REVIEW 15 cited by
Feedback-Guided Extraction of Knowledge Base from Retrieval-Augmented LLM Applications
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
Feedback-Guided Extraction of Knowledge Base from Retrieval-Augmented LLM Applications
read the original abstract
Retrieval-Augmented Generation (RAG) expands the knowledge boundary of large language models (LLMs) by integrating external knowledge bases, whose construction is often time-consuming and laborious. If an adversary extracts the knowledge base verbatim, it not only severely infringes the owner's intellectual property but also enables the adversary to replicate the application's functionality for unfair competition. Previous works on knowledge base extraction are limited either by low extraction coverage (usually less than 4%) in query-based attacks or by impractical assumptions of white-box access in embedding-based optimization methods. In this work, we propose CopyBreakRAG, an agent-based black-box attack that reasons from feedback and adaptively generates new adversarial queries for progressive extraction. By balancing exploration and exploitation through curiosity-driven queries and feedback-guided query refinement, our method overcomes the limitations of prior approaches and achieves significantly higher extraction coverage in realistic black-box settings. Experimental results show that CopyBreakRAG outperforms the state-of-the-art black-box approach by 45% on average in terms of chunk extraction ratio from applications built with mainstream RAG frameworks, and extracts over 70% of the data from the knowledge base in applications on commercial platforms including OpenAI's GPTs and ByteDance's Coze when essential protection is in place.
Forward citations
Cited by 15 Pith papers
-
Knowledge Poisoning Attacks on Medical Multi-Modal Retrieval-Augmented Generation
M³Att poisons medical multimodal RAG by pairing covert textual misinformation with query-agnostic visual perturbations that increase retrieval of the bad content, causing LLMs to generate clinically plausible but inco...
-
ShadowMerge: A Novel Poisoning Attack on Graph-Based Agent Memory via Relation-Channel Conflicts
ShadowMerge poisons graph-based agent memory by creating relation-channel conflicts that get extracted and retrieved, achieving 93.8% attack success rate on Mem0 and datasets like PubMedQA while evading prior defenses.
-
ShadowMerge: A Novel Poisoning Attack on Graph-Based Agent Memory via Relation-Channel Conflicts
ShadowMerge exploits relation-channel conflicts to poison graph-based agent memory, achieving 93.8% average attack success rate on Mem0 and real-world datasets while bypassing existing defenses.
-
ShadowMerge: A Novel Poisoning Attack on Graph-Based Agent Memory via Relation-Channel Conflicts
ShadowMerge poisons graph-based agent memory via relation-channel conflicts using an AIR pipeline, achieving 93.8% average attack success rate on Mem0 and three real-world datasets while bypassing existing defenses.
-
Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents
Malicious tools can systematically extract isolated LLM-agent long-term memory via persistence, pure-anchor retrieval steering, and reactivation payloads, reaching 80% extraction with unlimited triggers and 47% with 20.
-
External Data Extraction Attacks against Retrieval-Augmented Large Language Models
SECRET, an adaptive RAG extraction attack that fuses LLM-optimized jailbreak prompts with cluster-guided queries, extracts large portions of private databases from commercial and open LLMs, including ~35% of a sampled...
-
AgentWorm: Self-Propagating Attacks Across LLM Agent Ecosystems
A single adversarial message can persistently hijack an LLM agent's configuration and make it autonomously spread the same attack to other agents, succeeding in 64.5% of controlled trials.
-
Graphs Don't Stay Secret: Practical Subgraph Reconstruction Attacks on Defended Graph RAG
GRASP, a closed-box multi-turn prompt attack, reconstructs type-faithful one-hop subgraphs from defended Graph RAG systems, reaching up to 82.9 F1 where prior attacks fail.
-
Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents
A data-centric survey finds that only information-flow control covers compositional and cross-session leakage in LLM agents and that no single benchmark tests an agent across all its data surfaces under one policy.
-
Hierarchical Long-Term Semantic Memory for LinkedIn's Hiring Agent
HLTM structures textual data into a schema-aligned memory tree for scalable ingestion and low-latency retrieval in LinkedIn's Hiring Assistant, reporting over 5% higher answer correctness, over 10% higher retrieval F1...
-
ALDEN: Boosting Private Data Extraction from Retrieval-Augmented Generation Systems via Active Learning and Distribution Estimation
ALDEN boosts private data extraction rates from RAG systems by combining active learning for query diversification with dynamic estimation of the underlying knowledge-base topic distribution.
-
Benchmarking Knowledge-Extraction Attack and Defense on Retrieval-Augmented Generation
A unified benchmark comparing RAG knowledge-extraction attacks and defenses, showing query diversity boosts extraction, embedding attacks fail to transfer, and graph indexing raises per-token leakage.
-
Hierarchical Long-Term Semantic Memory for LinkedIn's Hiring Agent
HLTM builds a hierarchical memory tree from longitudinal data to enable scalable, private, low-latency retrieval, delivering over 10% gains in answer correctness and retrieval F1 for LinkedIn's Hiring Assistant while ...
-
SPARK: Search Personalization via Agent-Driven Retrieval and Knowledge-sharing
SPARK is a proposed framework that coordinates persona-based LLM agents with layered memory and three collaboration protocols to produce personalized search.
-
A Survey of Scaling in Large Language Model Reasoning
A survey categorizing scaling in LLM reasoning across input size, steps, rounds, training, and future directions, noting that scaling can negatively affect performance.
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.