{"total":94,"rows":[{"id":"2402.07867","title":"PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models","created":"2024-02-12","cited_by_count":267,"area":"rag"},{"id":"2405.15556","title":"Certifiably Robust RAG against Retrieval Corruption","created":"2024-05-24","cited_by_count":151,"area":"rag"},{"id":"2406.05870","title":"Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents","created":"2024-06-09","cited_by_count":102,"area":"rag"},{"id":"2406.00083","title":"BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models","created":"2024-06-03","cited_by_count":86,"area":"rag"},{"id":"2409.10102","title":"Trustworthiness in Retrieval-Augmented Generation Systems: A Survey","created":"2024-09-16","cited_by_count":83,"area":"rag"},{"id":"2402.17840","title":"Follow My Instruction and Spill the Beans: Scalable Data Extraction from Retrieval-Augmented Generation Systems","created":"2024-02-27","cited_by_count":76,"area":"rag"},{"id":"2406.00799","title":"Get my drift? Catching LLM Task Drift with Activation Deltas","created":"2024-06-02","cited_by_count":72,"area":"rag"},{"id":"2305.01579","title":"Why So Gullible? Enhancing the Robustness of Retrieval-Augmented Models against Counterfactual Noise","created":"2023-05-02","cited_by_count":54,"area":"rag"},{"id":"2405.20485","title":"Phantom: General Backdoor Attacks on Retrieval Augmented Language Generation","created":"2024-05-30","cited_by_count":49,"area":"rag"},{"id":"2405.20446","title":"Is My Data in Your Retrieval Database? Membership Inference Attacks Against Retrieval Augmented Generation","created":"2024-05-30","cited_by_count":44,"area":"rag"},{"id":"2501.00879","title":"TrustRAG: Enhancing Robustness and Trustworthiness in Retrieval-Augmented Generation","created":"2025-01-01","cited_by_count":40,"area":"rag"},{"id":"2504.03957","title":"Practical Poisoning Attacks against Retrieval-Augmented Generation","created":"2025-04-04","cited_by_count":36,"area":"rag"},{"id":"2404.17196","title":"Human-Imperceptible Retrieval Poisoning Attacks in LLM-Powered Applications","created":"2024-04-26","cited_by_count":33,"area":"rag"},{"id":"2411.18948","title":"RevPRAG: Revealing Poisoning Attacks in Retrieval-Augmented Generation through LLM Activation Analysis","created":"2024-11-28","cited_by_count":33,"area":"rag"},{"id":"2502.01386","title":"Topic-FlipRAG: Topic-Orientated Adversarial Opinion Manipulation Attacks to Retrieval-Augmented Generation Models","created":"2025-02-03","cited_by_count":33,"area":"rag"},{"id":"2505.06311","title":"Defending against Indirect Prompt Injection by Instruction Detection","created":"2025-05-08","cited_by_count":32,"area":"rag"},{"id":"2502.06872","title":"Towards Trustworthy Retrieval Augmented Generation for Large Language Models: A Survey","created":"2025-02-08","cited_by_count":30,"area":"rag"},{"id":"2504.21668","title":"Traceback of Poisoning Attacks to Retrieval-Augmented Generation","created":"2025-04-30","cited_by_count":28,"area":"rag"},{"id":"2410.22832","title":"HijackRAG: Hijacking Attacks against Retrieval-Augmented Large Language Models","created":"2024-10-30","cited_by_count":27,"area":"rag"},{"id":"2504.18041","title":"RAG LLMs are Not Safer: A Safety Analysis of Retrieval-Augmented Generation for Large Language Models","created":"2025-04-25","cited_by_count":24,"area":"rag"},{"id":"2408.04870","title":"ConfusedPilot: Confused Deputy Risks in RAG-based LLMs","created":"2024-08-09","cited_by_count":22,"area":"rag"},{"id":"2410.14479","title":"Backdoored Retrievers for Prompt Injection Attacks on Retrieval Augmented Generation of Large Language Models","created":"2024-10-18","cited_by_count":22,"area":"rag"},{"id":"2412.20953","title":"GASLITEing the Retrieval: Exploring Vulnerabilities in Dense Embedding-based Search","created":"2024-12-30","cited_by_count":20,"area":"rag"},{"id":"2410.22954","title":"Retrieval-Augmented Generation with Estimation of Source Reliability","created":"2024-10-30","cited_by_count":19,"area":"rag"},{"id":"2509.23519","title":"ReliabilityRAG: Effective and Provably Robust Defense for RAG-based Web-Search","created":"2025-09-27","cited_by_count":18,"area":"rag"},{"id":"2408.05025","title":"Rag and Roll: An End-to-End Evaluation of Indirect Prompt Manipulations in LLM-based Application Frameworks","created":"2024-08-09","cited_by_count":17,"area":"rag"},{"id":"2603.22928","title":"SoK: The Attack Surface of Agentic AI - Tools and Autonomy","created":"2026-03-24","cited_by_count":16,"area":"rag"},{"id":"2510.09710","title":"SeCon-RAG: A Two-Stage Semantic Filtering and Conflict-Free Framework for Trustworthy RAG","created":"2025-10-10","cited_by_count":13,"area":"rag"},{"id":"2503.21315","title":"Tricking Retrievers with Influential Tokens: An Efficient Black-Box Corpus Poisoning Attack","created":"2025-03-27","cited_by_count":10,"area":"rag"},{"id":"2505.07546","title":"GRADA: Graph-based Reranking against Adversarial Documents Attack","created":"2025-05-12","cited_by_count":10,"area":"rag"},{"id":"2510.13842","title":"ADMIT: Few-shot Knowledge Poisoning Attacks on RAG-based Fact Checking","created":"2025-10-11","cited_by_count":10,"area":"rag"},{"id":"2509.20324","title":"RAG Security and Privacy: Formalizing the Threat Model and Attack Surface","created":"2025-09-24","cited_by_count":8,"area":"rag"},{"id":"2508.03793","title":"AttnTrace: Contextual Attribution of Prompt Injection and Knowledge Corruption","created":"2025-08-05","cited_by_count":7,"area":"rag"},{"id":"2510.21144","title":"NeuroGenPoisoning: Neuron-Guided Attacks on Retrieval-Augmented Generation of LLM via Genetic Optimization of External Knowledge","created":"2025-10-24","cited_by_count":7,"area":"rag"},{"id":"2509.03787","title":"Evaluating the Robustness of Retrieval-Augmented Generation to Adversarial Evidence in the Health Domain","created":"2025-09-04","cited_by_count":6,"area":"rag"},{"id":"2604.27707","title":"Contextual Agentic Memory is a Memo, Not True Memory","created":"2026-04-30","cited_by_count":6,"area":"rag"},{"id":"2505.16014","title":"Ranking Free RAG: Replacing Re-ranking with Selection in RAG for Sensitive Domains","created":"2025-05-21","cited_by_count":5,"area":"rag"},{"id":"2508.11158","title":"Role-Augmented Intent-Driven Generative Search Engine Optimization","created":"2025-08-15","cited_by_count":5,"area":"rag"},{"id":"2601.10923","title":"Hidden-in-Plain-Text: A Benchmark for Social-Web Indirect Prompt Injection in RAG","created":"2026-01-16","cited_by_count":5,"area":"rag"},{"id":"2402.14480","title":"MeTMaP: Metamorphic Testing for Detecting False Vector Matching Problems in LLM Augmented Generation","created":"2024-02-22","cited_by_count":4,"area":"rag"},{"id":"2505.13506","title":"EcoSafeRAG: Efficient Security through Context Analysis in Retrieval-Augmented Generation","created":"2025-05-16","cited_by_count":4,"area":"rag"},{"id":"2510.11195","title":"RAG-Pull: Turning Retrieval into a Code-Injection Channel via Invisible Unicode Perturbations","created":"2025-10-13","cited_by_count":4,"area":"rag"},{"id":"2512.08289","title":"MIRAGE: Misleading Retrieval-Augmented Generation via Black-box and Query-agnostic Poisoning Attacks","created":"2025-12-09","cited_by_count":4,"area":"rag"},{"id":"2505.08728","title":"Securing RAG: A Risk Assessment and Mitigation Framework","created":"2025-05-13","cited_by_count":3,"area":"rag"},{"id":"2506.04390","title":"Through the Stealth Lens: Attention-Aware Defenses Against Poisoning in RAG","created":"2025-06-04","cited_by_count":3,"area":"rag"},{"id":"2508.18652","title":"UniC-RAG: Universal Knowledge Corruption Attacks to Retrieval-Augmented Generation","created":"2025-08-26","cited_by_count":3,"area":"rag"},{"id":"2512.01335","title":"EmoRAG: Evaluating RAG Robustness to Symbolic Perturbations","created":"2025-12-01","cited_by_count":3,"area":"rag"},{"id":"2508.20083","title":"DisarmRAG: Stealthy Retriever-Centric Poisoning to Disable Self-Correction in Retrieval-Augmented Generation (Extended Version)","created":"2025-08-27","cited_by_count":2,"area":"rag"},{"id":"2511.04080","title":"Caption Injection for Optimization in Generative Search Engine","created":"2025-11-06","cited_by_count":2,"area":"rag"},{"id":"2512.00804","title":"Epistemic Bias Injection: Manipulating LLM Opinion via Selective Context Retrieval","created":"2025-11-30","cited_by_count":2,"area":"rag"},{"id":"2602.22427","title":"Adversarial Hubness Detector: Detecting Hubness Poisoning in Retrieval-Augmented Generation Systems","created":"2026-02-25","cited_by_count":2,"area":"rag"},{"id":"2604.08304","title":"Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directions","created":"2026-04-09","cited_by_count":2,"area":"rag"},{"id":"2605.27157","title":"Detecting Is Not Resolving: The Monitoring Control Gap in Retrieval Augmented LLMs","created":"2026-05-26","cited_by_count":2,"area":"rag"},{"id":"2512.21681","title":"Exploring the Security Threats of Retriever Backdoors in Retrieval-Augmented Code Generation","created":"2025-12-25","cited_by_count":1,"area":"rag"},{"id":"2601.15528","title":"Securing LLM-as-a-Service for Small Businesses: An Industry Case Study of a Distributed Chatbot Deployment Platform","created":"2026-01-21","cited_by_count":1,"area":"rag"},{"id":"2602.09616","title":"With Argus Eyes: Assessing Retrieval Gaps via Uncertainty Scoring to Detect and Remedy Retrieval Blind Spots","created":"2026-02-10","cited_by_count":1,"area":"rag"},{"id":"2603.11501","title":"KEPo: Knowledge Evolution Poison on Graph-based Retrieval-Augmented Generation","created":"2026-03-12","cited_by_count":1,"area":"rag"},{"id":"2603.25164","title":"PIDP-Attack: Combining Prompt Injection with Database Poisoning Attacks on Retrieval-Augmented Generation Systems","created":"2026-03-26","cited_by_count":1,"area":"rag"},{"id":"2605.00505","title":"LLM-Oriented Information Retrieval: A Denoising-First Perspective","created":"2026-05-01","cited_by_count":1,"area":"rag"},{"id":"2605.01782","title":"Needle-in-RAG: Prompt-Conditioned Character-Level Traceback of Poisoned Spans in Retrieved Evidence","created":"2026-05-03","cited_by_count":1,"area":"rag"},{"id":"2605.07269","title":"MIPIAD: Multilingual Indirect Prompt Injection Attack Defense with Qwen -- TF-IDF Hybrid and Meta-Ensemble Learning","created":"2026-05-08","cited_by_count":1,"area":"rag"},{"id":"2605.29491","title":"The Curse of Helpfulness: Inverse Scaling Law in Robustness to Distractor Instructions via DistractionIF","created":"2026-05-28","cited_by_count":1,"area":"rag"},{"id":"2606.09005","title":"Document-Authored Control-Signal Impersonation: A Low-Cost Indirect Prompt Attack on RAG Safety Boundaries","created":"2026-06-08","cited_by_count":1,"area":"rag"},{"id":"2606.18310","title":"Conflict-Aware Retriever Editing for Knowledge Injection Attacks on LLM-Based RAG Systems","created":"2026-06-16","cited_by_count":1,"area":"rag"},{"id":"2606.18497","title":"Ghost Vectors: Soft-Deleted Embeddings Remain Reconstructible in HNSW Vector Databases","created":"2026-06-16","cited_by_count":1,"area":"rag"},{"id":"2607.00012","title":"PRA-RAG: Provably Robust Aggregation in Retrieval-Augmented Generation against Retrieval Corruption","created":"2026-05-08","cited_by_count":1,"area":"rag"},{"id":"2608.06947","title":"When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapse","created":"2026-08-07","cited_by_count":1,"area":"rag"},{"id":"2601.05260","title":"Quantifying Document Impact in RAG-LLMs","created":"2025-10-27","cited_by_count":0,"area":"rag"},{"id":"2603.17292","title":"SEAL-Tag: Self-Tag Evidence Aggregation with Probabilistic Circuits for PII-Safe Retrieval-Augmented Generation","created":"2026-03-18","cited_by_count":0,"area":"rag"},{"id":"2604.18663","title":"Beyond Explicit Refusals: Soft-Failure Attacks on Retrieval-Augmented Generation","created":"2026-04-20","cited_by_count":0,"area":"rag"},{"id":"2604.28157","title":"FlashRT: Towards Computationally and Memory Efficient Red-Teaming for Prompt Injection and Knowledge Corruption","created":"2026-04-30","cited_by_count":0,"area":"rag"},{"id":"2605.00460","title":"CleanBase: Detecting Malicious Documents in RAG Knowledge Databases","created":"2026-05-01","cited_by_count":0,"area":"rag"},{"id":"2605.01078","title":"A Sentence Relation-Based Approach to Sanitizing Malicious Instructions","created":"2026-05-01","cited_by_count":0,"area":"rag"},{"id":"2605.11217","title":"Training-Free Refusal of MCP Exploits via Retrieval-Augmented Generation","created":"2026-05-11","cited_by_count":0,"area":"rag"},{"id":"2606.24402","title":"Poisoned Playbooks: Demystifying Knowledge Poisoning Effects on AI Security Agents","created":"2026-06-23","cited_by_count":0,"area":"rag"},{"id":"2606.26793","title":"MIRROR: Novelty-Constrained Memory-Guided MCTS Red-Teaming for Agentic RAG","created":"2026-06-25","cited_by_count":0,"area":"rag"},{"id":"2607.20437","title":"TopoGuard: Graph Theory Based Defenses Against Split-Knowledge Attacks on RAG","created":"2026-05-11","cited_by_count":0,"area":"rag"},{"id":"2607.23838","title":"TriShieldRAG: 3 Rings, One Blind Spot in Layered Defenses for Retrieval-Augmented Generation","created":"2026-07-26","cited_by_count":0,"area":"rag"},{"id":"2608.00054","title":"RAG-TESTER: Automated End-to-End Testing of Retrieval-Augmented Large Language Models","created":"2026-07-26","cited_by_count":0,"area":"rag"},{"id":"2608.07458","title":"CoinRAG: Contextualized Information Nugget KV Cache Reuse for Long-Context RAG","created":"2026-08-07","cited_by_count":0,"area":"rag"},{"id":"2608.08100","title":"Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injection","created":"2026-08-08","cited_by_count":0,"area":"rag"},{"id":"2608.16044","title":"Coverage Is Not Containment: A Fundamental Limit of Admission-Time Defenses Against Coordinated Poisoning of Vector Retrieval","created":"2026-08-17","cited_by_count":0,"area":"rag"},{"id":"2608.21095","title":"Trustworthy RAG: An Evaluation Agent for Detecting Misinformation and Knowledge Poisoning in Generative AI Systems","created":"2026-08-21","cited_by_count":0,"area":"rag"},{"id":"2608.23965","title":"RAGSentinel: Certifiable Geometric Consensus for Robust Retrieval-Augmented Generation","created":"2026-08-25","cited_by_count":0,"area":"rag"},{"id":"2608.25880","title":"Beyond the Editing Canvas: Evidence Divergence in OOXML-to-LLM Ingestion","created":"2026-08-26","cited_by_count":0,"area":"rag"},{"id":"2609.00470","title":"TRIS: A Tri-Layer Retrieval Integrity Sieve Against Knowledge Poisoning","created":"2026-08-31","cited_by_count":0,"area":"rag"},{"id":"2609.00479","title":"EGT-KG: Evidence-Grounded Typed KG Retrieval for Practical Scientific QA with Small Language Models","created":"2026-08-31","cited_by_count":0,"area":"rag"},{"id":"2609.09243","title":"In RAG We Trust? Measuring Robustness of Retrieval-Augmented Generation Under Document Poisoning","created":"2026-09-08","cited_by_count":0,"area":"rag"},{"id":"2609.11082","title":"ToxicRAG: Compromising Retrieval-Augmented Generation Systems via Single-Shot Knowledge Poisoning Attacks","created":"2026-09-10","cited_by_count":0,"area":"rag"},{"id":"2609.15660","title":"CiteShade: Citation Laundering in Multi-Source Retrieval-Augmented Generation and Its Counterfactual Defense","created":"2026-09-14","cited_by_count":0,"area":"rag"},{"id":"2609.25469","title":"RAG-NAROK: Retrieval-Aware Knowledge Corpus Poisoning in RAG with Source-specific Refutation","created":"2026-09-21","cited_by_count":0,"area":"rag"},{"id":"2609.36376","title":"Quantization Enables Private Dense Retrieval against Malicious Service Providers","created":"2026-09-28","cited_by_count":0,"area":"rag"},{"id":"2609.36611","title":"Multi-Channel Mitigation of Source-Trust Shortcuts in Fact-Checking RL Agents","created":"2026-09-29","cited_by_count":0,"area":"rag"},{"id":"2610.19549","title":"GraphRAG-LTM: A Layered Threat Modeling Framework for Attacks on Graph Retrieval-Augmented Generation","created":"2026-10-14","cited_by_count":0,"area":"rag"}],"next_cursor":null}