Poison-RAG: Adversarial Data Poisoning Attacks on Retrieval-Augmented Generation in Recommender Systems

Fatemeh Nazary; Tommaso Di Noia; Yashar Deldjoo

REVIEW 4 major objections 6 minor 4 cited by

Poison-RAG: Adversarial Data Poisoning Attacks on Retrieval-Augmented Generation in Recommender Systems

T0 review · 4 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Local, item-specific tag edits can demote popular items in text-based RAG recommenders, while uniform tag edits often boost the very items the attacker targeted.

desk verdict A genuinely new attack surface for RAG recommenders, but the headline 'up to 50%' claim is not backed by the paper's own tables and the evaluation is too thin to support the strong framing. read the letter →

arxiv 2501.11759 v1 pith:FB3BCCOY submitted 2025-01-20 cs.IR

Fatemeh Nazary , Yashar Deldjoo , Tommaso di Noia This is my paper · ORCID

classification cs.IR

keywords retrieval-augmentedgenerationadversarialdatapoisoningrecommendersystemsecuritytagmanipulationblack-boxattackitemexposureMovieLensaugmentation

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Poison-RAG is a framework for attacking retrieval-augmented generation (RAG) recommenders, the class of systems that retrieve candidate items using text embeddings of users and items and then rerank or generate with an LLM. The paper tries to establish that a provider-side adversary can shift exposure by editing only item tags, choosing tags that are both semantically close to the item and characteristic of the opposite popularity class. In black-box experiments on MovieLens, the local, item-specific version reduced the popularity lift of popular items and improved manipulation effectiveness by up to 50%; the global, uniform version often did the reverse, boosting popular items. The authors also find that long-tail items are hard to promote and that approximately 70% of items lack original tags, so auto-generated metadata acts only as a partial defense. The paper's conclusion is that tag-level metadata poisoning is a real attack surface for text-based retrieval recommenders, and that local tag selection is the variant that deserves defensive attention.

What carries the argument

The load-bearing object is the per-tag adversarial score $A'(t,i)=A(t)\cdot s(t,i)$. The first factor, $A(t)=\log\left(\frac{P(t\mid c_{\text{target}})}{P(t\mid c_{\text{orig}})+\epsilon}\right)$, biases tag choice toward the opposite popularity class; the second factor, $s(t,i)$, keeps the added tag semantically close to the item so the edit is stealthy. Local tag selection builds an item-specific candidate pool by retrieving, with BERT embeddings, items in the target class that resemble the victim item, whereas global selection applies one uniform tag pool to every item. The contrast between the two pools is what explains the paper's headline result: local edits stay semantically plausible and shift the embedding only slightly, while global edits contaminate the item text so broadly that popular items' embeddings remain more centrally located and get recommended more often.

What would settle it

Take the same MovieLens setup and the same local tag-selection procedure, but replace the retrieval scorer with a lightly hybrid one that adds a small collaborative term (for example, a matrix-factorization score added to the cosine score) or insert a metadata-plausibility check that rejects tags absent from trusted sources; if popularity lift no longer drops by the reported margins, the attack surface is specific to the pure mean-embedding ranker rather than to RAG recommenders as a class.

Watch

Extended reading notes

Core claim

The paper claims that a text-based RAG recommender can be manipulated by an adversary who changes only item tags. Formally, Poison-RAG selects up to $k$ tags per item to maximize the composite score $A'(t,i) = A(t)\cdot s(t,i)$, where $A(t)=\log\big(P(t\mid c_{\text{target}})/P(t\mid c_{\text{orig}})\big)$ measures how strongly tag $t$ is associated with the opposite popularity class and $s(t,i)$ is the cosine similarity between BERT embeddings of the tag and the item. In black-box experiments on MovieLens, the local selection strategy reduced popularity lift (for example, from 0.9380 to 0.9191 in one cold-start condition and from 1.3600 to 0.9304 with data augmentation) and lowered popular-item hit rates by 5--6%, while global uniform tag edits raised popularity lift to values such as 1.3938 and raised popular-item HR@1 by 24--35%, meaning the global attack backfired. The paper reports that promoting long-tail items generally failed, so the effective outcome of the successful local attack is demotion of popular items rather than rebalancing toward long-tail ones.

Load-bearing premise

The effectiveness of Poison-RAG rests on the target being a text-based RAG recommender that forms user profiles as averages of item-text embeddings and ranks by cosine similarity to item embeddings, with no validation of metadata edits.

Editorial extensions

If this is right

A black-box attacker who can edit only item tags, with no access to the recommender's parameters, can reduce the exposure of popular items in this text-based RAG pipeline.
Uniform tag edits are not merely weak; in this setting they can increase popular items' hit rates by 24--35%, so an attacker applying them indiscriminately would help the target items.
Long-tail items are substantially harder to promote: across most conditions their coverage and relevance metrics did not improve, which limits the 'promote long-tail, demote popular' objective to the demotion half.
Because the demotion persists both before and after LLM reranking, the vulnerability is in the retrieval representations, not only in the final generative step.
The roughly 70% of items with no original tags form the largest editable surface, and the paper's data-augmentation results show that filling that gap with auto-generated tags and descriptions gives only a partial defense, mainly for mid-tail items.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the asymmetry generalizes, system operators should prioritize validation and monitoring of metadata changes on popular items, since each poisoned popular item shifts a user-profile average that many users share.
The attack's reported 50% advantage of local over global selection is likely specific to the cosine-mean architecture; on a recommender that re-ranks with an LLM that reads full descriptions rather than pooled embeddings, tag edits of this size may have smaller effect.
A natural testable extension is to enlarge the local candidate pool or to seed it with tags from mid-tail items; the paper's long-tail failures may come from thin candidate pools rather than from an inherent law of embeddings.
The same tag-selection scoring could be repurposed defensively, for instance to rank item tags by 'shift risk' and flag items whose tags have high $A(t)$ relative to their class, providing an inexpensive monitoring signal.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Let me give you the short version: the paper is a clean, well-scoped attack study on a relevant question, and the local-versus-global tag selection contrast is genuinely new. But the headline 'up to 50%' claim does not survive contact with the tables, and the evaluation is too thin to support the strong framing. It deserves a serious referee, but it needs major work before it is citable as evidence.

What I liked: attacking RAG recommenders through tag metadata is timely, and this is the first paper I know to frame the attack objective in terms of exposure and popularity classes rather than generic QA answer quality. The adversarial score combining a log-frequency-ratio with BERT semantic similarity is a reasonable design, and the local strategy (constructing per-item tag pools from similar items in the opposite popularity class) is a sensible, non-obvious mechanism. The related work is honestly placed: they explicitly contrast with BadRAG, PoisonedRAG, and Phantom, and the recommender-specific angle is a real gap. The writing is clear, and the code/data promise helps.

Where it gets soft. The abstract's 'up to 50%' is the central quantitative claim, and it is internally inconsistent with the text. In RQ2 the text reports a 5–6% HR@1 drop for popular items using baselines 0.3229→0.3021 (before reranking) and 0.2708→0.2552 (after). Those are the original, non-augmented columns. The 50% figure only appears in the data-augmentation columns (0.3750→0.1979, 0.3594→0.1719), which the text describes with different baselines. No confidence intervals, no number of runs, no significance tests anywhere. That is a load-bearing inconsistency: the abstract overstates what the tables show. Second, the evaluation is a single small dataset (365 users), a self-built RAG pipeline, and no independent recommender baseline. The 'black-box' setting only means the attacker lacks model internals; it says nothing about whether a deployed text-based recommender would respond the same way. The long-tail promotion goal fails in nearly every configuration, and the paper acknowledges this, but it undercuts the framing that the attack 'promotes' anything. Global attacks backfiring is a useful cautionary finding, but it is also the only robust pattern in the tables.

The core idea is plausible, and the local attack's 2% popularity-lift reduction and 5–6% HR drop are at least directionally consistent. But without error bars or an external baseline, I cannot tell whether those numbers are meaningful. A revision that fixes the abstract, reports uncertainty, and tests at least one independent recommender implementation would change my view.

Who should read it: people working on RAG security or recommender robustness will want to know this attack surface exists. I would bring it to reading group as a cautionary example of how to report attack effectiveness, not as a benchmark result. My recommendation: send it to review if you believe the area needs this question on record, but flag the inconsistencies and demand a stronger evaluation before acceptance.

Referee Report

4 major / 6 minor

Summary. The paper introduces Poison-RAG, a data-poisoning attack on text-based retrieval-augmented recommender systems. The attacker modifies item tags, leaving title and genre unchanged, with the stated dual objective of promoting long-tail items and demoting popular items. Tag selection maximizes A'(t,i) = A(t) * s(t,i), where A(t) is a log-ratio of tag occurrence probabilities between the target and original popularity classes and s(t,i) is BERT cosine similarity. Local and global strategies differ in how the candidate tag pool is constructed. The evaluation on MovieLens (365 users, 3,079 items) with GPT-generated descriptions and OpenAI embeddings compares popularity lift, long-tail coverage, mean popularity rank, and relevance metrics before and after reranking, with and without data augmentation. The paper claims that local attacks effectively reduce popular-item exposure and relevance, global attacks tend to backfire, long-tail items are difficult to promote, and data augmentation offers only partial defense.

Significance. If the results hold, the paper would establish that lightweight tag edits are a practical attack vector against text-based RAG recommenders and that item-specific local tag selection is more effective than uniform global tags. The paper's strengths include a clean formalization of the attack objective, a tag-scoring function that combines frequency-based adversarial impact with semantic similarity as a plausibility criterion, a public code/data link, and an explicit treatment of cold-start via data augmentation. The significance is curtailed by the evaluation: one small dataset, no error bars or significance tests, no independent recommender baseline, and an internal inconsistency in the headline 'up to 50%' figure. The conceptual framework is useful, but the current evidence does not yet support the quantitative claims as stated.

major comments (4)

[Abstract and Section 4 (RQ2, Table 6)] The abstract's claim that local strategies 'improve manipulation effectiveness by up to 50%' is not supported by the presented results in a consistent way. The RQ2 text reports popular-item HR@1 drops of 'about 5-6%' using the non-augmented columns (0.3229 to 0.3021 before reranking; 0.2708 to 0.2552 after reranking), while the 50% figure only matches the Data Augmentation columns (0.3750 to 0.1979 before reranking; 0.3594 to 0.1719 after reranking). No confidence intervals, number of runs, or significance tests are reported for either set of numbers, and the baseline values differ between panels of Table 6. This internal inconsistency affects the paper's headline result and must be fixed by reconciling the text and table and reporting uncertainty.
[Sections 3 and 4 (Tables 5 and 6)] The experimental evaluation is based on a single dataset with 365 users and 3079 items, and all conclusions rest on point estimates without variance, bootstrap confidence intervals, or significance tests. Several central differences are small (e.g., popularity lift 0.9380 to 0.9191 in Table 5; HR@1 0.3229 to 0.3021 in Table 6) and could be within noise. The paper should add multiple runs with different seeds or splits, or resampling-based intervals, and report effect sizes before claiming that popular items are more susceptible and that local attacks are effective.
[Section 2.1 versus Section 4 (Tables 5 and 6)] The formal attack objective in Section 2.1 jointly maximizes long-tail exposure and minimizes popular exposure, but the reported results show long-tail items becoming less visible: long-tail coverage decreases (Table 5, LT.Cov: Decay 0.0073 to 0.0046; Rating 0.0086 to 0.0061) and long-tail HR@1 drops (Table 6: 0.0909 to 0.0455, and to 0.0303 in the augmented condition). Although the paper acknowledges this in the RQ answers, the abstract and introduction still list promotion of long-tail items as a primary goal. The contribution should be reframed as a demotion-only attack, or the method should be revised to achieve the stated dual objective.
[Sections 3.1 and 4] The attack is evaluated only on the authors' self-built pipeline (GPT-3.5-turbo item embeddings, cosine retrieval, and an LLM reranker), with no independent or standard recommender implementation as a comparison. The central premise that tag-level metadata poisoning is a viable attack surface for deployed text-based RAG recommenders therefore remains untested. The authors should vary key components (embedding model, retrieval function, reranker) or evaluate against an established text-based recommender to demonstrate transferability.

minor comments (6)

[Various] Typographical errors should be corrected: 'Both trategies' in Section 2.3, 'raking upwards' in Table 2, 'black- vas. white-box' in Section 2.1, and 'less detectible' in the Answer to RQ2.
[Tables 5 and 6] The column header 'B' in Tables 5 and 6 is not defined; it should be labeled 'Baseline', and the nested table layout should be simplified to make the comparison between local, global, and baseline conditions readable.
[Section 2.1] The indicator function I(i ∈ R'(u)) in the Exposure definition is redundant when the objective already restricts the sums to R'(u) ∩ IL and R'(u) ∩ IP; this notation should be cleaned up.
[Section 3.1] The hyperparameters λ = 0.01, α = 1.2, and k ∈ {1, 3, 5} are stated without sensitivity analysis; a brief analysis of how results vary with these choices would strengthen the paper.
[References] Reference [1] is a non-archival blog post; it should be replaced with a peer-reviewed or archival source for the claim that about 60% of LLM applications use RAG.
[Sections 2.2 and 3] Please state the numerical value of the smoothing constant ϵ and the exact OpenAI API model or version and query date, so that the tag-frequency estimates and embeddings are reproducible.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the attack score and the evaluation metrics are distinct, and self-citations are not load-bearing.

full rationale

The derivation chain is self-contained. Poison-RAG selects tags using an explicit score A'(t,i) = A(t) * s(t,i), where A(t) is a log-ratio of class-conditional tag frequencies and s(t,i) is a BERT embedding cosine; the evaluation then independently measures popularity lift, long-tail coverage, rank, HR, MRR, and nDCG on a GPT-embedding retrieval pipeline. No parameter is fitted to the reported test cells and then reported as a prediction, and the attack score is not an algebraic reformulation of the evaluation metrics. Self-citations appear in the motivation and related work (e.g., references [6,7,8,9,10]), but none is load-bearing for the attack construction or for the answers to RQ1/RQ2. The abstract's 'up to 50%' improvement figure is not traceable to the same cells as the RQ2 text's 'about 5–6%' drop (Section 4, Table 6), and no confidence intervals are reported; this is an internal consistency and correctness concern, not a circularity. The evaluation is performed on a self-built recommender, so external transferability is untested, but that is a benchmarking limitation rather than a circular derivation.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The framework uses standard components (BERT embeddings, GPT-3.5 generated text, log-frequency tag scoring) and introduces no new entities. The load-bearing free choices are the user-profile aggregation hyperparameters (lambda, alpha), the smoothing epsilon, the attack size k, and the unstated popularity thresholds; none are fitted to data to manufacture the result, but the under-specification hampers independent replication.

free parameters (6)

epsilon (smoothing constant) = not specified
Appears in P(t|c) = (Count(t,c)+epsilon)/(sum+epsilon*|T|) and inside the log in A(t) (Section 2.2); its value changes tag scores and is never reported.
lambda (temporal decay rate) = 0.01
Used in w(t)=e^{-lambda*time_diff} for temporal-decay user profile aggregation (Section 3.1); chosen by hand and affects all user embeddings and downstream results.
alpha (power factor) = 1.2
Applied as w'(t)=w(t)^alpha in the temporal-decay profile variant (Section 3.1); chosen by hand, no sensitivity analysis.
k (number of modified tags per item) = 1, 3, 5
Attack size hyperparameter in the tag-selection optimization (Section 2.2); the abstract's 'up to 50%' claim depends on which k and metric cell is selected.
popularity class thresholds = not specified
Items are assigned to popular/mid-tail/long-tail classes (notation table, Section 2.1) but the cutoffs are never stated, so the attack objective and success metrics are not fully pinned down.
candidate tag pool size = not specified
The local strategy builds an item-specific candidate pool from similar items in the opposite class (Section 2.3); the pool size constrains tag selection and is not reported.

assumptions (5)

domain assumption The target recommender ranks candidates by cosine similarity between a user-profile embedding and item text embeddings.
Section 3.1 defines user profiles as rating-weighted or temporally decayed averages of item embeddings; the retrieval stage is not otherwise specified, so all attack evaluations presuppose this embedding-similarity ranker.
domain assumption The attacker can edit tags of arbitrary target items, and these edits enter retrieval without validation or anomaly detection.
Section 2.1 states the attacker's capability as modifying only item tags and claims stealthiness, but no detection mechanism or defense is modeled in the experiments.
domain assumption LLM-generated descriptions and NLP-extracted tags faithfully represent item content for embedding purposes.
Section 3 enriches every item with a GPT-3.5-turbo description and auto-generated tags; user profiles, item embeddings, and attack tag scores are all computed from this generated text, so errors or hallucinations propagate into the evaluation.
domain assumption The popular/mid-tail/long-tail partition of items is well-defined and stable.
The attack objective (Section 2.1) and all exposure and relevance metrics depend on these popularity classes, but the thresholds used to create them are not reported.
standard math Standard probability and linear algebra (log-frequency ratios, cosine similarity) correctly model tag-class association and tag-item relevance.
Section 2.2 defines A(t) and s(t,i) using standard formulas; these are unproblematic as mathematical tools.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Poison-RAG: Adversarial Data Poisoning Attacks on Retrieval-Augmented Generation in Recommender Systems." pith.science (2026). https://pith.science/paper/FB3BCCOY

@misc{pith2026250111759,
  author       = {Pith},
  title        = {Pith review of: Poison-RAG: Adversarial Data Poisoning Attacks on Retrieval-Augmented Generation in Recommender Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FB3BCCOY}},
  note         = {Machine review of arXiv:2501.11759}
}

read the original abstract

This study presents Poison-RAG, a framework for adversarial data poisoning attacks targeting retrieval-augmented generation (RAG)-based recommender systems. Poison-RAG manipulates item metadata, such as tags and descriptions, to influence recommendation outcomes. Using item metadata generated through a large language model (LLM) and embeddings derived via the OpenAI API, we explore the impact of adversarial poisoning attacks on provider-side, where attacks are designed to promote long-tail items and demote popular ones. Two attack strategies are proposed: local modifications, which personalize tags for each item using BERT embeddings, and global modifications, applying uniform tags across the dataset. Experiments conducted on the MovieLens dataset in a black-box setting reveal that local strategies improve manipulation effectiveness by up to 50\%, while global strategies risk boosting already popular items. Results indicate that popular items are more susceptible to attacks, whereas long-tail items are harder to manipulate. Approximately 70\% of items lack tags, presenting a cold-start challenge; data augmentation and synthesis are proposed as potential defense mechanisms to enhance RAG-based systems' resilience. The findings emphasize the need for robust metadata management to safeguard recommendation frameworks. Code and data are available at https://github.com/atenanaz/Poison-RAG.

Figures

Figures reproduced from arXiv: 2501.11759 by the authors.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 4 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Bias Amplification in RAG: Poisoning Knowledge Retrieval to Steer LLMs
cs.LG 2025-06 reject novelty 6.0 of 10

A retrieval-augmented generation system can be poisoned with reward-optimized biased documents and vector-space manipulation to substantially increase biased LLM outputs.
Preventing Rogue Agents Improves Multi-Agent Collaboration
cs.CL 2025-02 conditional novelty 6.0 of 10

A monitor trained on agent uncertainty statistics triggers rollbacks that improve multi-agent LLM collaboration across three test environments.
Use of Air Quality Sensor Network Data for Real-time Pollution-Aware POI Suggestion
cs.IR 2025-02 conditional novelty 5.0 of 10

AirSense-R is a privacy-preserving POI recommendation system that blends user preferences with real-time air quality data from low-cost sensor networks.
AirTOWN: A Privacy-Preserving Mobile App for Real-time Pollution-Aware POI Suggestion
cs.IR 2025-01 conditional novelty 4.0 of 10

AirTOWN is a mobile recommender that re-ranks point-of-interest suggestions using live air quality, personal preferences, and distance, with federated learning for privacy.

Reference graph

Works this paper leans on

16 extracted references · 6 canonical work pages · cited by 4 Pith papers

[1]

AI, T.: A taxonomy of retrieval-augmented genera- tion. Towards AI (2024), https://pub.towardsai.net/ a-taxonomy-of-retrieval-augmented-generation-a39eb2c4e2ab , accessed: 2024-11-08 Poison-RAG: Adversarial Data Poisoning Attacks on RAG 13

work page 2024
[2]

arXiv preprint arXiv:2405.20446 (2024)

Anderson, M., Amit, G., Goldsteen, A.: Is My Data in Your Retrieval Database? Membership Inference Attacks Against Retrieval Augmented Generation. arXiv preprint arXiv:2405.20446 (2024)

arXiv 2024
[3]

In: The 34th International FLAIRS Conference

Anelli, V.W., Bellogin, A., Deldjoo, Y., Di Noia, T., Merra, F.A.: Msap: Multi- step adversarial perturbations on recommender systems embeddings. In: The 34th International FLAIRS Conference. The Florida AI Research Society (FLAIRS), AAAI Press. pp. 1–6 (2021)

work page 2021
[4]

arXiv preprint arXiv:2405.20485 (2024)

Chaudhari, H., Severi, G., Abascal, J., Jagielski, M., Choquette-Choo, C.A., Nasr, M., Nita-Rotaru, C., Oprea, A.: Phantom: General Trigger Attacks on Retrieval Augmented Language Generation. arXiv preprint arXiv:2405.20485 (2024)

arXiv 2024
[5]

arXiv preprint arXiv:2407.13757 (2024)

Chen, Z., Liu, J., Liu, H., Cheng, Q., Zhang, F., Lu, W., Liu, X.: Black-Box Opin- ion Manipulation Attacks to Retrieval-Augmented Generation of Large Language Models. arXiv preprint arXiv:2407.13757 (2024)

arXiv 2024
[6]

ACM Transactions on Rec- ommender Systems (2024).https://doi.org/10.1145/3690655

Deldjoo, Y.: Understanding Biases in ChatGPT-based Recommender Systems: Provider Fairness, Temporal stability, and Recency. ACM Transactions on Rec- ommender Systems (2024).https://doi.org/10.1145/3690655

doi:10.1145/3690655 2024
[7]

ACM Transactions on Intelligent Systems and Technology (TIST) (2025)

Deldjoo, Y., Di Noia, T.: CFaiRLLM: Consumer Fairness Evaluation in Large- Language Model Recommender System. ACM Transactions on Intelligent Systems and Technology (TIST) (2025)

2025
[8]

ACM Computing Surveys (CSUR) (2), 1–38 (2022)

Deldjoo, Y., Di Noia, T., Merra, F.A.: A survey on Adversarial Recommender Systems: from attack/defense Strategies to Generative Adversarial Networks. ACM Computing Surveys (CSUR) (2), 1–38 (2022)

work page 2022

Show all 16 references

[9]

In: Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining

Deldjoo, Y., He, Z., McAuley, J., Korikov, A., Sanner, S., Ramisa, A., Vidal, R., Sathiamoorthy, M., Kasirzadeh, A., Milano, S.: A Review of Modern Recommender Systems using Generative Models (Gen-RecSys). In: Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discover...

2024
[10]

arXiv preprint arXiv:2409.15173 (2024)

Deldjoo, Y., He, Z., McAuley, J., Korikov, A., Sanner, S., Ramisa, A., Vidal, R., Sathiamoorthy, M., Kasrizadeh, A., Milano, S., et al.: Recommendation with gen- erative models. arXiv preprint arXiv:2409.15173 (2024)

2024 arXiv
[11]

In: Proceedings of the 17th ACM Conference on Recommender Systems

Di Palma, D.: Retrieval-augmented recommender system: Enhancing recommender systems with large language models. In: Proceedings of the 17th ACM Conference on Recommender Systems. pp. 1369–1373 (2023)

2023
[12]

In: Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining

Fan, W., Ding, Y., Ning, L., Wang, S., Li, H., Yin, D., Chua, T.S., Li, Q.: A survey on rag meeting llms: Towards retrieval-augmented large language models. In: Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. pp. 6491–6501 (2024)

2024
[13]

Li, Y., Liu, G., Wang, C., Yang, Y.: Generating Is Believing: Membership Inference AttacksagainstRetrieval-AugmentedGeneration.arXivpreprintarXiv:2406.19234 (2024)

2024 arXiv
[14]

arXiv preprint arXiv:2306.05817 (2023)

Lin, J., Dai, X., Xi, Y., Liu, W., Chen, B., Zhang, H., Liu, Y., Wu, C., Li, X., Zhu, C., et al.: How can recommender systems benefit from large language models: A survey. arXiv preprint arXiv:2306.05817 (2023)

2023 arXiv
[15]

arXiv preprint arXiv:2406.00083 (2024)

Xue, J., Zheng, M., Hu, Y., Liu, F., Chen, X., Lou, Q.: BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models. arXiv preprint arXiv:2406.00083 (2024)

2024 arXiv
[16]

arXiv preprint arXiv:2402.07867 (2024)

Zou, W., Geng, R., Wang, B., Jia, J.: Poisonedrag: Knowledge corruption at- tacks to retrieval-augmented generation of large language models. arXiv preprint arXiv:2402.07867 (2024)

2024 arXiv

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.

[1] [1]

AI, T.: A taxonomy of retrieval-augmented genera- tion. Towards AI (2024), https://pub.towardsai.net/ a-taxonomy-of-retrieval-augmented-generation-a39eb2c4e2ab , accessed: 2024-11-08 Poison-RAG: Adversarial Data Poisoning Attacks on RAG 13

work page 2024

[2] [2]

arXiv preprint arXiv:2405.20446 (2024)

Anderson, M., Amit, G., Goldsteen, A.: Is My Data in Your Retrieval Database? Membership Inference Attacks Against Retrieval Augmented Generation. arXiv preprint arXiv:2405.20446 (2024)

arXiv 2024

[3] [3]

In: The 34th International FLAIRS Conference

Anelli, V.W., Bellogin, A., Deldjoo, Y., Di Noia, T., Merra, F.A.: Msap: Multi- step adversarial perturbations on recommender systems embeddings. In: The 34th International FLAIRS Conference. The Florida AI Research Society (FLAIRS), AAAI Press. pp. 1–6 (2021)

work page 2021

[4] [4]

arXiv preprint arXiv:2405.20485 (2024)

Chaudhari, H., Severi, G., Abascal, J., Jagielski, M., Choquette-Choo, C.A., Nasr, M., Nita-Rotaru, C., Oprea, A.: Phantom: General Trigger Attacks on Retrieval Augmented Language Generation. arXiv preprint arXiv:2405.20485 (2024)

arXiv 2024

[5] [5]

arXiv preprint arXiv:2407.13757 (2024)

Chen, Z., Liu, J., Liu, H., Cheng, Q., Zhang, F., Lu, W., Liu, X.: Black-Box Opin- ion Manipulation Attacks to Retrieval-Augmented Generation of Large Language Models. arXiv preprint arXiv:2407.13757 (2024)

arXiv 2024

[6] [6]

ACM Transactions on Rec- ommender Systems (2024).https://doi.org/10.1145/3690655

Deldjoo, Y.: Understanding Biases in ChatGPT-based Recommender Systems: Provider Fairness, Temporal stability, and Recency. ACM Transactions on Rec- ommender Systems (2024).https://doi.org/10.1145/3690655

doi:10.1145/3690655 2024

[7] [7]

ACM Transactions on Intelligent Systems and Technology (TIST) (2025)

Deldjoo, Y., Di Noia, T.: CFaiRLLM: Consumer Fairness Evaluation in Large- Language Model Recommender System. ACM Transactions on Intelligent Systems and Technology (TIST) (2025)

2025

[8] [8]

ACM Computing Surveys (CSUR) (2), 1–38 (2022)

Deldjoo, Y., Di Noia, T., Merra, F.A.: A survey on Adversarial Recommender Systems: from attack/defense Strategies to Generative Adversarial Networks. ACM Computing Surveys (CSUR) (2), 1–38 (2022)

work page 2022