DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denial

Abay Zhurekbay; Fan Li; Tao Liu

REVIEW 4 major objections 4 minor 28 references

DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denial

T0 review · 4 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read DenialRAG: a single poisoned passage that names the correct answer and denies it steers RAG systems to wrong answers more reliably than merely asserting a false one.

desk verdict Novel attack idea with a real evaluation gap: the substring-match metric likely inflates DenialRAG's reported ASR, and the numbers need re-analysis before the comparative claims can be trusted. read the letter →

arxiv 2608.02678 v1 pith:UJCG2HH6 submitted 2026-08-02 cs.CR cs.AIcs.LG

Abay Zhurekbay , Tao Liu , Fan Li This is my paper

classification cs.CRcs.AIcs.LG

keywords DenialRAGpoisoningcorpussingle-documentattackretrieval-augmentedgenerationknowledgeconflictembeddedsuccessrate

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes DenialRAG, a corpus-poisoning attack on retrieval-augmented generation (RAG) systems that needs only a single inserted document. The core idea inverts the usual assumption that a poisoned passage should avoid mentioning the correct answer: DenialRAG explicitly names the correct answer X, explains why it is wrong, and asserts an attacker-chosen answer Y inside the same short passage. The paper reports that this approach outperforms four published single-document attacks on all three datasets when the generator is Mistral-7B, with attack success rates of 89%, 94%, and 86%, and remains competitive on several other models. It argues that the embedded denial, not the bare assertion of Y, does the work, since removing it costs 17.1 percentage points of mean success. The broader claim is that RAG poisoning risk cannot be captured by a single attack family: effectiveness depends on the interaction between the poisoning mechanism and the target model.

What carries the argument

The embedded-denial passage: a four-part, at-most-100-word poisoned document that (1) opens by asserting the attacker's answer Y as definitive, (2) incorporates salient entities from the question for retrieval alignment, (3) explicitly names the correct answer X and gives a reason it should be rejected, and (4) closes by reaffirming Y with an authority-style detail. Its work is to make the X-versus-Y conflict self-contained: the model never has to weigh X against Y, because the passage has already settled the question in favor of Y before generation begins. The ablation identifies part (3) as the load-bearing component.

What would settle it

Re-run the Mistral-7B NQ, HotpotQA, and MS-MARCO evaluations with a stronger scoring rule that counts a success only when Y appears as the asserted answer (for example, not immediately preceded by 'not', 'incorrectly', or 'actually wrong'), and compare the resulting ASRs with the reported 89%, 94%, and 86%. A large drop would falsify the claim that the embedded denial makes the model adopt Y; instead it would mean the model often mentions Y while rejecting it.

Watch

Extended reading notes

Core claim

DenialRAG is a single-document, black-box attack on RAG question answering. From a target question, the correct answer X, and a wrong answer Y, two LLM calls produce a ≤100-word passage that opens by asserting Y, weaves in the question's salient terms, explicitly denies X with a reason earlier sources were wrong, and closes with an institutional citation. The mechanism is the embedded denial: the passage resolves the X-versus-Y conflict locally, so the generator sees the correct answer already acknowledged, discounted, and replaced. The paper's central claim is that this denial is the most influential component, removing it causes the largest drop (17.1-point mean), and that the attack reach

Load-bearing premise

The results assume the success metric truly captures the model adopting the attacker's answer: any response that contains the answer string Y, even "the answer is not 24, it is 23", counts as a successful attack, so if most matches are in fact rejections, the reported ASRs and every comparison built on them collapse.

Editorial extensions

If this is right

A single adversarial document can override the model's correct answer even when it openly contradicts it, on models as strong as Mistral-7B.
Explicit denial of the correct answer is the main driver of this attack; bare assertion of Y is weaker by a 17.1-point mean.
No tested inference-time defense is uniformly effective: each leaves residual attack success in at least one setting.
Attack ranking is model-dependent; for example, PIA-direct dominates on GPT-5.2 while CorruptRAG-AK dominates on GPT-5.5.
Retrieval depth and position within the context do not materially change DenialRAG's success on the two tested models.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A natural next test, not run in the paper, is whether responses like "the answer is not 24, it is 23" are being counted as a success; the strict substring match would count them, so the true adoption rate of Y could be lower than the reported 89–94%.
The same denial structure should transfer to other fact-asserting RAG tasks such as entity linking or timeline questions, because the mechanism acts on the internal X-versus-Y conflict rather than on any dataset-specific surface form.
The component ablation predicts that defenses which ask the model to cross-check against parametric knowledge will interact with denial position: since moving the denial later already weakens the attack, a skeptical prompt is likely to land harder on late-denial passages.
The stability result suggests an attack zoo: future RAG risk assessment should include at least one denial-style, one assertion-style, and one update-style poisoning document, since their frontier-model transfer curves differ.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The core idea here is genuinely new: instead of avoiding the correct answer X, DenialRAG names it, denies it, and resolves the conflict inside the poisoned passage. That is a real departure from PoisonedRAG, AuthChain, and CorruptRAG, and the systematic sweep across eight models, three datasets, and five defenses is more thorough than most attack papers. The ablation is also well designed and shows, on its own terms, that the denial component matters.

The problem is the success metric. The paper counts a response as successful if it merely contains the attacker-chosen answer Y via strict substring matching. Because DenialRAG explicitly names both X and Y, a model that rejects the attack can easily produce "the answer is not 24, it is 23"—which contains 24 and is scored as a success. Baselines that avoid X are less likely to elicit this kind of refutation mention, so the bias hits DenialRAG hardest. That means the headline numbers (89/94/86 on Mistral-7B) and the 17.1-point ablation drop could partly reflect mention frequency rather than genuine adoption of Y. The reader's stress-test note is correct, and the paper does not address it.

Other soft spots are more minor but worth listing. N=100 per cell with no confidence intervals or significance tests makes 1–2 percentage-point differences uninterpretable. The paper says it keeps only queries where the clean RAG system answers correctly but does not report how many were excluded, which matters for comparability. The attack-generation LLM is unnamed, and code/data are promised only after acceptance.

None of this kills the underlying idea. The mechanism is plausible and the framing is coherent. But the empirical support, as it stands, is not solid enough to accept the specific claims. I would want a re-run with a stricter criterion—for example, exact final-answer matching, or at least counting cases where the response explicitly rejects Y as failures.

Who is this for? Researchers working on RAG security and on evaluation methodology for poisoning attacks. It is a useful trigger for discussion of metric design, but I would not cite the numbers yet. Send it to peer review—it deserves a serious referee—but expect a major revision focused on the success criterion and uncertainty reporting.

Referee Report

4 major / 4 minor

Summary. The paper proposes DenialRAG, a single-document RAG corpus-poisoning attack in which one short (≤100-word) passage explicitly names the correct answer X, denies it, and asserts an attacker-chosen wrong answer Y, with the goal of steering the generator to output Y. The attack is evaluated on three BEIR QA datasets (NQ, HotpotQA, MS-MARCO), eight target LLMs, four published single-document attack baselines, and five inference-time defenses. The central empirical claims are that DenialRAG achieves the highest attack success rate on all three Mistral-7B datasets (89/94/86% ASR), remains competitive on several other models, and that the embedded denial is the most influential component, based on a component ablation showing a 17.1-percentage-point mean ASR drop when denial is removed. The paper also reports a stability analysis across cost-tier and frontier models and retrieval-depth/position sensitivity probes.

Significance. If the qualitative results survive re-measurement, the paper makes a useful contribution to the RAG-poisoning literature: it identifies a plausible attack mechanism—explicitly naming and refuting the correct answer inside the poisoned passage—that interacts non-trivially with model family, model tier, and defense strategy. The systematic sweep over models, baselines, and defenses is valuable, and the attack definition is clear and independent of the measured outcomes, so there is no circularity. However, the central quantitative claims rest on a success criterion that likely over-counts DenialRAG successes, so the currently reported magnitudes and comparative rankings are not established. The paper's strengths include a well-specified threat model, a large and clearly presented evaluation matrix, and a reproducible configuration (Contriever retriever, seed 12, T=0.1) that should allow the authors to re-score their traces.

major comments (4)

[§3.4, §5.1] The success criterion counts a response as successful if it contains the attacker-chosen answer Y via strict substring matching. This also counts responses that explicitly reject Y. For example, with X=23 and Y=24, a response such as "The answer is not 24; it is 23" contains the substring '24' and would be scored as a successful attack. Because DenialRAG's defining component is a passage that names Y and denies X, generated responses are likely to mention both values even when the model ultimately adopts X. Consequently, the headline ASRs (89/94/86% on Mistral-7B) and the comparative conclusions in Tables 1–3 do not establish that the model was steered to Y. The authors should re-score the generated responses with a negation-aware metric (e.g., excluding 'not Y' patterns or extracting the final answer), and separately report Y-mention and Y-adoption rates.
[§5.4, Table 3] The component ablation's main claim—that removing the denial causes the largest ASR drop (17.1 percentage points on average)—is confounded by the same substring metric. The denial sentence explicitly contains both X and Y and invites the model to mention Y in the course of refuting it. Removing the denial can therefore reduce Y-mention frequency without reducing genuine adoption of Y. The claim that the embedded denial is 'the most influential tested component' is unsupported until responses are classified by semantic adoption rather than by substring containment. This is particularly important because the ablation is used to argue that DenialRAG's mechanism is specifically the denial, not merely assertion of Y.
[§5.1, Tables 1–2] All ASR values are point estimates over N=100 queries with a single seed (seed 12) and temperature 0.1, and no confidence intervals or significance tests are reported. Many comparisons in the paper are small in magnitude, e.g., Table 1 NQ/GPT-4o-mini shows PIA-direct at 86% versus DenialRAG at 84%, and several 'highest' or 'competitive' claims rest on differences of a few points. The authors should report binomial confidence intervals and, where comparing attacks or defenses, use paired tests across the same 100 queries, or run multiple seeds. This is needed to support the paper's model-dependence claims beyond individual point estimates.
[§5.1, Tables 4–5] The main evaluation reports generator-side ASR but does not report how often the poisoned document is actually retrieved into the top-k context. A single-document poisoning attack is only meaningful end-to-end if the poisoned passage is retrieved with sufficiently high probability. Tables 4 and 5 explicitly condition on the poisoned passage being included in the retrieved set, so they do not address this. The authors should report the retrieval rate (fraction of queries for which the poisoned passage appears in the top-5) per dataset and model, since a high generator-side ASR combined with low retrieval would materially change the practical threat assessment.

minor comments (4)

[Table 1] The header contains a typo: 'RFFECTIVENESS' should be 'EFFECTIVENESS'.
[Table 1] Some cells appear without clear delimiters (e.g., '7789' in the NQ/Mistral-7B row). Use explicit spacing or cell boundaries in the camera-ready version.
[Figure 2] The figure caption refers to four 'colour-coded' parts, but the text is not visibly color-coded in the submitted version. Label the four components directly in the figure or remove the color reference.
[§5.1] The reproducibility statement says code and traces will be released after acceptance. For a security paper whose main evidence is empirical, a reviewable artifact or at least the exact prompt templates and a sample of scored traces should be made available to reviewers.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity found; DenialRAG is an empirical attack paper whose claims rest on external baselines and independent experimental evaluation.

full rationale

The paper does not present a derivation chain in which a predicted quantity is inferred from fitted inputs. DenialRAG is defined directly as a passage that names the correct answer X, denies it, and asserts an attacker-chosen answer Y; attack success is measured empirically by strict substring matching of Y in the generated response. The four baselines and five defenses are all published external systems, and there are no self-citations or imported uniqueness theorems. The validation step requiring the generated passage to contain Y and an explicit denial of X is part of the attack construction, not a fitted parameter later renamed as a prediction. The ablation removing the denial is a controlled comparison of passage variants, not a self-justifying redefinition of the attack. While the strict substring-match success criterion raises a legitimate measurement-validity concern, it is a correctness threat rather than circularity because the attack's definition and the measured outcome are not mutually constituting. Since no central claim reduces to its own input by construction, the circularity score is 0.

Assumptions & free parameters 3 free parameters · 2 assumptions · 0 invented entities

No new physical or conceptual entities are introduced. The paper's assumptions are standard LLM behavior and the competence of the attack-generation LLM, plus the experimental configuration choices listed above.

free parameters (3)

N = 100 target queries per dataset = 100
Chosen sample size for all cells; no power analysis or confidence intervals, so all ASR estimates have up to 5 percentage points standard error.
top_k = 5 retrieved passages = 5
Retriever depth chosen to match prior work, not fitted; affects whether the single poisoned document is retrieved.
temperature = 0.1 and seed = 12 = T=0.1, seed=12
Decoding and sampling settings, fixed to aid reproducibility; no sensitivity analysis is reported.

assumptions (2)

domain assumption Instruction-tuned LLMs tend to follow coherent retrieved context over conflicting parametric knowledge.
Sections 2.5 and 4.1 rely on this cited behavior to motivate why DenialRAG should work; if models were strongly parametric-faithful, the attack would fail.
domain assumption The unspecified attack-generation LLM can reliably produce passages following the four-part DenialRAG structure (open with Y, weave evidence, deny X, close with authority).
Section 4.3.2 relies on this capability; the validation step checks only for the presence of Y and a denial phrase, not the reliability of the generation model.

how reviews work

0 comments

Cite this review

Pith. "Pith review of DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denial." pith.science (2026). https://pith.science/paper/UJCG2HH6

@misc{pith2026260802678,
  author       = {Pith},
  title        = {Pith review of: DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denial},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/UJCG2HH6}},
  note         = {Machine review of arXiv:2608.02678}
}

read the original abstract

Retrieval-augmented generation (RAG) systems are vulnerable to corpus poisoning: an attacker who inserts a crafted document into the retrieval corpus can steer the underlying large language model (LLM) toward an attacker-chosen wrong answer. Prior single-document attacks typically avoid explicitly naming and refuting the correct answer inside the poisoned passage. In this paper, we examine a complementary design and propose \emph{DenialRAG}, a single-document poisoning attack that explicitly names the correct answer, denies it, and presents an attacker-controlled explanation for favoring the wrong answer. By placing both the correct answer and the corresponding poisoned answer inside the same retrieved passage, DenialRAG embeds the conflict directly into the context seen by the generator. We evaluate DenialRAG against four published single-document poisoning attacks across three open-domain question-answering datasets, eight target LLMs from four vendors, and five inference-time defenses. The results show that attack effectiveness is strongly model-dependent: DenialRAG achieves the highest attack success rate (ASR) on all three Mistral-7B datasets and remains effective on several other target LLMs, while other attacks dominate in some model regimes. Defense results show meaningful ASR reductions but non-uniform protection, with each defense leaving residual ASR in some settings. Component-level and cross-model analyses further identify the embedded denial as the most influential tested component and show that different poisoning mechanisms lose effectiveness at different rates across model groups. Together, these results show that RAG poisoning risk cannot be fully characterized by a single attack family or a single target model.

Figures

Figures reproduced from arXiv: 2608.02678 by the authors.

**Figure 1.** End-to-end DenialRAG attack pipeline. Top row (attack time, offline): the attacker holds only ⟨q, X, Y ⟩, i.e. the target question, the correct answer, and a chosen wrong answer. Two LLM calls produce one ≤ 100-word poisoned passage that names X and explicitly denies it; this passage is then inserted into the corpus K. Bottom row (query time, online): the user asks q; retriever R returns the top-k passages from K, w… view at source ↗

**Figure 2.** Anatomy of one DenialRAG passage. A single ≤ 100-word passage bundles four colour-coded parts that are referenced throughout the paper: (1) Opening statement (assert Y ), (2) Evidence weaving (the question’s entities), (3) Denial of X with a specific reason, and (4) Closing authority citation. The in-passage resolution of the X vs. Y conflict is what makes the attack potent: by the time G processes the retrieved con… view at source ↗

**Figure 3.** Attack stability across model regimes. Each attack is plotted by its mean ASR on the four cost-tier LLMs (filled marker) and the four frontier LLMs (open marker), averaged across the three datasets. The horizontal segment shows the ASR drop from cost-tier to frontier models. early. If the passage first asserts Y and delays the rejection of X, the model may have more opportunity to preserve or recover the correct ans… view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

28 extracted references · 22 canonical work pages

[1]

A survey of large language models,

W. X. Zhao, K. Zhou, J. Li, T. Tang, Z. Dong, Y . Hou, B. Zhang, Y . Min, J. Zhang, P. Liuet al., “A survey of large language models,” Frontiers of Computer Science, vol. 20, no. 12, p. 2012627, 2026

work page 2026
[2]

Large language models encode clinical knowledge,

K. Singhal, S. Azizi, T. Tu, S. S. Mahdavi, J. Wei, H. W. Chung, N. Scales, A. Tanwani, H. Cole-Lewis, S. Pfohlet al., “Large language models encode clinical knowledge,”Nature, vol. 620, no. 7972, pp. 172–180, 2023

work page 2023
[3]

When flue meets flang: Bench- marks and large pretrained language model for financial domain,

R. Shah, K. Chawla, D. Eidnani, A. Shah, W. Du, S. Chava, N. Raman, C. Smiley, J. Chen, and D. Yang, “When flue meets flang: Bench- marks and large pretrained language model for financial domain,” in Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, 2022, pp. 2322–2335

work page 2022
[4]

Retrieval- augmented generation for knowledge-intensive nlp tasks,

P. Lewis, E. Perez, A. Piktus, F. Petroni, V . Karpukhin, N. Goyal, H. K ¨uttler, M. Lewis, W.-t. Yih, T. Rockt ¨aschelet al., “Retrieval- augmented generation for knowledge-intensive nlp tasks,” vol. 33, 2020, pp. 9459–9474

work page 2020
[5]

{PoisonedRAG}: Knowledge corruption attacks to {Retrieval-Augmented} generation of large language models,

W. Zou, R. Geng, B. Wang, and J. Jia, “ {PoisonedRAG}: Knowledge corruption attacks to {Retrieval-Augmented} generation of large language models,” in34th USENIX Security Symposium (USENIX Security 25), 2025, pp. 3827–3844

work page 2025
[6]

Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection,

K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection,” pp. 79–90, 2023

work page 2023
[7]

Confusedpilot: Confused deputy risks in rag-based llms,

A. RoyChowdhury, M. Luo, P. Sahu, S. Banerjee, and M. Tiwari, “Confusedpilot: Confused deputy risks in rag-based llms,” 2024

work page 2024
[8]

Adversarial search engine optimization for large language models,

F. Nestaas, E. Debenedetti, and F. Tram `er, “Adversarial search engine optimization for large language models,” inInternational Conference on Learning Representations, vol. 2025, 2025, pp. 4857–4888

work page 2025

Show all 28 references

[9]

Poisoning retrieval corpora by injecting adversarial passages,

Z. Zhong, Z. Huang, A. Wettig, and D. Chen, “Poisoning retrieval corpora by injecting adversarial passages,” inProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, 2023, pp. 13 764–13 775

2023
[10]

Badrag: Identifying vulnerabilities in retrieval augmented generation of large language models. arxiv 2024,

J. Xue, M. Zheng, Y . Hu, F. Liu, X. Chen, and Q. Lou, “Badrag: Identifying vulnerabilities in retrieval augmented generation of large language models. arxiv 2024,”arXiv preprint arXiv:2406.00083

2024 arXiv
[11]

One shot dominance: Knowledge poisoning attack on retrieval-augmented generation systems

Z. Chang, M. Li, X. Jia, J. Wang, Y . Huang, Z. Jiang, Y . Liu, and Q. Wang, “One shot dominance: Knowledge poisoning attack on retrieval-augmented generation systems.” inEMNLP (Findings), 2025, pp. 18 811–18 825

2025
[12]

Practical poisoning attacks against retrieval-augmented generation,

B. Zhang, Y . Chen, Z. Liu, L. Nie, T. Li, Z. Liu, and M. Fang, “Practical poisoning attacks against retrieval-augmented generation,” in Proceedings of the 31st ACM Symposium on Access Control Models and Technologies, 2026, pp. 33–44

2026
[13]

Unsupervised dense information retrieval with con- trastive learning,

G. Izacard, M. Caron, L. Hosseini, S. Riedel, P. Bojanowski, A. Joulin, and E. Grave, “Unsupervised dense information retrieval with con- trastive learning,”arXiv preprint arXiv:2112.09118, 2021

2021 arXiv
[14]

Joint-gcg: Unified gradient-based poisoning attacks on retrieval-augmented generation systems,

H. Wang, R. Zhang, J. Wang, M. Li, Y . Huang, D. Wang, and Q. Wang, “Joint-gcg: Unified gradient-based poisoning attacks on retrieval-augmented generation systems,” inProceedings of the AAAI Conference on Artificial Intelligence, vol. 40, no. 42, 2026, pp. 35 793– 35 801

2026
[15]

Phantom: General trigger attacks on retrieval augmented language generation,

H. Chaudhari, G. Severi, J. Abascal, M. Jagielski, C. A. Choquette- Choo, M. Nasr, C. Nita-Rotaru, and A. Oprea, “Phantom: General trigger attacks on retrieval augmented language generation,” 2024

2024
[16]

Cpa-rag: Covert poisoning attacks on retrieval-augmented generation in large language models,

C. Li, J. Zhang, A. Cheng, Z. Ma, X. Li, and J. Ma, “Cpa-rag: Covert poisoning attacks on retrieval-augmented generation in large language models,”arXiv preprint arXiv:2505.19864, 2025

2025 arXiv
[17]

Adversarialcot: Single-document retrieval poisoning for llm reasoning,

H. Song, Y .-A. Liu, R. Zhang, J. Guo, M. de Rijke, Y . Fan, and X. Cheng, “Adversarialcot: Single-document retrieval poisoning for llm reasoning,”arXiv preprint arXiv:2604.12201, 2026. 11

2026 arXiv
[18]

Baseline defenses for adversarial attacks against aligned language models,

N. Jain, A. Schwarzschild, Y . Wen, G. Somepalli, J. Kirchenbauer, P.-y. Chiang, M. Goldblum, A. Saha, J. Geiping, and T. Goldstein, “Baseline defenses for adversarial attacks against aligned language models,”arXiv preprint arXiv:2309.00614, 2023

2023 arXiv
[19]

Instructrag: Instructing retrieval- augmented generation via self-synthesized rationales,

Z. Wei, W.-L. Chen, and Y . Meng, “Instructrag: Instructing retrieval- augmented generation via self-synthesized rationales,” inInternational Conference on Learning Representations, vol. 2025, 2025, pp. 82 731– 82 754

2025
[20]

Trustrag: Enhancing robustness and trustworthiness in retrieval-augmented generation,

H. Zhou, K.-H. Lee, Z. Zhan, Y . Chen, Z. Li, Z. Wang, H. Haddadi, and E. Yilmaz, “Trustrag: Enhancing robustness and trustworthiness in retrieval-augmented generation,”arXiv preprint arXiv:2501.00879, 2025

2025 arXiv
[21]

Certifiably robust rag against retrieval corruption,

C. Xiang, T. Wu, Z. Zhong, D. Wagner, D. Chen, and P. Mittal, “Certifiably robust rag against retrieval corruption,” 2024

2024
[22]

Astute rag: Overcoming imperfect retrieval augmentation and knowledge conflicts for large language models,

F. Wang, X. Wan, R. Sun, J. Chen, and S. O. Arik, “Astute rag: Overcoming imperfect retrieval augmentation and knowledge conflicts for large language models,” inProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 202...

2025
[23]

Adaptive chameleon or stubborn sloth: Revealing the behavior of large language models in knowledge conflicts,

J. Xie, K. Zhang, J. Chen, R. Lou, and Y . Su, “Adaptive chameleon or stubborn sloth: Revealing the behavior of large language models in knowledge conflicts,” inInternational Conference on Learning Representations, vol. 2024, 2024, pp. 35 623–35 646

2024
[24]

Investigating context faithfulness in large language models: The roles of memory strength and evidence style,

Y . Li, K. Zhou, Q. Qiao, B. Nguyen, Q. Wang, and Q. Li, “Investigating context faithfulness in large language models: The roles of memory strength and evidence style,” inFindings of the Association for Computational Linguistics: ACL 2025, 2025, pp. 4789–4807

2025
[25]

Context-faithful prompt- ing for large language models,

W. Zhou, S. Zhang, H. Poon, and M. Chen, “Context-faithful prompt- ing for large language models,” inFindings of the Association for Computational Linguistics: EMNLP 2023, 2023, pp. 14 544–14 556

2023
[26]

What is seen cannot be unseen: The disruptive effect of knowledge conflict on large language models,

K. Sun, F. Bai, and M. Dredze, “What is seen cannot be unseen: The disruptive effect of knowledge conflict on large language models,” arXiv e-prints, pp. arXiv–2506, 2025

2025
[27]

Redeep: Detecting hallucination in retrieval-augmented generation via mechanistic interpretability,

Z. Sun, X. Zang, K. Zheng, J. Xu, X. Zhang, W. Yu, Y . Song, and H. Li, “Redeep: Detecting hallucination in retrieval-augmented generation via mechanistic interpretability,” inInternational Conference on Learning Representations, vol. 2025, 2025, pp. 50 250–50 279

2025
[28]

Beir: A heterogenous benchmark for zero-shot evaluation of informa- tion retrieval models,

N. Thakur, N. Reimers, A. R ¨uckl´e, A. Srivastava, and I. Gurevych, “Beir: A heterogenous benchmark for zero-shot evaluation of informa- tion retrieval models,” 2021. 12

2021

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

A survey of large language models,

W. X. Zhao, K. Zhou, J. Li, T. Tang, Z. Dong, Y . Hou, B. Zhang, Y . Min, J. Zhang, P. Liuet al., “A survey of large language models,” Frontiers of Computer Science, vol. 20, no. 12, p. 2012627, 2026

work page 2026

[2] [2]

Large language models encode clinical knowledge,

K. Singhal, S. Azizi, T. Tu, S. S. Mahdavi, J. Wei, H. W. Chung, N. Scales, A. Tanwani, H. Cole-Lewis, S. Pfohlet al., “Large language models encode clinical knowledge,”Nature, vol. 620, no. 7972, pp. 172–180, 2023

work page 2023

[3] [3]

When flue meets flang: Bench- marks and large pretrained language model for financial domain,

R. Shah, K. Chawla, D. Eidnani, A. Shah, W. Du, S. Chava, N. Raman, C. Smiley, J. Chen, and D. Yang, “When flue meets flang: Bench- marks and large pretrained language model for financial domain,” in Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, 2022, pp. 2322–2335

work page 2022

[4] [4]

Retrieval- augmented generation for knowledge-intensive nlp tasks,

P. Lewis, E. Perez, A. Piktus, F. Petroni, V . Karpukhin, N. Goyal, H. K ¨uttler, M. Lewis, W.-t. Yih, T. Rockt ¨aschelet al., “Retrieval- augmented generation for knowledge-intensive nlp tasks,” vol. 33, 2020, pp. 9459–9474

work page 2020

[5] [5]

{PoisonedRAG}: Knowledge corruption attacks to {Retrieval-Augmented} generation of large language models,

W. Zou, R. Geng, B. Wang, and J. Jia, “ {PoisonedRAG}: Knowledge corruption attacks to {Retrieval-Augmented} generation of large language models,” in34th USENIX Security Symposium (USENIX Security 25), 2025, pp. 3827–3844

work page 2025

[6] [6]

Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection,

K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection,” pp. 79–90, 2023

work page 2023

[7] [7]

Confusedpilot: Confused deputy risks in rag-based llms,

A. RoyChowdhury, M. Luo, P. Sahu, S. Banerjee, and M. Tiwari, “Confusedpilot: Confused deputy risks in rag-based llms,” 2024

work page 2024

[8] [8]

Adversarial search engine optimization for large language models,

F. Nestaas, E. Debenedetti, and F. Tram `er, “Adversarial search engine optimization for large language models,” inInternational Conference on Learning Representations, vol. 2025, 2025, pp. 4857–4888

work page 2025