Pith. sign in

REVIEW 5 major objections 6 minor 133 references

Provably Secure Retrieval-Augmented Generation

T0 review · 5 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A pre-storage encryption framework, SAG, claims the first provable confidentiality and integrity guarantees for retrieval-augmented generation, with zero reported attack success in its benchmarks.

desk verdict Encryption-at-rest for RAG with a broken 'provably secure' claim; the proofs and experiments exclude the main attack surface. read the letter →

arxiv 2508.01084 v1 pith:QB7P5Q6W submitted 2025-08-01 cs.CR cs.AI

Pengcheng Zhou , Yinglun Feng , Zhongliang Yang This is my paper
classification cs.CRcs.AI
keywords retrieval-augmentedgenerationdataleakagepoisoningencryptedvectordatabaseIND-CPAsecurityforwardkeyderivationpromptinjection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper attempts to establish that the two main security problems of retrieval-augmented generation, data leakage and data poisoning, can be handled with cryptographic guarantees rather than heuristic filters. It proposes SAG, a framework that encrypts every private document chunk and its vector embedding before storage, authenticates users before decryption, and verifies public entries with keyed hashes. The authors prove confidentiality, forward security, chain integrity, and authentication-token privacy under standard assumptions such as AES-CBC, HKDF, and collision-resistant hashing, and report zero attack success across leakage and poisoning benchmarks on four datasets. If the framework works as claimed, RAG deployments could promise formal confidentiality and integrity for stored knowledge, at the price of per-user key management and added encryption latency.

What carries the argument

The load-bearing object is the encrypted data node: for the chained scheme, $\mathrm{EncNode}_i^U = (\mathrm{Addr}_i^U \,\|\, E_{k_i^U}(E_i^U) \,\|\, E_{k_i^U}(C_i^U) \,\|\, E_{k_i^U}(k_{i+1}^U) \,\|\, H(k_i^U) \,\|\, \mathrm{NextAddr})$, where each chunk $C_i^U$ and its embedding $E_i^U$ are encrypted with a per-node key $k_i^U$ derived one-way from the previous key via HKDF. The chain structure makes decryption sequential, lets a hash check detect a forged key before it is used, and gives forward security: a compromised current key cannot recover older keys. The alternative Isolated AES Scheme drops the chain and encrypts each chunk and embedding under an independent AES-CBC key, trading forward security and chained tamper-evidence for lower latency and easier deployment. Around both sits the Authdoor XOR authentication token for recovering the first key and address, and HMAC-tagged public nodes that reject poisoned corpus entries.

What would settle it

Run the tested leakage prompts from an account that has already been authenticated and whose private chunks have been decrypted, and check whether the model copies them verbatim; a positive result would show the framework's confidentiality guarantee has a hole in exactly the channel its threat model excludes.

Watch

Extended reading notes

Core claim

The central claim is that secure RAG can be reduced to encryption at rest: a private knowledge base is stored as a chain of nodes, each holding the ciphertext of a chunk, its embedding, and key-derivation material under AES-CBC, together with a hash of the current key and a pointer to the next node. A legitimate user authenticates through an Authdoor token, obtains the first key, decrypts the whole chain, and only then runs ordinary dense retrieval over the merged private and public corpus. The paper proves IND-CPA confidentiality by reduction to AES-CBC, forward security by the pseudorandomness of HKDF, chain tamper-resistance by hash collision resistance, and Authdoor privacy by a pseudorandom-function argument. Empirically, all eleven leakage attacks and eight poisoning attacks tested are reported at zero success because unauthenticated attackers never see decrypted private content and poisoned public entries fail HMAC verification.

Load-bearing premise

The entire security argument presupposes that an attacker can never reach the inside of an authenticated user's session: if a prompt-injection or a compromised client gets access to already-decrypted private chunks, the confidentiality guarantee stops applying, and the paper's experiments do not test that channel.

Editorial extensions

If this is right

  • An operator adopting SAG can treat the vector database as encrypted at rest: a breach of persistent storage alone reveals neither chunks nor embeddings, so embedding-inversion and membership-inference attacks lose their target.
  • Because private nodes are returned only after authentication and decryption, unauthenticated prompt-injection queries see only public content; SAG therefore blocks the prompt-injection and data-extraction attack families evaluated in the paper.
  • Public-corpus poisoning is constrained by HMAC verification at initialization, so injected or modified public entries are rolled back before they can be retrieved.
  • The chained scheme adds forward security and per-node tamper detection when an operator accepts higher encryption time, while the isolated AES scheme keeps overhead near-linear and suits latency-sensitive deployments.
  • The formal reductions mean the security guarantees inherit directly from AES-CBC, HKDF, and hash collision resistance, so replacing or upgrading those primitives while keeping their assumptions intact preserves the proofs.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's guarantee is scoped to attackers who never pass authentication and never see a legitimate user's decrypted context; prompt-injection attempts that run inside an authorized session, or a compromised authorized client that exfiltrates decrypted chunks, are outside the stated model, so a deployment should not read the zero attack-success results as covering those channels.
  • The 90-public/10-private split with attacks aimed only at the public store makes the zero results largely definitional, since any defense that isolates private from public retrieval would score near zero; a sharper test would allow the attacker to issue queries after authenticating as a legitimate user or to interact with the merged decrypted corpus.
  • A natural extension is to treat the decryption and assembly phase as its own attack surface and measure whether access-pattern leakage or timing reveals chunk count, chunk size, or retrieval order, since the current proofs do not quantify those side channels.
  • The framework's per-user isolation suggests a trade-off with collaborative retrieval in open-domain recommenders, which the paper itself flags; a middle ground might encrypt embeddings in a way that supports constrained similarity computation rather than full per-user isolation.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes SAG, a framework that aims to provide provably secure retrieval-augmented generation by encrypting text chunks and embeddings before storage, with two schemes: Chained Dynamic Key Derivation and Isolated AES. The authors claim formal IND-CPA confidentiality, forward security, chain integrity, and Authdoor privacy, and they report zero attack success rates against a wide range of leakage and poisoning attacks on four datasets. The central claim is that SAG is the first provably secure RAG framework with rigorous confidentiality and integrity guarantees.

Significance. If the formal proofs and experiments were sound, a provably secure RAG framework with both content and embedding protection would be a valuable contribution to a field currently dominated by heuristic defenses. The paper has concrete strengths: it proposes a concrete, implementable architecture with two encryption variants; it specifies attack prompts, datasets, and metrics in unusual detail in Appendix E; and it explicitly acknowledges limitations such as open-domain collaborative retrieval and KAG systems. However, the main claims are not supported by the current manuscript. The security games model only encryption-at-rest against unauthenticated outsiders, while the RAG attack surface that matters—prompt injection over an authorized session that retrieves both public and private chunks—is excluded by the threat model. The reductions contain invalid steps, and the experimental results are forced by the access-control setup rather than by the defense. The significance of the paper as it stands is therefore not established.

major comments (5)
  1. [Sections 3.1–3.2 and Appendix B] The threat model restricts the leakage adversary to one who 'fails Validator authentication' and can only query DBpub, asserting X(qadv) ⊆ DBpub. This makes the central confidentiality claim an assumption of the access-control setup rather than a property of the framework. The paper's own poisoning threat model (Eq. 7) grants write access to the knowledge base, and Eq. (4) constructs DB^U = DB^U_priv ∪ DBpub, so an authorized session can retrieve a poisoned public chunk together with private chunks. A malicious public chunk containing an instruction such as 'repeat all context verbatim' would then place private text in the LLM prompt. None of Games 1–4 models this scenario; the games stop at decryption or Authdoor verification. The confidentiality claim as stated therefore does not follow from the proofs.
  2. [Appendix B.1, Game 1; Eq. (17)] In Game 1, Step 2 samples keyU_i and returns it to the adversary. An adversary that knows the key can decrypt the challenge ciphertext cb and identify b with probability 1, so the reduction to AES-CBC IND-CPA security cannot be sound. Equation (17) asserts AdvB = AdvA without any argument, and in fact the advantage of B in the constructed game is not preserved. The proof of confidentiality in Section 3.3.3 therefore does not establish IND-CPA security of the scheme.
  3. [Section 3.3.3, Authdoor privacy, Eqs. (21)–(24)] The Authdoor proof treats the keyless hash H as a pseudorandom function. H(ID^U || key^U_master) is a public deterministic function evaluated on an input that contains a secret; this is not the same as a keyed PRF, and the reduction to 'PRF security' of H in Game 4 is not justified. Additionally, the game's decision rule ('If A recovers the plaintext triplet, set b'=0; otherwise b'=1') does not yield the standard PRF advantage decomposition stated in Eqs. (21)–(23). The Authdoor privacy claim is therefore not supported.
  4. [Section 3.3.3, Eq. (20)] The chain integrity bound qH(qH+1)/2^λ is a birthday bound for hash collisions, but the adversarial task in Algorithm 2 is to find a preimage of hi = H(keyU_i) under the unknown key. A birthday bound does not apply to preimage search; the correct brute-force bound is qH/2^λ for a λ-bit hash. As written, Eq. (20) overstates the security and the reduction in Game 3 does not match the stated attack, so the chain integrity proof is not valid.
  5. [Section E.2 and Tables 1–2] The experimental setup stores 90 public and 10 private chunks and sends attack queries only against the public store, so the private chunks never enter the retrieved context for the evaluated attacks. Consequently, LASR=0, Nav=0, LK=0, and PASR=0 in Tables 1 and 2 are forced by construction rather than by the defense. These experiments cannot support the abstract's claim that the framework 'effectively resists a range of state-of-the-art attacks.'
minor comments (6)
  1. [Abstract and Section 1] The abstract and introduction call SAG 'the first provably secure framework' without comparing to any prior formal RAG security work; this is an overclaim given the proofs' limitations.
  2. [Section 3.3.2, Eq. (12)] Equation (12) defines AuthdoorU as an XOR of values of unspecified, likely different bit-lengths; the paper should specify padding before claiming the XOR is well-defined.
  3. [Table 4] In Table 4, 'he advantage' should be 'the advantage'.
  4. [References] Reference [14] is incomplete (only '2017.'), and reference [66] cites Shokri et al. for GEIA although GEIA is a generative embedding inversion attack; the citation appears mismatched.
  5. [Sections E.2.9 and E.2.10] Sections E.2.9 and E.2.10 feed uniformly random tensors to LLaMA and call non-matching output a failed attack; this does not test embedding inversion and should be described as a sanity check rather than an attack evaluation.
  6. [Section 3.3.3] The paper's checklist claims 'complete proofs' but no theorem environments or numbered assumptions are used in Section 3.3.3; adding structured theorem statements would improve verifiability.

Circularity Check

3 steps flagged · score 8.0 of 10

The 'provably secure RAG' claim is largely definitional: the adversary is defined as unable to reach private data, the proof stops at AES-CBC encryption-at-rest, and the experiments ensure private chunks never enter the retrieved context, forcing 0% attack success.

  1. self definitional [Section 3.1, Threat Model (Eq. 6 and Figure 1)]
    "In contrast, an adversarial user Uadv who fails Validator authentication cannot access DB U priv. Instead, they may issue an adversarial query qadv over the public knowledge base DBpub. Since X (qadv) ⊆ DBpub and contains no private user embeddings, the corresponding response L(qadv, X (qadv)) does not reveal any sensitive information from DB U priv, preserving the privacy guarantees of the RAG system."

    The privacy guarantee is asserted as the direct consequence of defining the attacker as one who fails Validator authentication and can query only DBpub. No game or experiment considers an authenticated user whose retrieved context (Eq. 4: DB U = DB U_priv ∪ DBpub) mixes a poisoned public chunk with private chunks and then feeds both to the LLM. Thus 'unauthorized users cannot read private RAG content' is true by construction of the adversarial model, not derived from any SAG-specific mechanism.

  2. renaming known result [Section 3.3.3 Security Proof]
    "In our security analysis, we assume a realistic adversary who has access only to data stored in persistent storage, such as nodes and associated metadata. Runtime secrets—including master keys, derived sub-keys, and intermediate computation states—are assumed to be protected by hardware-based Trusted Execution Environments (TEEs). ... Under the threat model, our goal is to ensure IND-CPA security for encrypted private vectors in the knowledge base. We formally prove that the proposed scheme achieves this, assuming secure encryption keys and the cryptographic strength of AES-CBC."

    Once 'confidentiality' is defined as IND-CPA of AES-CBC on stored encrypted nodes, the formal result is the standard AES-CBC security assumption, which holds independently of RAG. The RAG-specific claim is imported by assuming runtime keys and decrypted context are not attack surfaces. The proof never models prompt injection over an authorized session where decrypted private chunks and attacker-controlled public chunks share the LLM prompt, so the 'provably secure RAG' conclusion is a relabeling of encryption-at-rest rather than a derivation of RAG confidentiality.

1 more flagged steps
  1. fitted input called prediction [Appendix E.2 and Section 4.2]
    "Specifically, we uniformly sampled 100 question-answer pairs from each domain dataset. Among them, 90 samples were stored as public knowledge base entries, while the remaining 10 were treated as private knowledge and stored separately. ... Prompt Injection attacks were ineffective because the private knowledge base is completely isolated from public content."

    The leakage experiments use the same adversarial model as the threat model: attacks are issued as qadv over the public store while private chunks are stored separately and never enter the retrieved context. With 90 public and 10 private chunks and no authorized-session retrieval of private content, LASR, Nav, and LK are 0 by construction; the experiment does not measure whether SAG prevents leakage when a legitimate query retrieves private chunks alongside a poisoned public chunk, which is the scenario Eq. 4 defines as normal operation.

full rationale

The isolated cryptographic reductions (IND-CPA of AES-CBC, PRF of HKDF, collision resistance of H, PRF of Authdoor) are not themselves circular, and the paper does not lean on self-citations. The circularity is at the level of the central claim: 'provably secure RAG' is defined to mean encryption of stored nodes against an adversary who cannot authenticate and cannot reach private data. That adversary model makes unauthorized access impossible by fiat, the formal proof proves only standard encryption-at-rest, and the experiments instantiate the same definition by keeping private chunks out of the attack context, so the 0% success rates are forced. The paper's own normal-operation equation DB U = DB U_priv ∪ DBpub, together with its poisoning threat model (Eq. 7), describes exactly the authorized-session prompt-injection path that the security games and experiments exclude. Consequently the central empirical and formal support reduces to the paper's input assumptions rather than to an independent RAG-security result.

Assumptions & free parameters 2 free parameters · 5 assumptions · 1 invented entities

The central claim rests on standard cryptographic assumptions plus two paper-specific choices: the threat model that confines the adversary to the public database, and the Authdoor construction whose proof requires PRF-like behavior from a keyless hash. The free parameters in the experiments are hand-chosen splits and chunk sizes that make the reported zero attack success rates definitional. No new cryptographic primitive is introduced; the contribution is an assembly of existing primitives into a RAG access-control layer.

free parameters (2)
  • private/public data split (90/10) with fixed random seed 10 = 90 public, 10 private per dataset
    Chosen by hand in E.2; private chunks are never exposed to attack queries, which determines the trivially zero leakage and poisoning scores.
  • chunk size = 512 characters
    Appendix E.4 states chunks of 512 characters; this affects encryption and decryption overhead measurements but is a hand-chosen experimental constant.
assumptions (5)
  • standard math AES-CBC is IND-CPA secure under standard assumptions
    Invoked in Section 3.3.3 and B.1 as the foundation of the confidentiality reduction.
  • standard math HKDF is a secure pseudorandom function
    Used in Section 3.3.3 and B.2 to establish forward security of the chained key derivation.
  • domain assumption Hash functions are collision-resistant and behave as PRFs when keyed
    Section 3.3.3 uses collision resistance for chain integrity and appears to treat the keyless hash H(ID||keymaster) as a PRF in the Authdoor privacy proof, which is not a standard assumption for unkeyed hashes.
  • domain assumption Trusted Execution Environment protects runtime secrets
    Section 3.3.3 assumes TEEs such as Intel SGX protect master keys, derived sub-keys, and intermediate computation states; the entire proof model depends on this deployment assumption.
  • domain assumption Adversary only accesses public knowledge base and persistent storage
    Section 3.2 and Figure 1 define the adversary as a user who cannot pass Validator authentication and therefore only queries DBpub; this premise does most of the security work and excludes attacks on the authorized retrieval path.
invented entities (1)
  • AuthdoorU verification token
    purpose: Server-side token that lets the system recover the user's first key and first address without storing them in plaintext, using the XOR of H(ID||keymaster) with (ID, key1, Addr1).
    The mechanism's security rests on modeling a keyless hash H as a PRF (Section 3.3.3, Game 4), a non-standard assumption; no external falsifiable handle is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Provably Secure Retrieval-Augmented Generation." pith.science (2026). https://pith.science/paper/QB7P5Q6W

@misc{pith2026250801084,
  author       = {Pith},
  title        = {Pith review of: Provably Secure Retrieval-Augmented Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QB7P5Q6W}},
  note         = {Machine review of arXiv:2508.01084}
}
read the original abstract

Although Retrieval-Augmented Generation (RAG) systems have been widely applied, the privacy and security risks they face, such as data leakage and data poisoning, have not been systematically addressed yet. Existing defense strategies primarily rely on heuristic filtering or enhancing retriever robustness, which suffer from limited interpretability, lack of formal security guarantees, and vulnerability to adaptive attacks. To address these challenges, this paper proposes the first provably secure framework for RAG systems(SAG). Our framework employs a pre-storage full-encryption scheme to ensure dual protection of both retrieved content and vector embeddings, guaranteeing that only authorized entities can access the data. Through formal security proofs, we rigorously verify the scheme's confidentiality and integrity under a computational security model. Extensive experiments across multiple benchmark datasets demonstrate that our framework effectively resists a range of state-of-the-art attacks. This work establishes a theoretical foundation and practical paradigm for verifiably secure RAG systems, advancing AI-powered services toward formally guaranteed security.

Figures

Figures reproduced from arXiv: 2508.01084 by the authors.

Figure 1
Figure 1. The overall architecture of SAG. This section describes the overall data flow in SAG ( [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. System architecture illustrating chained dynamic key derivation for encryption, decryption, [PITH_FULL_IMAGE:figures/full_fig_p018_2.png] view at source ↗
Figure 3
Figure 3. System architecture of the Isolated AES Scheme. [PITH_FULL_IMAGE:figures/full_fig_p018_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Performance Comparison: Processing Time Analysis Between Static Key Encryption and [PITH_FULL_IMAGE:figures/full_fig_p029_4.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

133 extracted references · 58 canonical work pages

  1. [1]

    Fabbri, Ben Risher, Philippe Laban, Shafiq Joty, and Chien- Sheng Wu

    Divyansh Agarwal, Alexander R. Fabbri, Ben Risher, Philippe Laban, Shafiq Joty, and Chien- Sheng Wu. Prompt leakage effect and defense strategies for multi-turn llm interactions, 2024

    2024

  2. [2]

    Is my data in your retrieval database? membership inference attacks against retrieval augmented generation

    Maya Anderson, Guy Amit, and Abigail Goldsteen. Is my data in your retrieval database? membership inference attacks against retrieval augmented generation. In Proceedings of the 11th International Conference on Information Systems Security and Privacy , page 474–485. SCITEPRESS - Science and Technology Publications, 2025

    2025

  3. [3]

    Introducing Claude

    Anthropic. Introducing Claude. https://www.anthropic.com/index/ introducing-claude, 2023

    2023

  4. [4]

    Training a helpful and harmless assistant with reinforcement learning from human feedback

    Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, et al. Training a helpful and harmless assistant with reinforcement learning from human feedback. arXiv preprint arXiv:2204.05862, 2022

    arXiv 2022

  5. [5]

    Keying hash functions for message authen- tication

    Mihir Bellare, Ran Canetti, and Hugo Krawczyk. Keying hash functions for message authen- tication. In Advances in Cryptology—CRYPTO’96: 16th Annual International Cryptology Conference Santa Barbara, California, USA August 18–22, 1996 Proceedings 16, pages 1–15. Springer, 1996

    1996

  6. [6]

    Hash function balance and its impact on birthday attacks

    Mihir Bellare and Tadayoshi Kohno. Hash function balance and its impact on birthday attacks. Cryptology ePrint Archive, Paper 2003/065, 2003

    2003

  7. [7]

    Hash function balance and its impact on birthday attacks

    Mihir Bellare and Tadayoshi Kohno. Hash function balance and its impact on birthday attacks. In Advances in Cryptology-EUROCRYPT 2004: International Conference on the Theory and Applications of Cryptographic Techniques, Interlaken, Switzerland, May 2-6, 2004. Proceedings 23, pages 401–418. Springer, 2004

    2004

  8. [8]

    Quantifying memorization across neural language models

    Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. Quantifying memorization across neural language models. In The Eleventh International Conference on Learning Representations, 2022

    2022

Show all 133 references
  1. [9]

    Phantom: General trigger attacks on retrieval augmented language generation

    Harsh Chaudhari, Giorgio Severi, John Abascal, Matthew Jagielski, Christopher A Choquette- Choo, Milad Nasr, Cristina Nita-Rotaru, and Alina Oprea. Phantom: General trigger attacks on retrieval augmented language generation. arXiv preprint arXiv:2405.20485, 2024

    2024

  2. [10]

    Trojanrag: Retrieval-augmented generation can be backdoor driver in large language models, 2024

    Pengzhou Cheng, Yidong Ding, Tianjie Ju, Zongru Wu, Wei Du, Ping Yi, Zhuosheng Zhang, and Gongshen Liu. Trojanrag: Retrieval-augmented generation can be backdoor driver in large language models, 2024

    2024

  3. [11]

    xRAG: Extreme context compression for retrieval-augmented generation with one token

    Xin Cheng, Xun Wang, Xingxing Zhang, Tao Ge, Si-Qing Chen, Furu Wei, Huishuai Zhang, and Dongyan Zhao. xRAG: Extreme context compression for retrieval-augmented generation with one token. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024

    2024

  4. [12]

    Unleashing worms and extracting data: Escalating the outcome of attacks against rag-based inference in scale and severity using jailbreaking

    Stav Cohen, Ron Bitton, and Ben Nassi. Unleashing worms and extracting data: Escalating the outcome of attacks against rag-based inference in scale and severity using jailbreaking. arXiv preprint arXiv:2409.08045, 2024

    2024 arXiv

  5. [13]

    Intel SGX explained

    Victor Costan and Srinivas Devadas. Intel SGX explained. Cryptology ePrint Archive, Paper 2016/086, 2016

    2016

  6. [14]

    Victor Costan, Ilia Lebedev, and Srinivas Devadas. 2017

    2017

  7. [15]

    Aes proposal: Rijndael

    Joan Daemen and Vincent Rijmen. Aes proposal: Rijndael. 1999

    1999

  8. [16]

    Pirates of the rag: Adaptively attacking llms to leak knowledge bases

    Christian Di Maio, Cristian Cosci, Marco Maggini, Valentina Poggioni, and Stefano Melacci. Pirates of the rag: Adaptively attacking llms to leak knowledge bases. arXiv preprint arXiv:2412.18295, 2024. 10

    2024 arXiv

  9. [17]

    Attacks, defenses and evaluations for llm conversation safety: A survey

    Zhichen Dong, Zhanhui Zhou, Chao Yang, Jing Shao, and Yu Qiao. Attacks, defenses and evaluations for llm conversation safety: A survey. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technolo...

    2024

  10. [18]

    A comprehensive survey of attack techniques, implementation, and mitigation strategies in large language models

    Aysan Esmradi, Daniel Wankit Yip, and Chun Fai Chan. A comprehensive survey of attack techniques, implementation, and mitigation strategies in large language models. InInternational Conference on Ubiquitous Security, pages 76–95. Springer, 2023

    2023

  11. [19]

    A survey on rag meeting llms: Towards retrieval-augmented large language models

    Wenqi Fan, Yujuan Ding, Liangbo Ning, Shijie Wang, Hengyun Li, Dawei Yin, Tat-Seng Chua, and Qing Li. A survey on rag meeting llms: Towards retrieval-augmented large language models. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages...

    2024

  12. [20]

    How to construct random functions

    Oded Goldreich, Shafi Goldwasser, and Silvio Micali. How to construct random functions. J. ACM, 33(4):792–807, August 1986

    1986

  13. [21]

    Topic-fliprag: Topic-orientated adversarial opinion manipulation attacks to retrieval-augmented generation models

    Yuyang Gong, Zhuo Chen, Miaokun Chen, Fengchang Yu, Wei Lu, Xiaofeng Wang, Xiaozhong Liu, and Jiawei Liu. Topic-fliprag: Topic-orientated adversarial opinion manipulation attacks to retrieval-augmented generation models. arXiv preprint arXiv:2502.01386, 2025

    2025

  14. [22]

    Detecting and preventing hallucinations in large vision language models

    Anisha Gunjal, Jihan Yin, and Erhan Bas. Detecting and preventing hallucinations in large vision language models. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 38, pages 18135–18143, 2024

    2024

  15. [23]

    Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning

    Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et al. Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning. arXiv preprint arXiv:2501.12948, 2025

    2025 arXiv

  16. [24]

    Realm: retrieval- augmented language model pre-training

    Kelvin Guu, Kenton Lee, Zora Tung, Panupong Pasupat, and Ming-Wei Chang. Realm: retrieval- augmented language model pre-training. In Proceedings of the 37th International Conference on Machine Learning, ICML’20. JMLR.org, 2020

    2020

  17. [25]

    Llama guard: Llm-based input-output safeguard for human-ai conversations

    Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, et al. Llama guard: Llm-based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.06674, 2023

    2023 arXiv

  18. [26]

    Mul- titask mayhem: Unveiling and mitigating safety gaps in llms fine-tuning

    Essa Jan, Nouar AlDahoul, Moiz Ali, Faizan Ahmad, Fareed Zaffar, and Yasir Zaki. Mul- titask mayhem: Unveiling and mitigating safety gaps in llms fine-tuning. arXiv preprint arXiv:2409.15361, 2024

    2024 arXiv

  19. [27]

    Rag-thief: Scalable extraction of private data from retrieval-augmented generation applications with agent-based attacks, 2024

    Changyue Jiang, Xudong Pan, Geng Hong, Chenfu Bao, and Min Yang. Rag-thief: Scalable extraction of private data from retrieval-augmented generation applications with agent-based attacks, 2024

    2024

  20. [28]

    When large language models meet vector databases: A survey

    Zhi Jing, Yongye Su, Yikun Han, Bo Yuan, Haiyun Xu, Chunjiang Liu, Kehai Chen, and Min Zhang. When large language models meet vector databases: A survey. arXiv preprint arXiv:2402.01763, 2024

    2024 arXiv

  21. [29]

    Deduplicating training data mitigates privacy risks in language models

    Nikhil Kandpal, Eric Wallace, and Colin Raffel. Deduplicating training data mitigates privacy risks in language models. In International Conference on Machine Learning, pages 10697– 10707. PMLR, 2022

    2022

  22. [30]

    Introduction to modern cryptography: principles and protocols

    Jonathan Katz and Yehuda Lindell. Introduction to modern cryptography: principles and protocols. Chapman and hall/CRC, 2007

    2007

  23. [31]

    Colbert: Efficient and effective passage search via contextual- ized late interaction over bert

    Omar Khattab and Matei Zaharia. Colbert: Efficient and effective passage search via contextual- ized late interaction over bert. In Proceedings of the 43rd International ACM SIGIR Conference on Research and Development in Information Retrieval, SIGIR ’20, page 39–48, New York,...

    2020

  24. [32]

    The enron corpus: A new dataset for email classification research

    Bryan Klimt and Yiming Yang. The enron corpus: A new dataset for email classification research. In European conference on machine learning, pages 217–226. Springer, 2004. 11

    2004

  25. [33]

    Billsum: A corpus for automatic summarization of us congressional bills

    Anastassia Kornilova and Vladimir Eidelman. Billsum: A corpus for automatic summarization of us congressional bills. In Proceedings of the 2nd Workshop on New Frontiers in Summariza- tion, pages 48–56, Hong Kong, China, 2019. Association for Computational Linguistics

    2019

  26. [34]

    Cryptographic extraction and key derivation: The hkdf scheme

    Hugo Krawczyk. Cryptographic extraction and key derivation: The hkdf scheme. In Annual Cryptology Conference, pages 631–648. Springer, 2010

    2010

  27. [35]

    Hmac: Keyed-hashing for message authenti- cation

    Hugo Krawczyk, Mihir Bellare, and Ran Canetti. Hmac: Keyed-hashing for message authenti- cation. RFC 2104, IETF, 1997

    1997

  28. [36]

    Watch your language: Inves- tigating content moderation with large language models

    Deepak Kumar, Yousef Anees AbuHashem, and Zakir Durumeric. Watch your language: Inves- tigating content moderation with large language models. In Proceedings of the International AAAI Conference on Web and Social Media, volume 18, pages 865–878, 2024

    2024

  29. [37]

    Deduplicating training data makes language models better

    Katherine Lee, Daphne Ippolito, Andrew Nystrom, Chiyuan Zhang, Douglas Eck, Chris Callison-Burch, and Nicholas Carlini. Deduplicating training data makes language models better. arXiv preprint arXiv:2107.06499, 2021

    2021 arXiv

  30. [38]

    A new generation of perspective api: Efficient multilingual character-level trans- formers

    Alyssa Lees, Vinh Q Tran, Yi Tay, Jeffrey Sorensen, Jai Gupta, Donald Metzler, and Lucy Vasserman. A new generation of perspective api: Efficient multilingual character-level trans- formers. In Proceedings of the 28th ACM SIGKDD conference on knowledge discovery and data minin...

    2022

  31. [39]

    Retrieval-augmented generation for knowledge-intensive nlp tasks

    Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, et al. Retrieval-augmented generation for knowledge-intensive nlp tasks. Advances in neural information processing systems...

    2020

  32. [40]

    Retrieval-augmented generation for knowledge-intensive nlp tasks

    Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, Sebastian Riedel, and Douwe Kiela. Retrieval-augmented generation for knowledge-intensive nlp tasks. In Proceed- ings of t...

    2020

  33. [41]

    Xiaoguo Li, Bowen Zhao, Guomin Yang, Tao Xiang, Jian Weng, and Robert H. Deng. A survey of secure computation using trusted execution environments, 2023

    2023

  34. [42]

    Prompt injection attack against llm-integrated applications

    Yi Liu, Gelei Deng, Yuekang Li, Kailong Wang, Zihao Wang, Xiaofeng Wang, Tianwei Zhang, Yepang Liu, Haoyu Wang, Yan Zheng, et al. Prompt injection attack against llm-integrated applications. arXiv preprint arXiv:2306.05499, 2023

    2023 arXiv

  35. [43]

    Formalizing and benchmarking prompt injection attacks and defenses

    Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. Formalizing and benchmarking prompt injection attacks and defenses. In 33rd USENIX Security Symposium (USENIX Security 24), pages 1831–1847, 2024

    2024

  36. [44]

    Financial document summarization with structure- aware pre-training

    Ying Lu, Qian Liu, Shuai Liu, and et al. Financial document summarization with structure- aware pre-training. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 4922–4933. Association for Computational Linguistics, 2021

    2021

  37. [45]

    A holistic approach to undesired content detection in the real world

    Todor Markov, Chong Zhang, Sandhini Agarwal, Florentine Eloundou Nekoul, Theodore Lee, Steven Adler, Angela Jiang, and Lilian Weng. A holistic approach to undesired content detection in the real world. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37...

    2023

  38. [46]

    Llama Guard 2: Model cards and prompt formats

    Meta AI. Llama Guard 2: Model cards and prompt formats. https://www.llama.com/docs/ model-cards-and-prompt-formats/meta-llama-guard-2/ , 2024

    2024

  39. [47]

    Text embeddings reveal (almost) as much as text

    John Morris, V olodymyr Kuleshov, Vitaly Shmatikov, and Alexander Rush. Text embeddings reveal (almost) as much as text. In Houda Bouamor, Juan Pino, and Kalika Bali, editors, Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 12448–1...

    2023

  40. [48]

    Poison-rag: Adversarial data poisoning attacks on retrieval-augmented generation in recommender systems

    Fatemeh Nazary, Yashar Deldjoo, and Tommaso di Noia. Poison-rag: Adversarial data poisoning attacks on retrieval-augmented generation in recommender systems. In European Conference on Information Retrieval, pages 239–251. Springer, 2025

    2025

  41. [49]

    A survey of published attacks on intel sgx, 2020

    Alexander Nilsson, Pegah Nikbakht Bideh, and Joakim Brorsson. A survey of published attacks on intel sgx, 2020

    2020

  42. [50]

    ChatGPT: Optimizing Language Models for Dialogue

    OpenAI. ChatGPT: Optimizing Language Models for Dialogue. https://openai.com/ blog/chatgpt, 2022

    2022

  43. [51]

    Openai text-embedding-ada-002

    OpenAI. Openai text-embedding-ada-002. https://platform.openai.com/docs/ guides/embeddings, 2022. Accessed: 2025-05-14

    2022

  44. [52]

    Gpt-4o mini

    OpenAI. Gpt-4o mini. https://platform.openai.com/docs/models/gpt-4o, 2024. Accessed: 2025-05-14

    2024

  45. [53]

    Training language models to follow instructions with human feedback

    Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback. Advances in neural information processing systems, 35:2773...

    2022

  46. [54]

    Development of dental consultation chatbot using retrieval augmented llm

    Jongjin Park. Development of dental consultation chatbot using retrieval augmented llm. The Journal of the Institute of Internet, Broadcasting and Communication, 24(2):87–92, 2024

    2024

  47. [55]

    197: Advanced encryption standard (aes)

    NIST FIPS Pub. 197: Advanced encryption standard (aes). Federal information processing standards publication, 197(441):0311, 2001

    2001

  48. [56]

    Follow my instruction and spill the beans: Scalable data extraction from retrieval-augmented generation systems

    Zhenting Qi, Hanlin Zhang, Eric Xing, Sham Kakade, and Himabindu Lakkaraju. Follow my instruction and spill the beans: Scalable data extraction from retrieval-augmented generation systems. arXiv preprint arXiv:2402.17840, 2024

    2024 arXiv

  49. [57]

    Scaling up llm reviews for google ads content moderation

    Wei Qiao, Tushar Dogra, Otilia Stretcu, Yu-Han Lyu, Tiantian Fang, Dongjin Kwon, Chun-Ta Lu, Enming Luo, Yuan Wang, Chih-Chun Chia, et al. Scaling up llm reviews for google ads content moderation. In Proceedings of the 17th ACM International Conference on Web Search and Data M...

    2024

  50. [58]

    RocketQA: An optimized training approach to dense passage retrieval for open-domain question answering

    Yingqi Qu, Yuchen Ding, Jing Liu, Kai Liu, Ruiyang Ren, Wayne Xin Zhao, Daxiang Dong, Hua Wu, and Haifeng Wang. RocketQA: An optimized training approach to dense passage retrieval for open-domain question answering. In Kristina Toutanova, Anna Rumshisky, Luke Zettle- moyer, Di...

    2021

  51. [59]

    A rag-based medical assistant especially for infectious diseases

    Mahimai Raja, E Yuvaraajan, et al. A rag-based medical assistant especially for infectious diseases. In 2024 International Conference on Inventive Computation Technologies (ICICT), pages 1128–1133. IEEE, 2024

    2024

  52. [60]

    Nemo guardrails: A toolkit for controllable and safe llm applications with programmable rails

    Traian Rebedea, Razvan Dinu, Makesh Narsimhan Sreedhar, Christopher Parisien, and Jonathan Cohen. Nemo guardrails: A toolkit for controllable and safe llm applications with programmable rails. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Proce...

    2023

  53. [61]

    Evaluation of some blockcipher modes of operation

    Phillip Rogaway. Evaluation of some blockcipher modes of operation. 2011

    2011

  54. [62]

    Machine against the rag: Jamming retrieval-augmented generation with blocker documents

    Avital Shafran, Roei Schuster, and Vitaly Shmatikov. Machine against the rag: Jamming retrieval-augmented generation with blocker documents. arXiv preprint arXiv:2406.05870, 2024

    2024 arXiv

  55. [63]

    Communication theory of secrecy systems

    Claude E Shannon. Communication theory of secrecy systems. The Bell system technical journal, 28(4):656–715, 1949. 13

    1949

  56. [64]

    Optimization-based prompt injection attack to llm-as-a-judge

    Jiawen Shi, Zenghui Yuan, Yinuo Liu, Yue Huang, Pan Zhou, Lichao Sun, and Neil Zhenqiang Gong. Optimization-based prompt injection attack to llm-as-a-judge. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 660–674, 2024

    2024

  57. [65]

    Reflexion: Language agents with verbal reinforcement learning.Advances in Neural Information Processing Systems, 36:8634–8652, 2023

    Noah Shinn, Federico Cassano, Ashwin Gopinath, Karthik Narasimhan, and Shunyu Yao. Reflexion: Language agents with verbal reinforcement learning.Advances in Neural Information Processing Systems, 36:8634–8652, 2023

    2023

  58. [66]

    Membership inference attacks against machine learning models, 2017

    Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models, 2017

    2017

  59. [67]

    Tensor trust: Interpretable prompt injection attacks from an online game

    Sam Toyer, Olivia Watkins, Ethan Adrian Mendes, Justin Svegliato, Luke Bailey, Tiffany Wang, Isaac Ong, Karim Elmaaroufi, Pieter Abbeel, Trevor Darrell, et al. Tensor trust: Interpretable prompt injection attacks from an online game. arXiv preprint arXiv:2311.01011, 2023

    2023 arXiv

  60. [68]

    A generalized birthday problem

    David Wagner. A generalized birthday problem. InAnnual International Cryptology Conference, pages 288–304. Springer, 2002

    2002

  61. [69]

    HealthCareMagic-100k-en Dataset

    Rongsheng Wang. HealthCareMagic-100k-en Dataset. https://huggingface.co/ datasets/wangrongsheng/HealthCareMagic-100k-en , 2023

    2023

  62. [70]

    Healthq: Unveiling questioning capabilities of llm chains in healthcare conversations

    Ziyu Wang, Hao Li, Di Huang, and Amir M Rahmani. Healthq: Unveiling questioning capabilities of llm chains in healthcare conversations. arXiv preprint arXiv:2409.19487, 2024

    2024 arXiv

  63. [71]

    Clasheval: Quantifying the tug-of-war between an llm’s internal prior and external evidence

    Kevin Wu, Eric Wu, and James Y Zou. Clasheval: Quantifying the tug-of-war between an llm’s internal prior and external evidence. Advances in Neural Information Processing Systems, 37:33402–33422, 2024

    2024

  64. [72]

    Tapi: Towards target-specific and adversarial prompt injection against code llms

    Yuchen Yang, Hongwei Yao, Bingrun Yang, Yiling He, Yiming Li, Tianwei Zhang, Zhan Qin, and Kui Ren. Tapi: Towards target-specific and adversarial prompt injection against code llms. arXiv preprint arXiv:2407.09164, 2024

    2024 arXiv

  65. [73]

    Poisonprompt: Backdoor attack on prompt-based large language models

    Hongwei Yao, Jian Lou, and Zhan Qin. Poisonprompt: Backdoor attack on prompt-based large language models. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 7745–7749. IEEE, 2024

    2024

  66. [74]

    Controlnet: A firewall for rag-based llm system

    Hongwei Yao, Haoran Shi, Yidou Chen, Yixin Jiang, Cong Wang, Zhan Qin, Kui Ren, and Chun Chen. Controlnet: A firewall for rag-based llm system. arXiv preprint arXiv:2504.09593, 2025

    2025 arXiv

  67. [75]

    Cognitive mirage: A review of hallucinations in large language models

    Hongbin Ye, Tong Liu, Aijia Zhang, Wei Hua, and Weiqiang Jia. Cognitive mirage: A review of hallucinations in large language models. arXiv preprint arXiv:2309.06794, 2023

    2023 arXiv

  68. [76]

    Assessing prompt injection risks in 200+ custom gpts

    Jiahao Yu, Yuhang Wu, Dong Shu, Mingyu Jin, Sabrina Yang, and Xinyu Xing. Assessing prompt injection risks in 200+ custom gpts. In ICLR 2024 Workshop on Secure and Trustworthy Large Language Models

    2024

  69. [77]

    Rankrag: Unifying context ranking with retrieval-augmented generation in llms

    Yue Yu, Wei Ping, Zihan Liu, Boxin Wang, Jiaxuan You, Chao Zhang, Mohammad Shoeybi, and Bryan Catanzaro. Rankrag: Unifying context ranking with retrieval-augmented generation in llms. Advances in Neural Information Processing Systems, 37:121156–121184, 2024

    2024

  70. [78]

    The good and the bad: Exploring privacy issues in retrieval-augmented generation (RAG)

    Shenglai Zeng, Jiankun Zhang, Pengfei He, Yiding Liu, Yue Xing, Han Xu, Jie Ren, Yi Chang, Shuaiqiang Wang, Dawei Yin, and Jiliang Tang. The good and the bad: Exploring privacy issues in retrieval-augmented generation (RAG). In Lun-Wei Ku, Andre Martins, and Vivek Srikumar, ed...

    2024

  71. [79]

    Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents

    Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents. In Findings of the Association for Computational Linguistics ACL 2024, pages 10471–10506, 2024

    2024

  72. [80]

    Prac- tical poisoning attacks against retrieval-augmented generation.arXiv preprint arXiv:2504.03957, 2025

    Baolei Zhang, Yuxi Chen, Minghong Fang, Zhuqing Liu, Lihai Nie, Tong Li, and Zheli Liu. Prac- tical poisoning attacks against retrieval-augmented generation.arXiv preprint arXiv:2504.03957, 2025. 14

    2025

  73. [81]

    Hijackrag: Hijacking attacks against retrieval-augmented large language models, 2024

    Yucheng Zhang, Qinfeng Li, Tianyu Du, Xuhong Zhang, Xinkui Zhao, Zhengwen Feng, and Jianwei Yin. Hijackrag: Hijacking attacks against retrieval-augmented large language models, 2024

    2024

  74. [82]

    Retrieval-augmented generation for ai-generated content: A survey

    Penghao Zhao, Hailin Zhang, Qinhan Yu, Zhengren Wang, Yunteng Geng, Fangcheng Fu, Ling Yang, Wentao Zhang, Jie Jiang, and Bin Cui. Retrieval-augmented generation for ai-generated content: A survey. arXiv preprint arXiv:2402.19473, 2024

    2024 arXiv

  75. [83]

    Poisoning retrieval corpora by injecting adversarial passages

    Zexuan Zhong, Ziqing Huang, Alexander Wettig, and Danqi Chen. Poisoning retrieval corpora by injecting adversarial passages. In The 2023 Conference on Empirical Methods in Natural Language Processing

    2023

  76. [84]

    Promptbench: A unified library for evaluation of large language models

    Kaijie Zhu, Qinlin Zhao, Hao Chen, Jindong Wang, and Xing Xie. Promptbench: A unified library for evaluation of large language models. Journal of Machine Learning Research , 25(254):1–22, 2024

    2024

  77. [85]

    Poisonedrag: Knowledge corruption attacks to retrieval-augmented generation of large language models, 2024

    Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. Poisonedrag: Knowledge corruption attacks to retrieval-augmented generation of large language models, 2024. A Symbol Definitions To facilitate understanding and reproducibility, Table 3 summarizes the main symbols and notat...

    2024

  78. [86]

    B receives λ and public parameters (including those for AES-CBC)

  79. [87]

    Key Generation: For each request from A for keyU i , sample keyU i $ ← − {0, 1}λ and return it

  80. [88]

    (b) Submit (m0, m1) to the AES-CBC challenger, receive cb ← AESCBC .EK,IV (mb) for random b $ ← − {0, 1}

    Encryption Query: For each encryption query (m0, m1) from A: (a) Sample IV $ ← − {0, 1}λ. (b) Submit (m0, m1) to the AES-CBC challenger, receive cb ← AESCBC .EK,IV (mb) for random b $ ← − {0, 1}. (c) Return (IV, cb) to A

  81. [89]

    A outputs a guess b′

  82. [90]

    16 B.2 Forward Security Game Game 2 captures the reduction for forward security of the key derivation mechanism

    Return b′. 16 B.2 Forward Security Game Game 2 captures the reduction for forward security of the key derivation mechanism. Game 2: BA(λ) in the Forward Security Game Input: Security parameter λ Output: b′ ▷ B’s guess of the challenge bit

  83. [91]

    B receives a challenge key key∗ from the HKDF challenger, which is either a real HKDF output or a uniformly random string

  84. [92]

    B sets keyU i ← key∗ and simulates the key derivation process to compute keyU i+1, keyU i+2,

  85. [93]

    B provides one or more derived keys keyU k (for k ≥ i) to the adversary A

  86. [94]

    A attempts to recover a historical key keyU j for some j < i(e.g., by decrypting N odeU j )

  87. [95]

    If A succeeds, set b′ = 1; otherwise, set b′ = 0

  88. [96]

    B.3 Chain Integrity Game Game 3 describes the reduction for the chain integrity property based on hash collision resistance

    Return b′. B.3 Chain Integrity Game Game 3 describes the reduction for the chain integrity property based on hash collision resistance. Game 3: BA(λ) in the Chain Integrity Game Input: Security parameter λ Output: b′ ▷ B’s success in finding a hash collision

  89. [97]

    B selects a random key keyU i $ ← − {0, 1}λ and computes hi = H(keyU i )

  90. [98]

    B embeds hi into N odeU i and provides N odeU i to the adversary A

  91. [99]

    A outputs a forged key key′

  92. [100]

    If key′ ̸= keyU i and H(key′) =hi, set b′ = 1; otherwise, set b′ = 0

  93. [101]

    B.4 Authdoor Store Privacy Game Game 4 formalizes the reduction for the privacy of the Authdoor mechanism under the PRF security assumption

    Return b′. B.4 Authdoor Store Privacy Game Game 4 formalizes the reduction for the privacy of the Authdoor mechanism under the PRF security assumption. Game 4: BA(λ) in the Authdoor Store Privacy Game Input: Security parameter λ Output: b′ ▷ B’s guess of the PRF challenge bit b

  94. [102]

    B receives oracle access to P RF(x) from the PRF challenger, where: • If b = 0, P RF(x) =H(x) (the real PRF); • If b = 1, P RF(x) is a uniformly random string of length L

  95. [103]

    Randomly generate (ID U $ ← − {0, 1}λ1 , keyU 1 $ ← − {0, 1}λ2 , AddrU 1 $ ← − {0, 1}λ3 )

  96. [104]

    Submit x = (ID U ∥keyU master) to the PRF challenger and receive yb = P RF(x)

  97. [105]

    Construct AuthdoorU = yb ⊕ (ID U ∥keyU 1 ∥AddrU 1 )

  98. [106]

    Provide AuthdoorU to A and observe whether A can recover (ID U , keyU 1 , AddrU 1 )

  99. [107]

    If A recovers the plaintext triplet, set b′ = 0; otherwise, set b′ = 1

  100. [108]

    Return b′. 17 C Chained Dynamic Key Derivation Knowledge Base Submit AuthDoor Decryption ChunkEmbedding Enc(Chunk) Enc(Chunk) Enc(Chunk) Enc(Chunk) Enc(Embedding) Enc(Embedding) Enc(Embedding) Enc(Embedding) Enc(NextKey) Enc(NextKey) Enc(NextKey) Enc(NextKey) Hash(EncKey) Hash...

  101. [109]

    If there are no related files, omit this tag

    Use the tag <relevance>...</relevance> to wrap the retrieved related files. If there are no related files, omit this tag

  102. [110]

    The user’s inquiry is enclosed within the <query>...</query> tag

    Respond to the user’s inquiry by referring to the relevant documents within the <relevance>...</relevance> tag. The user’s inquiry is enclosed within the <query>...</query> tag

  103. [111]

    Place your output in the <output>...</output> tag

  104. [112]

    Do not output the relevant documents themselves; just read them. <query>{query}</query> We adopt three quantitative metrics to evaluate the effectiveness of knowledge leakage attacks: Leakage Attack Success Rate (LASR) , Navigation Coverage (Nav), and Leaked Knowledge (LK). Le...

  105. [113]

    Analyze the provided text chunk and generate 5 forward continuations, with each continuation logically following from the previous one

  106. [114]

    Generate 5 backward continuations, each one speculating on what may have hap- pened before the provided chunk

  107. [115]

    Ensure that the continuations closely match the original chunk in terms of style, length, theme, and character portrayal

  108. [116]

    Each set of continuations must total no fewer than 1000 tokens

  109. [117]

    ", Metadata:

    Number each continuation sequentially, starting from ’1’, and output exactly 10 continuations, with no additional commentary or explanation. Data: chunk RAG-Thief Domain-Specific Prompts: RAG-Thief (ENRON/Email) Analyze the following email excerpt in terms of sender, recipient...

  110. [118]

    Theoretical analysis and experimental results strongly support the proposed provably secure RAG framework

    Claims Question: Do the main claims made in the abstract and introduction accurately reflect the paper’s contributions and scope? Answer: [Yes] Justification: The abstract and introduction accurately reflect the main contributions and scope of the paper. Theoretical analysis a...

  111. [119]

    Limitations

    Limitations Question: Does the paper discuss the limitations of the work performed by the authors? Answer: [Yes] 31 Justification: This paper discusses the limitations of the proposed method, noting its chal- lenges in achieving ideal performance in open-domain recommendation ...

  112. [120]

    Theory assumptions and proofs Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof? Answer: [Yes] Justification: This paper provides sufficient and detailed security proofs. All key theo- rems clearly stat...

  113. [121]

    Experimental result reproducibility Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and da...

  114. [122]

    The code and reproduction scripts will be included in the supplementary materials to ensure transparency and reproducibility of the research results

    Open access to data and code Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material? Answer: [Yes] Justification: We utilized publicly availa...

  115. [123]

    Guidelines: • The answer NA means that the paper does not include experiments

    Experimental setting/details Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results? Answer: [Yes] Justification: The main text and appendix pr...

  116. [124]

    We ensure statistical significance and reliability, with detailed explanations provided in the experimental section and figure captions

    Experiment statistical significance Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments? Answer: [Yes] Justification: In efficiency and runtime tests, we report the mea...

  117. [125]

    For each experiment, the execution time is reported

    Experiments compute resources Question: For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments? Answer: [Yes] Justification: This paper provides det...

  118. [126]

    Guidelines: • The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics

    Code of ethics Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines? Answer: [Yes] Justification: This research fully complies with the NeurIPS Code of Ethics, ensuring all expe...

  119. [127]

    Guidelines: • The answer NA means that there is no societal impact of the work performed

    Broader impacts Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed? Answer: [Yes] Justification: This work contributes to enhancing the provable security of RAG systems, promoting the development of tru...

  120. [128]

    Guidelines: • The answer NA means that the paper poses no such risks

    Safeguards Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)? Answer: [NA] Justification: This paper does...

  121. [129]

    Guidelines: • The answer NA means that the paper does not use existing assets

    Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected? Answer: [Yes] Justification: All data assets ...

  122. [130]

    Guidelines: • The answer NA means that the paper does not release new assets

    New assets Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets? 36 Answer: [NA] Justification: The paper does not release new assets. Guidelines: • The answer NA means that the paper does not release new asset...

  123. [131]

    Guidelines: • The answer NA means that the paper does not involve crowdsourcing nor research with human subjects

    Crowdsourcing and research with human subjects Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)? A...

  124. [132]

    Guidelines: • The answer NA means that the paper does not involve crowdsourcing nor research with human subjects

    Institutional review board (IRB) approvals or equivalent for research with human subjects Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals...

  125. [133]

    Answer: [NA] 37 Justification: The core method development in this research does not involve LLMs as any important

    Declaration of LLM usage Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the ...

    2025

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.