Pith. sign in

REVIEW 10 cited by

Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2406.05870 v4 pith:QYERFLK3 submitted 2024-06-09 cs.CR cs.CLcs.LG

Avital Shafran , Roei Schuster , Vitaly Shmatikov This is my paper · ORCID
classification cs.CRcs.CLcs.LG
keywords documentsblockerjammingadversaryattacksbecausedatabasedemonstrate
verification ladder T0 review T1 audit T2 compute T3 formal

Signed reviews

No signed human review yet.

0 comments
read the original abstract

Retrieval-augmented generation (RAG) systems respond to queries by retrieving relevant documents from a knowledge database and applying an LLM to the retrieved documents. We demonstrate that RAG systems that operate on databases with untrusted content are vulnerable to denial-of-service attacks we call jamming. An adversary can add a single ``blocker'' document to the database that will be retrieved in response to a specific query and result in the RAG system not answering this query, ostensibly because it lacks relevant information or because the answer is unsafe. We describe and measure the efficacy of several methods for generating blocker documents, including a new method based on black-box optimization. Our method (1) does not rely on instruction injection, (2) does not require the adversary to know the embedding or LLM used by the target RAG system, and (3) does not employ an auxiliary LLM. We evaluate jamming attacks on several embeddings and LLMs and demonstrate that the existing safety metrics for LLMs do not capture their vulnerability to jamming. We then discuss defenses against blocker documents.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 10 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. RAG LLMs are Not Safer: A Safety Analysis of Retrieval-Augmented Generation for Large Language Models

    cs.CL 2025-04 conditional novelty 7.0 of 10

    RAG can make language models less safe than their non-RAG equivalents, even with safe documents, and current jailbreak methods transfer poorly to RAG.

  2. ImportSnare: Directed "Code Manual" Hijacking in Retrieval-Augmented Code Generation

    cs.CR 2025-09 conditional novelty 6.0 of 10

    Documentation poisoning with hidden ranking and suggestion sequences can make RAG-based code generators confidently recommend malicious dependencies, even at 0.01% poisoning ratios.

  3. EcoSafeRAG: Efficient Security through Context Analysis in Retrieval-Augmented Generation

    cs.CL 2025-05 conditional novelty 6.0 of 10

    EcoSafeRAG filters poisoned or injected documents from RAG inputs by sentence-level splitting plus bait-guided DBSCAN clustering of context vectors, before the language model generates an answer.

  4. Rerouting LLM Routers

    cs.CR 2025-01 conditional novelty 6.0 of 10

    Adversarially optimized, query-independent token prefixes can reroute nearly all queries to the expensive strong model in both open-source and commercial LLM routers.

  5. TrustRAG: Enhancing Robustness and Trustworthiness in Retrieval-Augmented Generation

    cs.CL 2025-01 conditional novelty 6.0 of 10

    TrustRAG combines K-means filtering with LLM self-assessment to defend RAG systems against corpus poisoning attacks, cutting attack success rates while preserving accuracy.

  6. Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation

    cs.CL 2025-08 reject novelty 5.0 of 10

    Sparse autoencoder activation perturbation (SFPF) applied on top of existing jailbreak prompts raises attack success rate on Qwen3-32B, but with no defense evaluation and weak reproducibility.

  7. Benchmarking Poisoning Attacks against Retrieval-Augmented Generation

    cs.CR 2025-05 conditional novelty 5.0 of 10

    A unified benchmark evaluation finds that existing RAG poisoning attacks remain effective on standard QA datasets, drop on expanded knowledge bases, and are only partially mitigated by current defenses.

  8. Hoist with His Own Petard: Inducing Guardrails to Facilitate Denial-of-Service Attacks on Retrieval-Augmented Generation of LLMs

    cs.CR 2025-04 conditional novelty 4.0 of 10

    MutedRAG injects jailbreak-style sentences into a RAG knowledge base, causing the language model's safety guardrails to block benign queries.

  9. Retrieval Augmented Generation Evaluation in the Era of Large Language Models: A Comprehensive Survey

    cs.CL 2025-04 conditional novelty 3.0 of 10

    A review that organizes RAG evaluation into internal and external categories, catalogs dozens of benchmarks, and analyzes evaluation practices in 582 conference papers.

  10. Provably Secure Retrieval-Augmented Generation

    cs.CR 2025-08 reject novelty 2.0 of 10

    SAG encrypts RAG knowledge bases and claims formal security, but its proofs are flawed and its benchmarks guarantee zero attack success by design.

Pith tools