{"total":159,"rows":[{"id":"2407.12784","title":"AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases","created":"2024-07-17","cited_by_count":429,"area":"agents"},{"id":"2410.02644","title":"Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents","created":"2024-10-03","cited_by_count":369,"area":"agents"},{"id":"2402.07867","title":"PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models","created":"2024-02-12","cited_by_count":267,"area":"rag"},{"id":"2405.15556","title":"Certifiably Robust RAG against Retrieval Corruption","created":"2024-05-24","cited_by_count":151,"area":"rag"},{"id":"2406.12814","title":"Dissecting Adversarial Robustness of Multimodal LM Agents","created":"2024-06-18","cited_by_count":120,"area":"agents"},{"id":"2504.15585","title":"A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deployment","created":"2025-04-22","cited_by_count":116,"area":"lr"},{"id":"2406.05870","title":"Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents","created":"2024-06-09","cited_by_count":102,"area":"rag"},{"id":"2406.13629","title":"InstructRAG: Instructing Retrieval-Augmented Generation via Self-Synthesized Rationales","created":"2024-06-19","cited_by_count":101,"area":"rag"},{"id":"2503.09648","title":"A Survey on Trustworthy LLM Agents: Threats and Countermeasures","created":"2025-03-12","cited_by_count":96,"area":"agents"},{"id":"2406.00083","title":"BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models","created":"2024-06-03","cited_by_count":86,"area":"rag"},{"id":"2409.10102","title":"Trustworthiness in Retrieval-Augmented Generation Systems: A Survey","created":"2024-09-16","cited_by_count":83,"area":"rag"},{"id":"2502.05174","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","created":"2025-02-07","cited_by_count":77,"area":"agents"},{"id":"2502.05206","title":"Safety at Scale: A Comprehensive Survey of Large Model and Agent Safety","created":"2025-02-02","cited_by_count":67,"area":"mllm"},{"id":"2404.13948","title":"Typos that Broke the RAG's Back: Genetic Attack on RAG Pipeline by Simulating Documents in the Wild via Low-level Perturbations","created":"2024-04-22","cited_by_count":65,"area":"rag"},{"id":"2410.15999","title":"Steering Knowledge Selection Behaviours in LLMs via SAE-Based Representation Engineering","created":"2024-10-21","cited_by_count":63,"area":"mechinterp"},{"id":"2406.19417","title":"\"Glue pizza and eat rocks\" -- Exploiting Vulnerabilities in Retrieval-Augmented Generative Models","created":"2024-06-26","cited_by_count":60,"area":"rag"},{"id":"2506.19676","title":"A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures","created":"2025-06-24","cited_by_count":57,"area":"agents"},{"id":"2405.20485","title":"Phantom: General Backdoor Attacks on Retrieval Augmented Language Generation","created":"2024-05-30","cited_by_count":49,"area":"rag"},{"id":"2405.20446","title":"Is My Data in Your Retrieval Database? Membership Inference Attacks Against Retrieval Augmented Generation","created":"2024-05-30","cited_by_count":44,"area":"rag"},{"id":"2501.00879","title":"TrustRAG: Enhancing Robustness and Trustworthiness in Retrieval-Augmented Generation","created":"2025-01-01","cited_by_count":40,"area":"rag"},{"id":"2504.03957","title":"Practical Poisoning Attacks against Retrieval-Augmented Generation","created":"2025-04-04","cited_by_count":36,"area":"rag"},{"id":"2411.18948","title":"RevPRAG: Revealing Poisoning Attacks in Retrieval-Augmented Generation through LLM Activation Analysis","created":"2024-11-28","cited_by_count":33,"area":"rag"},{"id":"2502.01386","title":"Topic-FlipRAG: Topic-Orientated Adversarial Opinion Manipulation Attacks to Retrieval-Augmented Generation Models","created":"2025-02-03","cited_by_count":33,"area":"rag"},{"id":"2501.18636","title":"SafeRAG: Benchmarking Security in Retrieval-Augmented Generation of Large Language Model","created":"2025-01-28","cited_by_count":32,"area":"rag"},{"id":"2504.07717","title":"PR-Attack: Coordinated Prompt-RAG Attacks on Retrieval-Augmented Generation in Large Language Models via Bilevel Optimization","created":"2025-04-10","cited_by_count":32,"area":"rag"},{"id":"2502.06872","title":"Towards Trustworthy Retrieval Augmented Generation for Large Language Models: A Survey","created":"2025-02-08","cited_by_count":30,"area":"rag"},{"id":"2510.23883","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","created":"2025-10-27","cited_by_count":28,"area":"agents"},{"id":"2603.11088","title":"The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey","created":"2026-03-11","cited_by_count":28,"area":"agents"},{"id":"2506.13666","title":"We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systems","created":"2025-06-16","cited_by_count":27,"area":"agents"},{"id":"2604.06811","title":"SkillTrojan: Backdoor Attacks on Skill-Based Agent Systems","created":"2026-04-08","cited_by_count":25,"area":"agents"},{"id":"2501.14050","title":"GraphRAG under Fire","created":"2025-01-23","cited_by_count":24,"area":"rag"},{"id":"2504.18041","title":"RAG LLMs are Not Safer: A Safety Analysis of Retrieval-Augmented Generation for Large Language Models","created":"2025-04-25","cited_by_count":24,"area":"rag"},{"id":"2402.10196","title":"A Trembling House of Cards? Mapping Adversarial Attacks against Language Agents","created":"2024-02-15","cited_by_count":22,"area":"agents"},{"id":"2406.05087","title":"Corpus Poisoning via Approximate Greedy Gradient Descent","created":"2024-06-07","cited_by_count":21,"area":"rag"},{"id":"2412.20953","title":"GASLITEing the Retrieval: Exploring Vulnerabilities in Dense Embedding-based Search","created":"2024-12-30","cited_by_count":20,"area":"rag"},{"id":"2410.22954","title":"Retrieval-Augmented Generation with Estimation of Source Reliability","created":"2024-10-30","cited_by_count":19,"area":"rag"},{"id":"2509.03888","title":"False Sense of Security: Why Probing-based Malicious Input Detection Fails to Generalize","created":"2025-09-04","cited_by_count":19,"area":null},{"id":"2505.18543","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","created":"2025-05-24","cited_by_count":18,"area":"rag"},{"id":"2408.05025","title":"Rag and Roll: An End-to-End Evaluation of Indirect Prompt Manipulations in LLM-based Application Frameworks","created":"2024-08-09","cited_by_count":17,"area":"rag"},{"id":"2410.16090","title":"Analysing the Residual Stream of Language Models Under Knowledge Conflicts","created":"2024-10-21","cited_by_count":17,"area":null},{"id":"2505.19864","title":"CPA-RAG:Covert Poisoning Attacks on Retrieval-Augmented Generation in Large Language Models","created":"2025-05-26","cited_by_count":17,"area":"rag"},{"id":"2410.02163","title":"Adversarial Decoding: Generating Readable Documents for Adversarial Objectives","created":"2024-10-03","cited_by_count":16,"area":"safety"},{"id":"2503.05037","title":"Collapse of Dense Retrievers: Short, Early, and Literal Biases Outranking Factual Evidence","created":"2025-03-06","cited_by_count":16,"area":"rag"},{"id":"2601.07072","title":"Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systems","created":"2026-01-11","cited_by_count":16,"area":"safety"},{"id":"2407.06992","title":"Robust Neural Information Retrieval: An Adversarial and Out-of-distribution Perspective","created":"2024-07-09","cited_by_count":15,"area":null},{"id":"2311.09069","title":"How Well Do Large Language Models Truly Ground?","created":"2023-11-15","cited_by_count":14,"area":null},{"id":"2402.13532","title":"Backdoor Attacks on Dense Retrieval via Public and Unintentional Triggers","created":"2024-02-21","cited_by_count":14,"area":null},{"id":"2409.17275","title":"On the Vulnerability of Applying Retrieval-Augmented Generation within Knowledge-Intensive Application Domains","created":"2024-09-12","cited_by_count":14,"area":"rag"},{"id":"2412.16708","title":"Towards More Robust Retrieval-Augmented Generation: Evaluating RAG Under Adversarial Poisoning Attacks","created":"2024-12-21","cited_by_count":14,"area":"rag"},{"id":"2506.04202","title":"TracLLM: A Generic Framework for Attributing Long Context LLMs","created":"2025-06-04","cited_by_count":13,"area":null},{"id":"2510.09710","title":"SeCon-RAG: A Two-Stage Semantic Filtering and Conflict-Free Framework for Trustworthy RAG","created":"2025-10-10","cited_by_count":13,"area":"rag"},{"id":"2503.06254","title":"Poisoned-MRAG: Knowledge Poisoning Attacks to Multimodal Retrieval Augmented Generation","created":"2025-03-08","cited_by_count":12,"area":"lr"},{"id":"2509.13772","title":"Who Taught the Lie? Responsibility Attribution for Poisoned Knowledge in Retrieval-Augmented Generation","created":"2025-09-17","cited_by_count":12,"area":"rag"},{"id":"2404.00486","title":"Dialectical Alignment: Resolving the Tension of 3H and Security Threats of LLMs","created":"2024-03-30","cited_by_count":11,"area":"alignment"},{"id":"2407.13757","title":"Black-Box Opinion Manipulation Attacks to Retrieval-Augmented Generation of Large Language Models","created":"2024-07-18","cited_by_count":11,"area":"rag"},{"id":"2508.02835","title":"Defending Against Knowledge Poisoning Attacks During Retrieval-Augmented Generation","created":"2025-08-04","cited_by_count":11,"area":"rag"},{"id":"2503.21315","title":"Tricking Retrievers with Influential Tokens: An Efficient Black-Box Corpus Poisoning Attack","created":"2025-03-27","cited_by_count":10,"area":"rag"},{"id":"2505.07546","title":"GRADA: Graph-based Reranking against Adversarial Documents Attack","created":"2025-05-12","cited_by_count":10,"area":"rag"},{"id":"2402.12784","title":"Understanding and Mitigating the Threat of Vec2Text to Dense Retrieval Systems","created":"2024-02-20","cited_by_count":9,"area":null},{"id":"2506.11415","title":"Bias Amplification in RAG: Poisoning Knowledge Retrieval to Steer LLMs","created":"2025-06-13","cited_by_count":8,"area":"rag"},{"id":"2602.19555","title":"SOK: A Taxonomy of Attack Vectors and Defense Strategies for Agentic Supply Chain Runtime","created":"2026-02-23","cited_by_count":8,"area":"agents"},{"id":"2607.05029","title":"Your Agent's Memories Are Not Its Own: Forged Reasoning Attacks on LLM Agent Memory and Defenses","created":"2026-07-06","cited_by_count":8,"area":"lr"},{"id":"2501.04802","title":"Reproducing HotFlip for Corpus Poisoning Attacks in Dense Retrieval","created":"2025-01-08","cited_by_count":7,"area":null},{"id":"2505.15753","title":"Scalable Defense against In-the-wild Jailbreaking Attacks with Safety Context Retrieval","created":"2025-05-21","cited_by_count":7,"area":"safety"},{"id":"2508.03793","title":"AttnTrace: Contextual Attribution of Prompt Injection and Knowledge Corruption","created":"2025-08-05","cited_by_count":7,"area":"rag"},{"id":"2510.21144","title":"NeuroGenPoisoning: Neuron-Guided Attacks on Retrieval-Augmented Generation of LLM via Genetic Optimization of External Knowledge","created":"2025-10-24","cited_by_count":7,"area":"rag"},{"id":"2601.17887","title":"When Personalization Legitimizes Risks: Uncovering Safety Vulnerabilities in Personalized Dialogue Agents","created":"2026-01-25","cited_by_count":7,"area":"agents"},{"id":"2505.06579","title":"POISONCRAFT: Practical Poisoning of Retrieval-Augmented Generation for Large Language Models","created":"2025-05-10","cited_by_count":6,"area":"rag"},{"id":"2504.20769","title":"Chain-of-Defensive-Thought: Structured Reasoning Elicits Robustness in Large Language Models against Reference Corruption","created":"2025-04-29","cited_by_count":5,"area":"lr"},{"id":"2507.18202","title":"Safeguarding RAG Pipelines with GMTP: A Gradient-based Masked Token Probability Method for Poisoned Document Detection","created":"2025-07-24","cited_by_count":5,"area":"rag"},{"id":"2509.15159","title":"AIP: Subverting Retrieval-Augmented Generation via Adversarial Instructional Prompt","created":"2025-09-18","cited_by_count":5,"area":"rag"},{"id":"2602.15344","title":"ER-MIA: Black-Box Adversarial Memory Injection Attacks on Long-Term Memory-Augmented Large Language Models","created":"2026-02-17","cited_by_count":5,"area":null},{"id":"2503.08644","title":"Exploiting Instruction-Following Retrievers for Malicious Information Retrieval","created":"2025-03-11","cited_by_count":4,"area":null},{"id":"2510.11195","title":"RAG-Pull: Turning Retrieval into a Code-Injection Channel via Invisible Unicode Perturbations","created":"2025-10-13","cited_by_count":4,"area":"rag"},{"id":"2408.14830","title":"PolicyLR: A Logic Representation For Privacy Policies","created":"2024-08-27","cited_by_count":3,"area":null},{"id":"2504.21680","title":"Hoist with His Own Petard: Inducing Guardrails to Facilitate Denial-of-Service Attacks on Retrieval-Augmented Generation of LLMs","created":"2025-04-30","cited_by_count":3,"area":"rag"},{"id":"2505.12655","title":"Web Intellectual Property at Risk: Preventing Unauthorized Real-Time Retrieval by Large Language Models","created":"2025-05-19","cited_by_count":3,"area":null},{"id":"2506.04390","title":"Through the Stealth Lens: Attention-Aware Defenses Against Poisoning in RAG","created":"2025-06-04","cited_by_count":3,"area":"rag"},{"id":"2508.18652","title":"UniC-RAG: Universal Knowledge Corruption Attacks to Retrieval-Augmented Generation","created":"2025-08-26","cited_by_count":3,"area":"rag"},{"id":"2512.01335","title":"EmoRAG: Evaluating RAG Robustness to Symbolic Perturbations","created":"2025-12-01","cited_by_count":3,"area":"rag"},{"id":"2512.24268","title":"RAGPart & RAGMask: Retrieval-Stage Defenses Against Corpus Poisoning in Retrieval-Augmented Generation","created":"2025-12-30","cited_by_count":3,"area":"rag"},{"id":"2601.15678","title":"Connect the Dots: Knowledge Graph-Guided Crawler Attack on Retrieval-Augmented Generation Systems","created":"2026-01-22","cited_by_count":3,"area":"rag"},{"id":"2602.04711","title":"Addressing Corpus Knowledge Poisoning Attacks on RAG Using Sparse Attention","created":"2026-02-04","cited_by_count":3,"area":"rag"},{"id":"2605.21948","title":"SCI-Defense: Defending Manipulation Attacks from Generative Engine Optimization","created":"2026-05-21","cited_by_count":3,"area":null},{"id":"2605.23196","title":"Prompt Overflow: What the Guardrail Inspects Is Not What the Model Infers","created":"2026-05-22","cited_by_count":3,"area":"safety"},{"id":"2405.17130","title":"Explaining the role of Intrinsic Dimensionality in Adversarial Training","created":"2024-05-27","cited_by_count":2,"area":null},{"id":"2406.10746","title":"SparseCL: Sparse Contrastive Learning for Contradiction Retrieval","created":"2024-06-15","cited_by_count":2,"area":null},{"id":"2602.19844","title":"LLM-enabled Applications Require System-Level Threat Monitoring","created":"2026-02-23","cited_by_count":2,"area":null},{"id":"2603.22934","title":"ProGRank: Probe-Gradient Reranking to Defend Dense-Retriever RAG from Corpus Poisoning","created":"2026-03-24","cited_by_count":2,"area":"rag"},{"id":"2605.27157","title":"Detecting Is Not Resolving: The Monitoring Control Gap in Retrieval Augmented LLMs","created":"2026-05-26","cited_by_count":2,"area":"rag"},{"id":"2605.28104","title":"Defending LLM-based Multi-Agent Systems Against Cooperative Attacks with Sentence-Level Rectification","created":"2026-05-27","cited_by_count":2,"area":"agents"},{"id":"2607.15657","title":"Do Agents Dream of False Memories? Black-box Visual Attacks on Long-term Memory in Multimodal AI Agents","created":"2026-07-17","cited_by_count":2,"area":"agents"},{"id":"2607.26843","title":"When Knowledge Changes: Metamorphic Testing of RAG Systems with Mutations","created":"2026-07-29","cited_by_count":2,"area":"rag"},{"id":"2507.01752","title":"Tuning without Peeking: Provable Generalization Bounds and Robust LLM Post-Training","created":"2025-07-02","cited_by_count":1,"area":"safety"},{"id":"2510.00586","title":"Eyes-on-Me: Scalable RAG Poisoning through Transferable Attention-Steering Attractors","created":"2025-10-01","cited_by_count":1,"area":"rag"},{"id":"2601.23094","title":"Safer Policy Compliance with Dynamic Epistemic Fallback","created":"2026-01-30","cited_by_count":1,"area":null},{"id":"2602.08668","title":"Retrieval Pivot Attacks in Hybrid RAG: Measuring and Mitigating Amplified Leakage from Vector Seeds to Graph Expansion","created":"2026-02-09","cited_by_count":1,"area":"rag"},{"id":"2602.09616","title":"With Argus Eyes: Assessing Retrieval Gaps via Uncertainty Scoring to Detect and Remedy Retrieval Blind Spots","created":"2026-02-10","cited_by_count":1,"area":"rag"},{"id":"2603.11501","title":"KEPo: Knowledge Evolution Poison on Graph-based Retrieval-Augmented Generation","created":"2026-03-12","cited_by_count":1,"area":"rag"},{"id":"2603.25164","title":"PIDP-Attack: Combining Prompt Injection with Database Poisoning Attacks on Retrieval-Augmented Generation Systems","created":"2026-03-26","cited_by_count":1,"area":"rag"}],"next_cursor":"100"}