can be backdoor driver in large language models. CoRR

    work page 2024

  6. [6]

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies, volume 1 (long and short papers), pages 4171--4186

    2019

  7. [7]

    Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. 2024. The llama 3 herd of models. arXiv preprint arXiv:2407.21783

    arXiv 2024

  8. [8]

    Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2018. https://doi.org/10.18653/v1/P18-2006 H ot F lip: White-box adversarial examples for text classification . In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), pages 31--36, Melbourne, Australia. Association for Computational Linguistics

    doi:10.18653/v1/p18-2006 2018

Show all 51 references
  1. [9]

    Yunfan Gao, Yun Xiong, Xinyu Gao, Kangxiang Jia, Jinliu Pan, Yuxi Bi, Yi Dai, Jiawei Sun, and Haofen Wang. 2023. Retrieval-augmented generation for large language models: A survey. arXiv preprint arXiv:2312.10997

    2023 arXiv

  2. [10]

    Kelvin Guu, Kenton Lee, Zora Tung, Panupong Pasupat, and Mingwei Chang. 2020. Retrieval augmented language model pre-training. In International conference on machine learning, pages 3929--3938. PMLR

    2020

  3. [11]

    Lei Huang, Weijiang Yu, Weitao Ma, Weihong Zhong, Zhangyin Feng, Haotian Wang, Qianglong Chen, Weihua Peng, Xiaocheng Feng, Bing Qin, et al. 2023. A survey on hallucination in large language models: Principles, taxonomy, challenges, and open questions. arXiv preprint arXiv:2311.05232

    2023 arXiv

  4. [12]

    Poly-encoders: Architectures and pre-training strategies for fast and accurate multi-sentence scoring

    Samuel Humeau, Kurt Shuster, Marie-Anne Lachaux, and Jason Weston. Poly-encoders: Architectures and pre-training strategies for fast and accurate multi-sentence scoring. In International Conference on Learning Representations

  5. [13]

    Unsupervised dense information retrieval with contrastive learning

    Gautier Izacard, Mathilde Caron, Lucas Hosseini, Sebastian Riedel, Piotr Bojanowski, Armand Joulin, and Edouard Grave. Unsupervised dense information retrieval with contrastive learning. Transactions on Machine Learning Research

  6. [14]

    Fengqing Jiang, Zhangchen Xu, Luyao Niu, Zhen Xiang, Bhaskar Ramasubramanian, Bo Li, and Radha Poovendran. 2024. https://doi.org/10.18653/v1/2024.acl-long.809 A rt P rompt: ASCII art-based jailbreak attacks against aligned LLM s . In Proceedings of the 62nd Annual Meeting of t...

    2024 doi

  7. [15]

    Zhengbao Jiang, Frank Xu, Luyu Gao, Zhiqing Sun, Qian Liu, Jane Dwivedi-Yu, Yiming Yang, Jamie Callan, and Graham Neubig. 2023. https://doi.org/10.18653/v1/2023.emnlp-main.495 Active retrieval augmented generation . In Proceedings of the 2023 Conference on Empirical Methods in...

    2023 doi

  8. [16]

    Jeff Johnson, Matthijs Douze, and Herv \'e J \'e gou. 2019. Billion-scale similarity search with gpus. IEEE Transactions on Big Data, 7(3):535--547

    2019

  9. [17]

    Vladimir Karpukhin, Barlas Oguz, Sewon Min, Patrick Lewis, Ledell Wu, Sergey Edunov, Danqi Chen, and Wen-tau Yih. 2020 a . Dense passage retrieval for open-domain question answering. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMN...

    2020

  10. [18]

    Vladimir Karpukhin, Barlas Oguz, Sewon Min, Patrick Lewis, Ledell Wu, Sergey Edunov, Danqi Chen, and Wen-tau Yih. 2020 b . https://doi.org/10.18653/v1/2020.emnlp-main.550 Dense passage retrieval for open-domain question answering . In Proceedings of the 2020 Conference on Empi...

    2020 doi

  11. [19]

    Omar Khattab and Matei Zaharia. 2020. Colbert: Efficient and effective passage search via contextualized late interaction over bert. In Proceedings of the 43rd International ACM SIGIR conference on research and development in Information Retrieval, pages 39--48

    2020

  12. [20]

    Dai, Jakob Uszkoreit, Quoc Le, and Slav Petrov

    Tom Kwiatkowski, Jennimaria Palomaki, Olivia Redfield, Michael Collins, Ankur Parikh, Chris Alberti, Danielle Epstein, Illia Polosukhin, Jacob Devlin, Kenton Lee, Kristina Toutanova, Llion Jones, Matthew Kelcey, Ming-Wei Chang, Andrew M. Dai, Jakob Uszkoreit, Quoc Le, and Slav...

    2019 doi

  13. [21]

    u ttler, Mike Lewis, Wen-tau Yih, Tim Rockt \

    Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich K \"u ttler, Mike Lewis, Wen-tau Yih, Tim Rockt \"a schel, et al. 2020. Retrieval-augmented generation for knowledge-intensive nlp tasks. Advances in Neural Information Proc...

    2020

  14. [22]

    Zhuowan Li, Cheng Li, Mingyang Zhang, Qiaozhu Mei, and Michael Bendersky. 2024. Retrieval augmented generation or long-context llms? a comprehensive study and hybrid approach. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing: Industry T...

    2024

  15. [23]

    Na Liu, Liangyu Chen, Xiaoyu Tian, Wei Zou, Kaijiang Chen, and Ming Cui. 2024. From llm to conversational agent: A memory enhanced architecture with fine-tuning of large language models. arXiv preprint arXiv:2401.02777

    2024 arXiv

  16. [24]

    Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. 2019. Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv:1907.11692

    2019 arXiv

  17. [25]

    A language agent for autonomous driving

    Jiageng Mao, Junjie Ye, Yuxi Qian, Marco Pavone, and Yue Wang. A language agent for autonomous driving. In First Conference on Language Modeling

  18. [26]

    Han Cheol Moon, Shafiq Joty, and Xu Chi. 2022. Gradmask: Gradient-guided token masking for textual adversarial example detection. In Proceedings of the 28th ACM SIGKDD conference on knowledge discovery and data mining, pages 3603--3613

    2022

  19. [27]

    Ms marco: A human generated machine reading comprehension dataset

    Tri Nguyen, Mir Rosenberg, Xia Song, Jianfeng Gao, Saurabh Tiwary, Rangan Majumder, and Li Deng. Ms marco: A human generated machine reading comprehension dataset. choice, 2640:660

  20. [28]

    Rodrigo Nogueira and Kyunghyun Cho. 2019. Passage re-ranking with bert. arXiv preprint arXiv:1901.04085

    2019 arXiv

  21. [29]

    Language models are unsupervised multitask learners

    Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language models are unsupervised multitask learners

  22. [30]

    Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. 2020. Exploring the limits of transfer learning with a unified text-to-text transformer. Journal of machine learning research, 21(140):1--67

    2020

  23. [31]

    Machel Reid, Nikolay Savinov, Denis Teplyashin, Dmitry Lepikhin, Timothy Lillicrap, Jean-baptiste Alayrac, Radu Soricut, Angeliki Lazaridou, Orhan Firat, Julian Schrittwieser, et al. 2024. Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context. arX...

    2024 arXiv

  24. [32]

    Keshav Santhanam, Omar Khattab, Jon Saad-Falcon, Christopher Potts, and Matei Zaharia. 2022. Colbertv2: Effective and efficient retrieval via lightweight late interaction. In Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational ...

    2022

  25. [33]

    Zhihong Shao, Yeyun Gong, Yelong Shen, Minlie Huang, Nan Duan, and Weizhu Chen. 2023. Enhancing retrieval-augmented large language models with iterative retrieval-generation synergy. In Findings of the Association for Computational Linguistics: EMNLP 2023, pages 9248--9274

    2023

  26. [34]

    do anything now

    Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. 2024. " do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, page...

    2024

  27. [35]

    Zhen Tan, Chengshuai Zhao, Raha Moraffah, Yifan Li, Song Wang, Jundong Li, Tianlong Chen, and Huan Liu. 2024. Glue pizza and eat rocks-exploiting vulnerabilities in retrieval-augmented generative models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Lan...

    2024

  28. [36]

    Gemma Team, Thomas Mesnard, Cassidy Hardin, Robert Dadashi, Surya Bhupatiraju, Shreya Pathak, Laurent Sifre, Morgane Rivi \`e re, Mihir Sanjay Kale, Juliette Love, et al. 2024. Gemma: Open models based on gemini research and technology. arXiv preprint arXiv:2403.08295

    2024 arXiv

  29. [37]

    Beir: A heterogeneous benchmark for zero-shot evaluation of information retrieval models

    Nandan Thakur, Nils Reimers, Andreas R \"u ckl \'e , Abhishek Srivastava, and Iryna Gurevych. Beir: A heterogeneous benchmark for zero-shot evaluation of information retrieval models. In Thirty-fifth Conference on Neural Information Processing Systems Datasets and Benchmarks T...

  30. [38]

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. 2023. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288

    2023 arXiv

  31. [39]

    Chong Xiang, Tong Wu, Zexuan Zhong, David Wagner, Danqi Chen, and Prateek Mittal. 2024. Certifiably robust rag against retrieval corruption. arXiv preprint arXiv:2405.15556

    2024

  32. [40]

    Zihao Xu, Yi Liu, Gelei Deng, Yuekang Li, and Stjepan Picek. 2024 a . A comprehensive study of jailbreak attack versus defense for large language models. In Findings of the Association for Computational Linguistics ACL 2024, pages 7432--7449

    2024

  33. [41]

    Ziwei Xu, Sanjay Jain, and Mohan S Kankanhalli. 2024 b . Hallucination is inevitable: An innate limitation of large language models. CoRR

    2024

  34. [42]

    Jiaqi Xue, Mengxin Zheng, Yebowen Hu, Fei Liu, Xun Chen, and Qian Lou. 2024. Badrag: Identifying vulnerabilities in retrieval augmented generation of large language models. arXiv preprint arXiv:2406.00083

    2024 arXiv

  35. [43]

    Zhilin Yang, Peng Qi, Saizheng Zhang, Yoshua Bengio, William Cohen, Ruslan Salakhutdinov, and Christopher D. Manning. 2018. https://doi.org/10.18653/v1/D18-1259 H otpot QA : A dataset for diverse, explainable multi-hop question answering . In Proceedings of the 2018 Conference...

    2018 doi

  36. [44]

    Collin Zhang, Tingwei Zhang, and Vitaly Shmatikov. 2024. Controlled generation of natural adversarial documents for stealthy retrieval poisoning. arXiv preprint arXiv:2410.02163

    2024 arXiv

  37. [45]

    Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric Xing, et al. 2023. Judging llm-as-a-judge with mt-bench and chatbot arena. Advances in Neural Information Processing Systems, 36:46595--46623

    2023

  38. [46]

    Zexuan Zhong, Ziqing Huang, Alexander Wettig, and Danqi Chen. 2023. Poisoning retrieval corpora by injecting adversarial passages. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 13764--13775

    2023

  39. [47]

    Huichi Zhou, Kin-Hei Lee, Zhonghao Zhan, Yue Chen, and Zhenhao Li. 2025. Trustrag: Enhancing robustness and trustworthiness in rag. arXiv preprint arXiv:2501.00879

    2025 arXiv

  40. [48]

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043

    2023 arXiv

  41. [49]

    Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. 2024. Poisonedrag: Knowledge poisoning attacks to retrieval-augmented generation of large language models. arXiv preprint arXiv:2402.07867

    2024 arXiv

  42. [50]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list...

  43. [51]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.