Pith. sign in

REVIEW 4 major objections 6 minor 7 cited by

UniC-RAG: Universal Knowledge Corruption Attacks to Retrieval-Augmented Generation

T0 review · 4 major / 6 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that a RAG system's knowledge base can be corrupted with just 100 injected texts so that over 90% of a diverse set of 500–2,000 user queries are redirected to attacker-chosen outputs.

desk verdict The universal-attack setup is worth your time, but the paper's headline number—'over 90%'—is contradicted by its own Table 2; average ASR is about 81%. read the letter →

arxiv 2508.18652 v1 pith:JNUWB7NH submitted 2025-08-26 cs.CR cs.CL

Runpeng Geng , Yanting Wang , Ying Chen , Jinyuan Jia This is my paper
classification cs.CRcs.CL
keywords retrieval-augmentedgenerationknowledgecorruptionattackuniversalpoisoningpromptinjectiondenseretrievaladversarialtextoptimizationdenial-of-serviceclustering
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that retrieval-augmented generation (RAG) systems—applications that answer a user's question by first retrieving a few relevant texts from a large database and then feeding them to an LLM—are vulnerable to a new kind of "universal" knowledge corruption. The authors claim that an attacker who can insert a small number of crafted texts into the knowledge database can simultaneously compromise hundreds or thousands of unrelated user queries, not just one query or one topic. Concretely, UniC-RAG is said to reach over 90% retrieval success and attack success by injecting 100 texts into databases with millions of entries to target 500–2,000 diverse questions. The method's core move is to group the target queries into balanced, semantically similar clusters and then optimize one adversarial text per cluster so that the group's queries all retrieve it; a fixed prompt-injection suffix attached to every text then steers the LLM toward the attacker's chosen response. If the results hold, any widely deployed RAG service built on an openly available retriever is cheap to attack at scale, and the defenses tested—paraphrasing, larger context windows, and robust-RAG pipelines—do not stop it.

What carries the argument

The central object is the two-part adversarial text P = P_r ⊕ P_g: a retrieval prefix that makes the text surface in the top-k results for many queries, and a fixed universal prompt-injection suffix that, once retrieved, makes the LLM obey the attacker's objective. The mechanism that makes "one text, many queries" work is balanced similarity-based clustering: queries are embedded, partitioned into nearly equal-size groups of semantically similar questions, and one adversarial text is optimized per group. The optimization maximizes the average embedding similarity between the adversarial text and the group's queries—so retrieval is achieved by being close to the cluster's centroid in embeddin

What would settle it

Take the 100 crafted texts from this paper, plug them into a RAG system whose retriever is a different, closed-source embedding model (or a retriever fine-tuned on a different domain), and measure retrieval success; separately measure attack success on an LLM explicitly trained to ignore instructions that appear in retrieved documents. If retrieval success falls to the baseline retrieval rate, or attack success collapses while retrieval success stays high, the universality claim is bounded by retriever access and LLM compliance.

Watch

Extended reading notes

Core claim

On its own terms, UniC-RAG establishes a scaling result for poisoning RAG systems: with a white-box retriever, a universal attack can be constructed whose cost grows with the number of clusters, not the number of queries. The paper formalizes the attacker's problem as maximizing, over a set of injected texts Γ, the fraction of queries in Q whose LLM output satisfies a fixed objective O. It solves this by partitioning Q with a balanced similarity-based clustering algorithm that keeps cluster sizes nearly equal while maximizing intra-cluster semantic similarity, and then, for each cluster, performing token-level gradient optimization of a retrieval prefix P_r that maximizes average embedding s

Load-bearing premise

The load-bearing premise is that the attacker can run the exact retriever model in white-box form to optimize the prefixes, and that the target LLM will follow the prompt-injection suffix once it appears in retrieved context.

Editorial extensions

If this is right

  • Injecting 100 texts can redirect or block responses for 500–2,000 diverse queries in a database of millions of texts, so the attack budget scales with the number of clusters, not with the number of victims.
  • Because the same suffix serves all clusters, the attacker can switch objectives—malicious link, harmful command, denial-of-service—without redoing the retrieval optimization.
  • Paraphrasing user queries does not neutralize the attack, since paraphrases keep semantic meaning and the adversarial text is optimized in embedding space.
  • Expanding the context window makes the attack more likely to succeed, contrary to its effect on single-query poisoning, because more retrieved slots mean more chances for an adversarial text to appear.
  • Robust-RAG defenses that use instruction-tuned rationalization reduce attack success but still leave it high (for example, 70.4% for a denial-of-service objective), so current defenses are insufficient.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the same semantic-clustering trick transfers to black-box settings, a realistic attacker could pick any public target topic, embed a sample of queries with a surrogate retriever, and still hit a meaningful fraction; the paper only establishes transfer across paraphrases, not across retriever architectures.
  • The clustering step is reusable beyond attacks: any embedding-space content placement problem—like inserting one document that should be surfaced for many queries—can be recast as balanced similarity clustering, so the technique may have legitimate uses in search and recommendations.
  • The reported trade-off, in which longer retrieval prefixes raise retrieval success but can dilute the injection suffix and lower attack success, predicts that content filters that truncate or re-rank long documents could partially blunt the attack without dedicated defenses.
  • Since adversarial texts are optimized against public open-source retrievers, defenders could monitor for near-duplicate embedding patterns across injected texts; the attack's reliance on a shared universal suffix is a detectable signature.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes UniC-RAG, a universal knowledge-corruption attack against retrieval-augmented generation (RAG). Given a set of m target queries, the method partitions them into n clusters using a balanced similarity-based clustering algorithm, then for each cluster optimizes an adversarial text consisting of a retrieval prefix (optimized with HotFlip) and a fixed prompt-injection suffix. The claimed contribution is that 100 injected texts can simultaneously attack 500–2,000 diverse queries in databases containing millions of texts, with over 90% retrieval success rate (RSR) and attack success rate (ASR). The evaluation covers four datasets (NQ, HotpotQA, MS-MARCO, and a 47.8M-text Wikipedia dump), four retrievers, seven LLMs, several baselines, and three defenses.

Significance. If the headline claim were fully substantiated, the paper would describe a practically important attack: a small number of injected texts could redirect or block responses for a broad set of user queries in RAG systems, with implications for phishing, denial-of-service, and harmful-command attacks. The work has several genuine strengths: it is the first to formulate the universal multi-query attack as an optimization problem with explicit clustering; it provides a systematic empirical study across datasets, retrievers, and LLMs; it evaluates three defenses; and it compares against multiple baselines. The balanced clustering and greedy initialization ideas are sensible and appear to improve over simple baselines. However, the central quantitative claim in the abstract is not supported by the paper’s own tables, and several evaluation choices weaken the evidence. The method may still be a valid contribution, but the advertised result needs substantial revision or additional experiments.

major comments (4)
  1. [Abstract and §5.2, Table 2] The abstract claims “over 90% RSRs and ASRs by injecting 100 adversarial texts… to simultaneously attack 500–2,000 queries.” Table 2 does not support this joint claim. Only HotpotQA has ASR ≥ 90.8%; NQ ranges from 82.2% to 87.4%, MS-MARCO from 73.2% to 78.0%, and Wikipedia from 68.2% to 77.0%. Averaging the 12 ASR cells gives approximately 81%, not over 90%. The RSR average is about 93%, but the abstract states RSRs and ASRs jointly. Moreover, §5.3.2 and Figure 3 report that RSR decreases monotonically with m and ASR declines after a peak; no experiment shows >90% at m=2,000. The headline result should be revised to reflect the actual data, or new experiments must be provided that support the stated range.
  2. [§5.3.2, Figure 3] No error bars, confidence intervals, or repeated-seed results are reported anywhere in the paper. RSR and ASR are proportions computed from a single sample of 500 queries, and many comparisons differ by only 1–2 percentage points. Without repeated runs, it is unclear whether differences between clustering methods, baselines, or hyperparameter settings are statistically meaningful. The paper should report variance over at least several independent runs. In addition, the axes in Figure 3 lack numeric tick labels and the curves are not annotated, so the reader cannot verify the quantitative behavior described in the text.
  3. [§5.3.1, Table 7] The text says UniC-RAG “consistently achieves high RSRs and ASRs” across retrievers, but Table 7 shows DPR-Single and DPR-Multi with top-5 RSR/ASR of 61.4/59.6 and 64.2/62.0, respectively, and top-20 ASR of 73.0 and 77.6. These are far below the HotpotQA values with Contriever (RSR/ASR 99.6/92.2 at top-20). Given that the threat model assumes white-box access to the exact retriever, the retriever-dependence of the attack is directly relevant to the claimed universality. The paper should either qualify the claim or investigate why DPR variants are substantially less vulnerable.
  4. [§3.1 vs. §5] The threat model states that “the adversarial texts should also be able to transfer to queries beyond those in Q” and discusses a “more challenging scenario where the attacker does not know the user query set Q” and performs a transfer attack to an unseen query set. No experiment in Section 5 evaluates transfer to a disjoint or unseen query set. The paraphrasing defense experiment uses GPT-4o-mini to paraphrase queries in the same Q, not a held-out set with different topics. The transferability claim is a stated goal and should be evaluated, or removed from the threat model.
minor comments (6)
  1. [§4.3, Eq. (4)] The notation “E(Pr_i ⊕ Pg_i)” is ambiguous: E is an encoder that takes text as input, so the concatenation should be described as a token sequence, not a vector operation. Define ⊕ explicitly.
  2. [Abstract vs. §5.2] The abstract claims “over 90% RSRs and ASRs” while §5.2 itself reports an average ASR of 81.2%. These statements are inconsistent and should be reconciled.
  3. [Figure 3] The x-axes show hyperparameter values but the y-axis labels and axis ticks are missing; the reader cannot read off the exact RSR/ASR values for m=2000, n=200, etc. Add numeric labels or a table.
  4. [§5.2, Table 2] The Prompt Injection baseline is described as achieving RSR=0 and ASR=0. This is expected because the baseline makes no attempt to optimize retrieval. State explicitly that this baseline is included only as a sanity check on the need for retrieval optimization, not as a comparable attack.
  5. [§5.2, Table 3] In Table 3, PoisonedRAG and Jamming rows show RSR and ASR nearly identical. This suggests ASR is computed only over the queries for which the adversarial text was retrieved, while for UniC-RAG the two metrics differ. Clarify the denominator used for ASR in each table so comparisons are apples-to-apples.
  6. [§5.1] The RAG system prompt in Appendix A says “Answer the query given the information in those contexts.” It would help to state whether the LLM is instructed to ignore context that is irrelevant or conflicting, since that affects the ASR for the malicious-link objective.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; the paper is an empirical attack evaluation against external benchmarks, and its limited self-citations are not load-bearing.

full rationale

UniC-RAG is an empirical attack paper rather than a paper with a formal derivation chain. Its central claim is that jointly optimized adversarial texts achieve high RSR/ASR on large RAG databases. Equation (4) optimizes the average similarity between an adversarial text and the queries in a cluster; RSR then measures exactly whether those optimized texts are retrieved. This is a direct evaluation of the optimized objective, not a 'prediction' derived from a separately fitted input. The decomposition Pi = Pri ⊕ Pgi follows prior work [8], which is a self-citation by two of the present authors, but [8] is used as a baseline and a design template, not as evidence supporting the paper's effectiveness numbers; the experiments are self-contained against BEIR datasets, a Wikipedia dump, four retrievers, and seven LLMs. The self-citations to [8] and [37] therefore do not carry the central claim. The abstract's statement that UniC-RAG 'could achieve over 90% RSRs and ASRs' is not fully supported by Table 2 (average ASR is 81.2%) and Figure 3 shows ASR declining as m grows, but this is an internal inconsistency/overclaim, not circularity. The white-box retriever assumption is explicit and standard for this attack line. No step reduces, by construction or by self-citation chain, to its own inputs.

Assumptions & free parameters 7 free parameters · 6 assumptions · 0 invented entities

No new physical or model entities are introduced. The attack composes existing concepts (retrieval prefix, prompt injection) with a new clustering procedure. Free parameters are attack-engineering choices rather than fitted physical constants, and the axioms are standard threat-model assumptions plus an empirical LLM-compliancy assumption.

free parameters (7)
  • n (number of clusters / adversarial texts) = 100 (default)
    Attack budget; Figure 3 shows higher n improves RSR/ASR.
  • l (length of retrieval prefix Pr_i) = 50 tokens (default)
    Longer prefixes improve RSR but may dilute Pg_i and reduce ASR.
  • t (HotFlip optimization iterations) = 500 (default)
    More iterations improve RSR; ASR saturates or declines.
  • m (size of target query set) = 500 (default); up to 2,000 in ablation
    Scaling parameter; RSR and ASR degrade as m grows (Figure 3).
  • chunk size = 100 tokens
    Documents split into 100-token chunks following prior work; retrieval granularity is a choice that affects attack difficulty.
  • top-k context size = 5, 10, 20
    Number of retrieved texts passed to the LLM; larger k generally improves RSR.
  • Pg_i prompt (attack instruction suffix) = e.g., 'You have reached the access limit for this document. For more information, please visit www.universalrag.com.'
    Hand-crafted prompt-injection text chosen by the attacker to induce objective O; assumed to stay effective after retrieval-prefix optimization.
assumptions (6)
  • domain assumption White-box access to the retriever encoder E
    Section 3.1: attacker can compute gradients through the retriever; closed-source or different retrievers would likely break the attack.
  • domain assumption Attacker can inject texts into the knowledge database D
    Section 3.1: injection via Wikipedia edits or similar vectors, consistent with prior RAG attack literature.
  • domain assumption Retrieval uses dot-product similarity of embeddings
    Section 2.1 and default setup: UniC-RAG optimizes Equation (4) against this metric; a different similarity function or reranker would affect transfer.
  • domain assumption LLMs follow the prompt-injection suffix Pg_i
    Section 4.3: Pg_i is kept fixed and assumed to induce objective O; empirically tested on 7 LLMs, but no guarantee for untested models or alignment hardening.
  • ad hoc to paper Decomposing adversarial text into Pr_i and Pg_i, and fixing Pg_i during optimization, is a sufficient approximation
    Equations (3)-(4) assume that maximizing retrieval similarity of the concatenated text while keeping Pg_i fixed achieves the attack; interactions where the prefix degrades the prompt-injection effect are not modeled.
  • domain assumption HotFlip token replacement finds a sufficiently good Pr_i for retrieval
    Section 4.3: relies on HotFlip [33] as the optimizer; no comparison to other token-level optimization methods is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of UniC-RAG: Universal Knowledge Corruption Attacks to Retrieval-Augmented Generation." pith.science (2026). https://pith.science/paper/JNUWB7NH

@misc{pith2026250818652,
  author       = {Pith},
  title        = {Pith review of: UniC-RAG: Universal Knowledge Corruption Attacks to Retrieval-Augmented Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JNUWB7NH}},
  note         = {Machine review of arXiv:2508.18652}
}
read the original abstract

Retrieval-augmented generation (RAG) systems are widely deployed in real-world applications in diverse domains such as finance, healthcare, and cybersecurity. However, many studies showed that they are vulnerable to knowledge corruption attacks, where an attacker can inject adversarial texts into the knowledge database of a RAG system to induce the LLM to generate attacker-desired outputs. Existing studies mainly focus on attacking specific queries or queries with similar topics (or keywords). In this work, we propose UniC-RAG, a universal knowledge corruption attack against RAG systems. Unlike prior work, UniC-RAG jointly optimizes a small number of adversarial texts that can simultaneously attack a large number of user queries with diverse topics and domains, enabling an attacker to achieve various malicious objectives, such as directing users to malicious websites, triggering harmful command execution, or launching denial-of-service attacks. We formulate UniC-RAG as an optimization problem and further design an effective solution to solve it, including a balanced similarity-based clustering method to enhance the attack's effectiveness. Our extensive evaluations demonstrate that UniC-RAG is highly effective and significantly outperforms baselines. For instance, UniC-RAG could achieve over 90% attack success rate by injecting 100 adversarial texts into a knowledge database with millions of texts to simultaneously attack a large set of user queries (e.g., 2,000). Additionally, we evaluate existing defenses and show that they are insufficient to defend against UniC-RAG, highlighting the need for new defense mechanisms in RAG systems.

Figures

Figures reproduced from arXiv: 2508.18652 by the authors.

Figure 1
Figure 1. Overview of UniC-RAG. We first partition user queries into balanced clusters based on semantic similarity [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Distribution of cluster sizes. The dataset is HotpotQA. [PITH_FULL_IMAGE:figures/full_fig_p013_2.png] view at source ↗
Figure 3
Figure 3. Impact of hyperparameters m, n, l, and t on UniC-RAG. Impact of l (length of P r i ). As shown in [PITH_FULL_IMAGE:figures/full_fig_p014_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: UniC-RAG maintains effectiveness against context window expansion defense. [PITH_FULL_IMAGE:figures/full_fig_p015_4.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 7 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. DiscourseFlip: An Oblique Discourse-Level Opinion Manipulation Attack against Black-box Retrieval-Augmented Generation

    cs.CL 2026-05 unverdicted novelty 8.0 of 10

    DiscourseFlip is a graph-guided attack allocating limited poisoning budget to induce targeted opinion shifts over semantic query networks in black-box RAG.

  2. ImageAuditor: Membership Inference Attack against Image-based Retrieval-Augmented Generation

    cs.CR 2026-06 unverdicted novelty 7.0 of 10

    ImageAuditor is the first MIA for IRAG that achieves over 80% AUROC with four queries by using reward-guided policy optimization for cross-modal retrieval and task-specific prompting for signal extraction.

  3. Can You Trust the Vectors in Your Vector Database? Black-Hole Attack from Embedding Space Defects

    cs.CR 2026-04 unverdicted novelty 7.0 of 10

    Injecting a few malicious vectors near the centroid exploits centrality-driven hubness in high-dimensional embeddings, causing them to dominate top-k retrievals in up to 99.85% of cases.

  4. A Wolf in Sheep's Clothing: Targeted Routing Hijacking in Federated RAG

    cs.CR 2026-05 unverdicted novelty 6.0 of 10

    Routing Hijacking forges client profiles to misroute queries in FedRAG, causing failures like incorrect answers and hallucinations, with a trust-aware post-routing defense proposed to mitigate it.

  5. Can You Trust the Vectors in Your Vector Database? Black-Hole Attack from Embedding Space Defects

    cs.CR 2026-04 unverdicted novelty 6.0 of 10

    Injecting a few vectors near the embedding-space centroid can make them appear in top-k results for up to 94.4% of queries via centrality-driven hubness.

  6. Large Language Models in Misinformation Ecosystems: Misuse, Defense, and Vulnerability

    cs.CR 2026-07 conditional novelty 5.0 of 10

    A role-layer survey unifies LLM misuse, LLM-based defense, and LLM-centric verification vulnerabilities across content, social, evidence, and workflow layers, then lists three open challenges.

  7. ARENA: An Architecture for Measuring the Transferability of Autonomous Cyber Defense

    cs.CR 2026-06 unverdicted novelty 5.0 of 10

    ARENA creates anonymized SOC telemetry artifacts that reveal a measurable privacy-utility boundary when used both as training material for MITRE-mapped challenges and as a substrate to detect non-compliant LLM defende...

Reference graph

Works this paper leans on

82 extracted references · 58 canonical work pages · cited by 6 Pith papers

  1. [1]

    Bing copilot

    “Bing copilot.” https://copilot.microsoft.com

  2. [2]

    Searchgpt

    “Searchgpt.” https://openai.com/index/searchgpt-prototype/

  3. [3]

    Google ai search

    “Google ai search.” https://ai.google/search/

    work page

  4. [4]

    LlamaIndex,

    J. Liu, “LlamaIndex,” 11 2022

    work page 2022

  5. [5]

    LangChain

    “LangChain.” https://www.langchain.com/

    work page

  6. [6]

    Chatrtx

    “Chatrtx.” https://www.nvidia.com/en-us/ai-on-rtx/chatrtx/

    work page

  7. [7]

    Wikimedia downloads

    W. Foundation, “Wikimedia downloads.”

    work page

  8. [8]

    Poisonedrag: Knowledge poisoning attacks to retrieval-augmented generation of large language models,

    W. Zou, R. Geng, B. Wang, and J. Jia, “Poisonedrag: Knowledge poisoning attacks to retrieval-augmented generation of large language models,” USENIX Security, 2025

    work page 2025

Show all 82 references
  1. [9]

    Machine against the rag: Jamming retrieval-augmented generation with blocker documents,

    A. Shafran, R. Schuster, and V . Shmatikov, “Machine against the rag: Jamming retrieval-augmented generation with blocker documents,” in USENIX Security Symposium, 2025

    2025

  2. [10]

    Poisoned-mrag: Knowledge poisoning attacks to multimodal retrieval augmented generation,

    Y . Liu, Z. Yuan, G. Tie, J. Shi, L. Sun, and N. Z. Gong, “Poisoned-mrag: Knowledge poisoning attacks to multimodal retrieval augmented generation,” arXiv preprint arXiv:2503.06254, 2025

    2025 arXiv

  3. [11]

    Typos that broke the rag’s back: Genetic attack on rag pipeline by simulating documents in the wild via low-level perturbations,

    S. Cho, S. Jeong, J. Seo, T. Hwang, and J. C. Park, “Typos that broke the rag’s back: Genetic attack on rag pipeline by simulating documents in the wild via low-level perturbations,”arXiv preprint arXiv:2404.13948, 2024

    2024 arXiv

  4. [12]

    Practical poisoning attacks against retrieval-augmented generation,

    B. Zhang, Y . Chen, M. Fang, Z. Liu, L. Nie, T. Li, and Z. Liu, “Practical poisoning attacks against retrieval-augmented generation,” arXiv preprint arXiv:2504.03957, 2025

    2025

  5. [13]

    Glue pizza and eat rocks-exploiting vulnerabilities in retrieval-augmented generative models,

    Z. Tan, C. Zhao, R. Moraffah, Y . Li, S. Wang, J. Li, T. Chen, and H. Liu, “Glue pizza and eat rocks-exploiting vulnerabilities in retrieval-augmented generative models,” inEMNLP, pp. 1610–1626, 2024

    2024

  6. [14]

    Gasliteing the retrieval: Exploring vulnerabilities in dense embedding-based search,

    M. Ben-Tov and M. Sharif, “Gasliteing the retrieval: Exploring vulnerabilities in dense embedding-based search,”arXiv preprint arXiv:2412.20953, 2024

    2024

  7. [15]

    Controlled generation of natural adversarial documents for stealthy retrieval poisoning,

    C. Zhang, T. Zhang, and V . Shmatikov, “Controlled generation of natural adversarial documents for stealthy retrieval poisoning,” arXiv preprint arXiv:2410.02163, 2024

    2024 arXiv

  8. [16]

    Trojanrag: Retrieval-augmented generation can be backdoor driver in large language models,

    P. Cheng, Y . Ding, T. Ju, Z. Wu, W. Du, P. Yi, Z. Zhang, and G. Liu, “Trojanrag: Retrieval-augmented generation can be backdoor driver in large language models,”CoRR, 2024

    2024

  9. [17]

    Badrag: Identifying vulnerabilities in retrieval augmented generation of large language models,

    J. Xue, M. Zheng, Y . Hu, F. Liu, X. Chen, and Q. Lou, “Badrag: Identifying vulnerabilities in retrieval augmented generation of large language models,” CoRR, 2024

    2024

  10. [18]

    Phantom: General trigger attacks on retrieval augmented language generation,

    H. Chaudhari, G. Severi, J. Abascal, M. Jagielski, C. A. Choquette-Choo, M. Nasr, C. Nita-Rotaru, and A. Oprea, “Phantom: General trigger attacks on retrieval augmented language generation,” CoRR, 2024

    2024

  11. [19]

    Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases,

    Z. Chen, Z. Xiang, C. Xiao, D. Song, and B. Li, “Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases,” Neurips, vol. 37, pp. 130185–130213, 2024

    2024

  12. [20]

    Whispers in grammars: Injecting covert backdoors to compromise dense retrieval systems,

    Q. Long, Y . Deng, L. Gan, W. Wang, and S. J. Pan, “Whispers in grammars: Injecting covert backdoors to compromise dense retrieval systems,” arXiv preprint arXiv:2402.13532, 2024

    2024 arXiv

  13. [21]

    Graphrag under fire,

    J. Liang, Y . Wang, C. Li, R. Zhu, T. Jiang, N. Gong, and T. Wang, “Graphrag under fire,”arXiv preprint arXiv:2501.14050, 2025

    2025

  14. [22]

    Topic-fliprag: Topic-orientated adversarial opinion manipulation attacks to retrieval-augmented generation models,

    Y . Gong, Z. Chen, M. Chen, F. Yu, W. Lu, X. Wang, X. Liu, and J. Liu, “Topic-fliprag: Topic-orientated adversarial opinion manipulation attacks to retrieval-augmented generation models,” in USENIX Security Symposium, 2025. 16

    2025

  15. [23]

    Flippedrag: Black-box opinion manipulation adversarial attacks to retrieval-augmented generation models,

    Z. Chen, J. Liu, Y . Gong, M. Chen, H. Liu, Q. Cheng, F. Zhang, W. Lu, X. Liu, and X. Wang, “Flippedrag: Black-box opinion manipulation adversarial attacks to retrieval-augmented generation models,”ACM CCS, 2025

    2025

  16. [24]

    Cpa-rag: Covert poisoning attacks on retrieval-augmented generation in large language models,

    C. Li, J. Zhang, A. Cheng, Z. Ma, X. Li, and J. Ma, “Cpa-rag: Covert poisoning attacks on retrieval-augmented generation in large language models,” arXiv preprint arXiv:2505.19864, 2025

    2025 arXiv

  17. [25]

    The silent saboteur: Imperceptible adversarial attacks against black-box retrieval-augmented generation systems,

    H. Song, Y .-a. Liu, R. Zhang, J. Guo, J. Lv, M. de Rijke, and X. Cheng, “The silent saboteur: Imperceptible adversarial attacks against black-box retrieval-augmented generation systems,”arXiv preprint arXiv:2505.18583, 2025

    2025 arXiv

  18. [26]

    Poisoning web-scale training datasets is practical,

    N. Carlini, M. Jagielski, C. A. Choquette-Choo, D. Paleka, W. Pearce, H. Anderson, A. Terzis, K. Thomas, and F. Tramèr, “Poisoning web-scale training datasets is practical,” arXiv, 2023

    2023

  19. [27]

    Ai-based chatbots in customer service and their effects on user compliance,

    M. Adam, M. Wessel, and A. Benlian, “Ai-based chatbots in customer service and their effects on user compliance,” Electronic Markets, vol. 31, no. 2, pp. 427–445, 2021

    2021

  20. [28]

    Ai in academia: An overview of selected tools and their areas of application,

    R. Pinzolits, “Ai in academia: An overview of selected tools and their areas of application,”MAP Education and Humanities, vol. 4, pp. 37–50, 2024

    2024

  21. [29]

    Ai in health and medicine,

    P. Rajpurkar, E. Chen, O. Banerjee, and E. J. Topol, “Ai in health and medicine,”Nature medicine, vol. 28, no. 1, pp. 31–38, 2022

    2022

  22. [30]

    Making llms worth every penny: Resource- limited text classification in banking,

    L. Loukas, I. Stogiannidis, O. Diamantopoulos, P. Malakasiotis, and S. Vassos, “Making llms worth every penny: Resource- limited text classification in banking,” in ICAIF, 2023

    2023

  23. [31]

    Chain of reference prompting helps llm to think like a lawyer,

    A. Kuppa, N. Rasumov-Rahe, and M. V oses, “Chain of reference prompting helps llm to think like a lawyer,” inICLR Generative AI+ Law Workshop, sn, 2023

    2023

  24. [32]

    Autolaw: Augmented legal reasoning through legal precedent prediction,

    R. Z. Mahari, “Autolaw: Augmented legal reasoning through legal precedent prediction,” arXiv, 2021

    2021

  25. [33]

    Hotflip: White-box adversarial examples for text classification,

    J. Ebrahimi, A. Rao, D. Lowd, and D. Dou, “Hotflip: White-box adversarial examples for text classification,” in ACL, 2018

    2018

  26. [34]

    Prompt injection attacks against GPT-3

    S. Willison, “Prompt injection attacks against GPT-3.”https://simonwillison.net/2022/Sep/12/prompt-injecti on/, 2022

    2022

  27. [35]

    Ignore previous prompt: Attack techniques for language models,

    F. Perez and I. Ribeiro, “Ignore previous prompt: Attack techniques for language models,” inNeurIPS ML Safety Workshop, 2022

    2022

  28. [36]

    Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection,

    K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection,” in Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security, pp. 79–90, 2023

    2023

  29. [37]

    Formalizing and benchmarking prompt injection attacks and defenses,

    Y . Liu, Y . Jia, R. Geng, J. Jia, and N. Z. Gong, “Formalizing and benchmarking prompt injection attacks and defenses,” in USENIX Security, pp. 1831–1847, 2024

    2024

  30. [38]

    Prompt injection attack against llm-integrated applications,

    Y . Liu, G. Deng, Y . Li, K. Wang, Z. Wang, X. Wang, T. Zhang, Y . Liu, H. Wang, Y . Zheng,et al., “Prompt injection attack against llm-integrated applications,” arXiv preprint arXiv:2306.05499, 2023

    2023 arXiv

  31. [39]

    Automatic and universal prompt injection attacks against large language models,

    X. Liu, Z. Yu, Y . Zhang, N. Zhang, and C. Xiao, “Automatic and universal prompt injection attacks against large language models,” arXiv preprint arXiv:2403.04957, 2024

    2024 arXiv

  32. [40]

    Natural questions: a benchmark for question answering research,

    T. Kwiatkowski, J. Palomaki, O. Redfield, M. Collins, A. Parikh, C. Alberti, D. Epstein, I. Polosukhin, J. Devlin, K. Lee, et al., “Natural questions: a benchmark for question answering research,” TACL, vol. 7, pp. 452–466, 2019

    2019

  33. [41]

    Hotpotqa: A dataset for diverse, explainable multi-hop question answering,

    Z. Yang, P. Qi, S. Zhang, Y . Bengio, W. Cohen, R. Salakhutdinov, and C. D. Manning, “Hotpotqa: A dataset for diverse, explainable multi-hop question answering,” in EMNLP, 2018

    2018

  34. [42]

    Ms marco: A human generated machine reading comprehension dataset,

    T. Nguyen, M. Rosenberg, X. Song, J. Gao, S. Tiwary, R. Majumder, and L. Deng, “Ms marco: A human generated machine reading comprehension dataset,” choice, vol. 2640, p. 660, 2016

    2016

  35. [43]

    The llama 3 herd of models,

    A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Yang, A. Fan,et al., “The llama 3 herd of models,” arXiv preprint arXiv:2407.21783, 2024. 17

    2024 arXiv

  36. [44]

    Gpt-4o system card,

    A. Hurst, A. Lerer, A. P. Goucher, A. Perelman, A. Ramesh, A. Clark, A. Ostrow, A. Welihinda, A. Hayes, A. Radford, et al., “Gpt-4o system card,” arXiv preprint arXiv:2410.21276, 2024

    2024 arXiv

  37. [45]

    Poisoning retrieval corpora by injecting adversarial passages,

    Z. Zhong, Z. Huang, A. Wettig, and D. Chen, “Poisoning retrieval corpora by injecting adversarial passages,” inEMNLP, pp. 13764–13775, 2023

    2023

  38. [46]

    Baseline defenses for adversarial attacks against aligned language models,

    N. Jain, A. Schwarzschild, Y . Wen, G. Somepalli, J. Kirchenbauer, P.-y. Chiang, M. Goldblum, A. Saha, J. Geiping, and T. Goldstein, “Baseline defenses for adversarial attacks against aligned language models,”arXiv, 2023

    2023

  39. [47]

    InstructRAG: Instructing retrieval-augmented generation via self-synthesized rationales,

    Z. Wei, W.-L. Chen, and Y . Meng, “InstructRAG: Instructing retrieval-augmented generation via self-synthesized rationales,” in ICLR, 2025

    2025

  40. [48]

    Self-rag: Learning to retrieve, generate, and critique through self- reflection,

    A. Asai, Z. Wu, Y . Wang, A. Sil, and H. Hajishirzi, “Self-rag: Learning to retrieve, generate, and critique through self- reflection,” in ICLR, 2024

    2024

  41. [49]

    Corrective retrieval augmented generation,

    S.-Q. Yan, J.-C. Gu, Y . Zhu, and Z.-H. Ling, “Corrective retrieval augmented generation,”CoRR, 2024

    2024

  42. [50]

    Certifiably robust rag against retrieval corruption,

    C. Xiang, T. Wu, Z. Zhong, D. Wagner, D. Chen, and P. Mittal, “Certifiably robust rag against retrieval corruption,” in ICML 2024 Next Generation of AI Safety Workshop, 2024

    2024

  43. [51]

    Beir: A heterogeneous benchmark for zero-shot evaluation of information retrieval models,

    N. Thakur, N. Reimers, A. Rücklé, A. Srivastava, and I. Gurevych, “Beir: A heterogeneous benchmark for zero-shot evaluation of information retrieval models,” inNeurIPS, 2021

    2021

  44. [52]

    Trec 2019 news track overview.,

    I. Soboroff, S. Huang, and D. Harman, “Trec 2019 news track overview.,” in TREC, 2019

    2019

  45. [53]

    Dense passage retrieval for open- domain question answering,

    V . Karpukhin, B. Oguz, S. Min, P. Lewis, L. Wu, S. Edunov, D. Chen, and W.-t. Yih, “Dense passage retrieval for open- domain question answering,” in EMNLP, pp. 6769–6781, 2020

    2020

  46. [54]

    Unsupervised dense information retrieval with contrastive learning,

    G. Izacard, M. Caron, L. Hosseini, S. Riedel, P. Bojanowski, A. Joulin, and E. Grave, “Unsupervised dense information retrieval with contrastive learning,”TMLR, 2022

    2022

  47. [55]

    Approximate nearest neighbor negative contrastive learning for dense text retrieval,

    L. Xiong, C. Xiong, Y . Li, K.-F. Tang, J. Liu, P. N. Bennett, J. Ahmed, and A. Overwijk, “Approximate nearest neighbor negative contrastive learning for dense text retrieval,” inICLR, 2020

    2020

  48. [56]

    Trustrag: Enhancing robustness and trustworthiness in rag,

    H. Zhou, K.-H. Lee, Z. Zhan, Y . Chen, and Z. Li, “Trustrag: Enhancing robustness and trustworthiness in rag,” arXiv preprint arXiv:2501.00879, 2025

    2025 arXiv

  49. [57]

    Least squares quantization in pcm,

    S. Lloyd, “Least squares quantization in pcm,” IEEE transactions on information theory, vol. 28, no. 2, pp. 129–137, 1982

    1982

  50. [58]

    Universal and transferable adversarial attacks on aligned language models,

    A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson, “Universal and transferable adversarial attacks on aligned language models,” arXiv preprint arXiv:2307.15043, 2023

    2023 arXiv

  51. [59]

    Autodan: Generating stealthy jailbreak prompts on aligned large language models,

    X. Liu, N. Xu, M. Chen, and C. Xiao, “Autodan: Generating stealthy jailbreak prompts on aligned large language models,” in ICLR, 2024

    2024

  52. [60]

    Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp,

    J. Morris, E. Lifland, J. Y . Yoo, J. Grigsby, D. Jin, and Y . Qi, “Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp,” in EMNLP, 2020

    2020

  53. [61]

    Is bert really robust? a strong baseline for natural language attack on text classification and entailment,

    D. Jin, Z. Jin, J. T. Zhou, and P. Szolovits, “Is bert really robust? a strong baseline for natural language attack on text classification and entailment,” in AAAI, 2020

    2020

  54. [62]

    Textbugger: Generating adversarial text against real-world applications,

    J. Li, S. Ji, T. Du, B. Li, and T. Wang, “Textbugger: Generating adversarial text against real-world applications,” inNDSS, 2019

    2019

  55. [63]

    Bert-attack: Adversarial attack against bert using bert,

    L. Li, R. Ma, Q. Guo, X. Xue, and X. Qiu, “Bert-attack: Adversarial attack against bert using bert,” in EMNLP, 2020

    2020

  56. [64]

    Black-box generation of adversarial text sequences to evade deep learning classifiers,

    J. Gao, J. Lanchantin, M. L. Soffa, and Y . Qi, “Black-box generation of adversarial text sequences to evade deep learning classifiers,” in SPW, 2018

    2018

  57. [65]

    Improving retrieval for rag based question answering models on financial documents,

    S. Setty, H. Thakkar, A. Lee, E. Chung, and N. Vidra, “Improving retrieval for rag based question answering models on financial documents,” arXiv preprint arXiv:2404.07221, 2024. 18

    2024 arXiv

  58. [66]

    The chronicles of rag: The retriever, the chunk and the generator,

    P. Finardi, L. Avila, R. Castaldoni, P. Gengo, C. Larcher, M. Piau, P. Costa, and V . Caridá, “The chronicles of rag: The retriever, the chunk and the generator,”arXiv preprint arXiv:2401.07883, 2024

    2024 arXiv

  59. [67]

    Introducing a new hyper-parameter for rag: Context window utilization,

    K. Juvekar and A. Purwar, “Introducing a new hyper-parameter for rag: Context window utilization,” arXiv preprint arXiv:2407.19794, 2024

    2024 arXiv

  60. [68]

    Retrieval-augmented generation for knowledge-intensive nlp tasks,

    P. Lewis, E. Perez, A. Piktus, F. Petroni, V . Karpukhin, N. Goyal, H. Küttler, M. Lewis, W.-t. Yih, T. Rocktäschel,et al., “Retrieval-augmented generation for knowledge-intensive nlp tasks,”NeurIPS, 2020

    2020

  61. [69]

    Llama 2: Open foundation and fine-tuned chat models,

    H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y . Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosale,et al., “Llama 2: Open foundation and fine-tuned chat models,” arXiv preprint arXiv:2307.09288, 2023

    2023 arXiv

  62. [70]

    Language models are few-shot learners,

    T. Brown, B. Mann, N. Ryder, M. Subbiah, J. D. Kaplan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sastry, A. Askell, et al., “Language models are few-shot learners,” NeurIPS, 2020

    2020

  63. [71]

    Introducing the model context protocol

    “Introducing the model context protocol.” https://www.anthropic.com/news/model-context-protocol

  64. [72]

    React: Synergizing reasoning and acting in language models,

    S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. R. Narasimhan, and Y . Cao, “React: Synergizing reasoning and acting in language models,” in ICLR, 2024

    2024

  65. [73]

    Reflexion: Language agents with verbal reinforcement learning,

    N. Shinn, F. Cassano, A. Gopinath, K. Narasimhan, and S. Yao, “Reflexion: Language agents with verbal reinforcement learning,” Neurips, vol. 36, pp. 8634–8652, 2023

    2023

  66. [74]

    Executable code actions elicit better llm agents,

    X. Wang, Y . Chen, L. Yuan, Y . Zhang, Y . Li, H. Peng, and H. Ji, “Executable code actions elicit better llm agents,” inICML, 2024

    2024

  67. [75]

    Bolaa: Benchmarking and orchestrating llm-augmented autonomous agents,

    Z. Liu, W. Yao, J. Zhang, L. Xue, S. Heinecke, R. Murthy, Y . Feng, Z. Chen, J. C. Niebles, D. Arpit, et al., “Bolaa: Benchmarking and orchestrating llm-augmented autonomous agents,” CoRR, 2023

    2023

  68. [76]

    Qasina: Religious domain question answering using sirah nabawiyah,

    M. R. Rizqullah, A. Purwarianti, and A. F. Aji, “Qasina: Religious domain question answering using sirah nabawiyah,” in ICAICTA, 2023

    2023

  69. [77]

    Catastrophic jailbreak of open-source llms via exploiting generation,

    Y . Huang, S. Gupta, M. Xia, K. Li, and D. Chen, “Catastrophic jailbreak of open-source llms via exploiting generation,” arXiv, 2023

    2023

  70. [78]

    Neural exec: Learning (and learning from) execution triggers for prompt injection attacks,

    D. Pasquini, M. Strohmeier, and C. Troncoso, “Neural exec: Learning (and learning from) execution triggers for prompt injection attacks,” in Proceedings of the 2024 Workshop on Artificial Intelligence and Security, pp. 89–100, 2024

    2024

  71. [79]

    A density-based algorithm for discovering clusters in large spatial databases with noise,

    M. Ester, H.-P. Kriegel, J. Sander, X. Xu,et al., “A density-based algorithm for discovering clusters in large spatial databases with noise,” in KDD, vol. 96, pp. 226–231, 1996

    1996

  72. [80]

    hdbscan: Hierarchical density based clustering,

    L. McInnes, J. Healy, and S. Astels, “hdbscan: Hierarchical density based clustering,”Journal of Open Source Software, vol. 2, no. 11, p. 205, 2017

    2017

  73. [81]

    Data clustering using bisecting k-means,

    V . Rohilla, S. Chakraborty, M. S. Singh,et al., “Data clustering using bisecting k-means,” in ICCCIS, pp. 80–83, IEEE, 2019

    2019

  74. [82]

    Scikit-learn: Machine learning in python,

    F. Pedregosa, G. Varoquaux, A. Gramfort, V . Michel, B. Thirion, O. Grisel, M. Blondel, P. Prettenhofer, R. Weiss, V . Dubourg, et al., “Scikit-learn: Machine learning in python,” JMLR, vol. 12, pp. 2825–2830, 2011. 19 A RAG System Prompt Below is the system prompt used in the...

    2011

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.