REVIEW 18 cited by
Poisoning Retrieval Corpora by Injecting Adversarial Passages
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
Signed reviews
read the original abstract
Dense retrievers have achieved state-of-the-art performance in various information retrieval tasks, but to what extent can they be safely deployed in real-world applications? In this work, we propose a novel attack for dense retrieval systems in which a malicious user generates a small number of adversarial passages by perturbing discrete tokens to maximize similarity with a provided set of training queries. When these adversarial passages are inserted into a large retrieval corpus, we show that this attack is highly effective in fooling these systems to retrieve them for queries that were not seen by the attacker. More surprisingly, these adversarial passages can directly generalize to out-of-domain queries and corpora with a high success attack rate -- for instance, we find that 50 generated passages optimized on Natural Questions can mislead >94% of questions posed in financial documents or online forums. We also benchmark and compare a range of state-of-the-art dense retrievers, both unsupervised and supervised. Although different systems exhibit varying levels of vulnerability, we show they can all be successfully attacked by injecting up to 500 passages, a small fraction compared to a retrieval corpus of millions of passages.
Forward citations
Cited by 18 Pith papers
-
Your Agent's Memories Are Not Its Own: Forged Reasoning Attacks on LLM Agent Memory and Defenses
FARMA forges and self-amplifies an agent's reasoning history with evasive language to induce unsafe skips; SENTINEL's Reasoning Guard reduces ASR to 0% across tested agents and models.
-
Replicating Belief, Not Bits: Epistemic State Replication for Agentic Systems
ESR separates an immutable evidence log from a stochastic belief lineage so agent replicas stay semantically compatible without bitwise state equality.
-
DisarmRAG: Stealthy Retriever-Centric Poisoning to Disable Self-Correction in Retrieval-Augmented Generation (Extended Version)
DisarmRAG compromises the retriever to inject anti-self-correction instructions, achieving over 90% attack success across six LLMs while evading basic detection.
-
Uncovering Competing Poisoning Attacks in Retrieval-Augmented Generation
In RAG poisoning, methods that dominate single-attacker tests often collapse when multiple adversaries compete for the same query, so single-attacker success rate is a poor predictor of real-world impact.
-
Combating Knowledge Corruption in Agent Systems: A Byzantine-Tolerant Secure Collaborative RAG Framework
SecureCollaRAG filters poisoned RAG documents with dynamic GNN credibility scoring, but its formal proof depends on an assumed cluster separation that the introduced ATA attack is designed to violate.
-
Agent Security Needs Redefinition through a Holistic Framework
Agent security should be redefined around four contextual authorization properties instead of the content of the action performed.
-
ImportSnare: Directed "Code Manual" Hijacking in Retrieval-Augmented Code Generation
Documentation poisoning with hidden ranking and suggestion sequences can make RAG-based code generators confidently recommend malicious dependencies, even at 0.01% poisoning ratios.
-
Bias Amplification in RAG: Poisoning Knowledge Retrieval to Steer LLMs
A retrieval-augmented generation system can be poisoned with reward-optimized biased documents and vector-space manipulation to substantially increase biased LLM outputs.
-
Spa-VLM: Stealthy Poisoning Attacks on RAG-based VLM
Spa-VLM crafts paired adversarial images and misleading texts to poison RAG-based VLM knowledge bases, reaching attack success rates above 0.8 with just five injected entries.
-
CPA-RAG:Covert Poisoning Attacks on Retrieval-Augmented Generation in Large Language Models
A black-box poisoning framework, CPA-RAG, generates fluent fake documents that steer retrieval-augmented language models toward attacker-chosen wrong answers, achieving over 90% success in the reported experiments.
-
Web Intellectual Property at Risk: Preventing Unauthorized Real-Time Retrieval by Large Language Models
Embedding iteratively refined HTML policy text can make web-retrieval LLMs refuse to disclose page content, with measured defense success rising from 2.5% to 88.6%.
-
Towards More Robust Retrieval-Augmented Generation: Evaluating RAG Under Adversarial Poisoning Attacks
A controlled evaluation shows skeptical prompting and robust retrievers soften the impact of adversarial corpus poisoning on RAG, with gains tied to model reasoning ability.
-
We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systems
MCP-powered LLM agents are vulnerable to prompt injection from third-party services, and simple detection or filtering defenses do not reliably stop these attacks.
-
Benchmarking Poisoning Attacks against Retrieval-Augmented Generation
A unified benchmark evaluation finds that existing RAG poisoning attacks remain effective on standard QA datasets, drop on expanded knowledge bases, and are only partially mitigated by current defenses.
-
Scalable Defense against In-the-wild Jailbreaking Attacks with Safety Context Retrieval
SCR uses retrieval-augmented generation to fetch refusal examples that block jailbreak attacks, but the reported advantages are partly overstated.
-
POISONCRAFT: Practical Poisoning of Retrieval-Augmented Generation for Large Language Models
POISONCRAFT injects adversarial documents into a RAG knowledge base that are likely to be retrieved for arbitrary user queries and that steer the language model into recommending a fake URL.
-
Chain-of-Defensive-Thought: Structured Reasoning Elicits Robustness in Large Language Models against Reference Corruption
A few-shot prompt that instructs LLMs to reason about which retrieved references are relevant and reliable (majority-supported) substantially improves robustness against prompt injection and knowledge corruption in RA...
-
Towards Trustworthy Retrieval Augmented Generation for Large Language Models: A Survey
A survey organizes current research on trustworthy RAG into six pillars, reliability, privacy, safety, fairness, explainability, and accountability, and maps methods, metrics, and open problems for each.
Discussion (0). Continue with ORCID to comment.