{"total":267,"rows":[{"id":"2501.00309","title":"Retrieval-Augmented Generation with Graphs (GraphRAG)","created":"2024-12-31","cited_by_count":172,"area":"rag"},{"id":"2405.15556","title":"Certifiably Robust RAG against Retrieval Corruption","created":"2024-05-24","cited_by_count":151,"area":"rag"},{"id":"2504.01990","title":"Advances and Challenges in Foundation Agents: From Brain-Inspired Intelligence to Evolutionary, Collaborative, and Safe Systems","created":"2025-03-31","cited_by_count":126,"area":"agents"},{"id":"2504.15585","title":"A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deployment","created":"2025-04-22","cited_by_count":116,"area":"lr"},{"id":"2409.10102","title":"Trustworthiness in Retrieval-Augmented Generation Systems: A Survey","created":"2024-09-16","cited_by_count":83,"area":"rag"},{"id":"2406.00799","title":"Get my drift? Catching LLM Task Drift with Activation Deltas","created":"2024-06-02","cited_by_count":72,"area":"rag"},{"id":"2512.16962","title":"MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval","created":"2025-12-18","cited_by_count":72,"area":"rag"},{"id":"2502.05206","title":"Safety at Scale: A Comprehensive Survey of Large Model and Agent Safety","created":"2025-02-02","cited_by_count":67,"area":"mllm"},{"id":"2411.09523","title":"Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agents","created":"2024-11-14","cited_by_count":65,"area":"agents"},{"id":"2504.13079","title":"Retrieval-Augmented Generation with Conflicting Evidence","created":"2025-04-17","cited_by_count":63,"area":"rag"},{"id":"2506.23260","title":"From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflows","created":"2025-06-29","cited_by_count":58,"area":"agents"},{"id":"2506.19676","title":"A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures","created":"2025-06-24","cited_by_count":57,"area":"agents"},{"id":"2602.15654","title":"Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections","created":"2026-02-17","cited_by_count":48,"area":"agents"},{"id":"2604.03081","title":"Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems","created":"2026-04-03","cited_by_count":45,"area":"agents"},{"id":"2601.05504","title":"Memory Poisoning Attack and Defense on Memory Based LLM-Agents","created":"2026-01-09","cited_by_count":44,"area":"agents"},{"id":"2502.01386","title":"Topic-FlipRAG: Topic-Orientated Adversarial Opinion Manipulation Attacks to Retrieval-Augmented Generation Models","created":"2025-02-03","cited_by_count":33,"area":"rag"},{"id":"2501.11759","title":"Poison-RAG: Adversarial Data Poisoning Attacks on Retrieval-Augmented Generation in Recommender Systems","created":"2025-01-20","cited_by_count":32,"area":"rag"},{"id":"2601.17548","title":"Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystems","created":"2026-01-24","cited_by_count":31,"area":"agents"},{"id":"2506.13666","title":"We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systems","created":"2025-06-16","cited_by_count":27,"area":"agents"},{"id":"2510.02554","title":"ToolTweak: An Attack on Tool Selection in LLM-based Agents","created":"2025-10-02","cited_by_count":26,"area":"agents"},{"id":"2501.14050","title":"GraphRAG under Fire","created":"2025-01-23","cited_by_count":24,"area":"rag"},{"id":"2503.16248","title":"Real AI Agents with Fake Memories: Fatal Context Manipulation Attacks on Web3 Agents","created":"2025-03-20","cited_by_count":24,"area":"safety"},{"id":"2604.02623","title":"Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents","created":"2026-04-03","cited_by_count":24,"area":"agents"},{"id":"2510.16724","title":"A Comprehensive Survey on Reinforcement Learning-based Agentic Search: Foundations, Roles, Optimizations, Evaluations, and Applications","created":"2025-10-19","cited_by_count":22,"area":"rag"},{"id":"2504.14891","title":"Retrieval Augmented Generation Evaluation in the Era of Large Language Models: A Comprehensive Survey","created":"2025-04-21","cited_by_count":20,"area":"rag"},{"id":"2510.14005","title":"PIShield: Detecting Prompt Injection Attacks via Intrinsic LLM Features","created":"2025-10-15","cited_by_count":20,"area":"safety"},{"id":"2602.12194","title":"MalTool: Malicious Tool Attacks on LLM Agents","created":"2026-02-12","cited_by_count":20,"area":"agents"},{"id":"2604.04759","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","created":"2026-04-06","cited_by_count":20,"area":"agents"},{"id":"2510.25025","title":"Secure Retrieval-Augmented Generation against Poisoning Attacks","created":"2025-10-28","cited_by_count":19,"area":"rag"},{"id":"2509.23519","title":"ReliabilityRAG: Effective and Provably Robust Defense for RAG-based Web-Search","created":"2025-09-27","cited_by_count":18,"area":"rag"},{"id":"2512.09321","title":"ObliInjection: Order-Oblivious Prompt Injection Attack to LLM Agents with Multi-source Data","created":"2025-12-10","cited_by_count":18,"area":"agents"},{"id":"2606.24322","title":"Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees","created":"2026-06-23","cited_by_count":18,"area":"agents"},{"id":"2510.01645","title":"Position: Privacy Is Not Just Memorization!","created":"2025-10-02","cited_by_count":17,"area":null},{"id":"2601.04566","title":"BackdoorAgent: A Unified Framework for Backdoor Attacks on LLM-based Agents","created":"2026-01-08","cited_by_count":16,"area":"agents"},{"id":"2603.19469","title":"A Framework for Formalizing LLM Agent Security","created":"2026-03-19","cited_by_count":16,"area":"agents"},{"id":"2505.12567","title":"A Survey of Attacks on Large Language Models","created":"2025-05-18","cited_by_count":15,"area":"agents"},{"id":"2602.11327","title":"Security Threat Modeling for Emerging AI-Agent Protocols: A Comparative Analysis of MCP, A2A, Agora, and ANP","created":"2026-02-11","cited_by_count":15,"area":"agents"},{"id":"2605.14473","title":"Does RAG Know When Retrieval Is Wrong? Diagnosing Context Compliance under Knowledge Conflict","created":"2026-05-14","cited_by_count":15,"area":"rag"},{"id":"2505.06493","title":"System Prompt Poisoning: Persistent Attacks on Large Language Models Beyond User Injection","created":"2025-05-10","cited_by_count":14,"area":"safety"},{"id":"2605.03378","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","created":"2026-05-05","cited_by_count":14,"area":"agents"},{"id":"2506.04202","title":"TracLLM: A Generic Framework for Attributing Long Context LLMs","created":"2025-06-04","cited_by_count":13,"area":null},{"id":"2510.09710","title":"SeCon-RAG: A Two-Stage Semantic Filtering and Conflict-Free Framework for Trustworthy RAG","created":"2025-10-10","cited_by_count":13,"area":"rag"},{"id":"2512.01295","title":"Systems Security Foundations for Agentic Computing","created":"2025-12-01","cited_by_count":13,"area":"agents"},{"id":"2503.06254","title":"Poisoned-MRAG: Knowledge Poisoning Attacks to Multimodal Retrieval Augmented Generation","created":"2025-03-08","cited_by_count":12,"area":"lr"},{"id":"2508.02835","title":"Defending Against Knowledge Poisoning Attacks During Retrieval-Augmented Generation","created":"2025-08-04","cited_by_count":11,"area":"rag"},{"id":"2604.23338","title":"A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Layered Attack Surface Framework","created":"2026-04-25","cited_by_count":11,"area":"agents"},{"id":"2510.13842","title":"ADMIT: Few-shot Knowledge Poisoning Attacks on RAG-based Fact Checking","created":"2025-10-11","cited_by_count":10,"area":"rag"},{"id":"2511.05797","title":"When AI Meets the Web: Prompt Injection Risks in Third-Party AI Chatbot Plugins","created":"2025-11-08","cited_by_count":9,"area":"safety"},{"id":"2608.05179","title":"Autonomous Research Agents: A Survey of AI Scientists and the Verification Gap","created":"2026-06-29","cited_by_count":9,"area":"agents"},{"id":"2504.00147","title":"Universal Zero-shot Embedding Inversion","created":"2025-03-31","cited_by_count":8,"area":null},{"id":"2504.02132","title":"One Pic is All it Takes: Poisoning Visual Document Retrieval Augmented Generation with a Single Image","created":"2025-04-02","cited_by_count":8,"area":"rag"},{"id":"2506.11415","title":"Bias Amplification in RAG: Poisoning Knowledge Retrieval to Steer LLMs","created":"2025-06-13","cited_by_count":8,"area":"rag"},{"id":"2509.20324","title":"RAG Security and Privacy: Formalizing the Threat Model and Attack Surface","created":"2025-09-24","cited_by_count":8,"area":"rag"},{"id":"2602.19555","title":"SOK: A Taxonomy of Attack Vectors and Defense Strategies for Agentic Supply Chain Runtime","created":"2026-02-23","cited_by_count":8,"area":"agents"},{"id":"2603.07379","title":"SoK: Agentic Retrieval-Augmented Generation (RAG): Taxonomy, Architectures, Evaluation, and Research Directions","created":"2026-03-07","cited_by_count":8,"area":"lr"},{"id":"2607.05029","title":"Your Agent's Memories Are Not Its Own: Forged Reasoning Attacks on LLM Agent Memory and Defenses","created":"2026-07-06","cited_by_count":8,"area":"lr"},{"id":"2505.15753","title":"Scalable Defense against In-the-wild Jailbreaking Attacks with Safety Context Retrieval","created":"2025-05-21","cited_by_count":7,"area":"safety"},{"id":"2507.06323","title":"Bridging AI and Software Security: A Comparative Vulnerability Assessment of LLM Agent Deployment Paradigms","created":"2025-07-08","cited_by_count":7,"area":"agents"},{"id":"2508.03793","title":"AttnTrace: Contextual Attribution of Prompt Injection and Knowledge Corruption","created":"2025-08-05","cited_by_count":7,"area":"rag"},{"id":"2510.18333","title":"Position: LLM Watermarking Should Align Stakeholders' Incentives for Practical Adoption","created":"2025-10-21","cited_by_count":7,"area":"safety"},{"id":"2510.21144","title":"NeuroGenPoisoning: Neuron-Guided Attacks on Retrieval-Augmented Generation of LLM via Genetic Optimization of External Knowledge","created":"2025-10-24","cited_by_count":7,"area":"rag"},{"id":"2601.03979","title":"SoK: Privacy Risks and Mitigations in Retrieval-Augmented Generation Systems","created":"2026-01-07","cited_by_count":7,"area":"rag"},{"id":"2605.17830","title":"Remembering More, Risking More: Longitudinal Safety Risks in Memory-Equipped LLM Agents","created":"2026-05-18","cited_by_count":7,"area":"agents"},{"id":"2410.22339","title":"DAWN: Designing Distributed Agents in a Worldwide Network","created":"2024-10-11","cited_by_count":6,"area":"agents"},{"id":"2505.06579","title":"POISONCRAFT: Practical Poisoning of Retrieval-Augmented Generation for Large Language Models","created":"2025-05-10","cited_by_count":6,"area":"rag"},{"id":"2505.16367","title":"Chain-of-Thought Poisoning Attacks against R1-based Retrieval-Augmented Generation Systems","created":"2025-05-22","cited_by_count":6,"area":"lr"},{"id":"2509.03787","title":"Evaluating the Robustness of Retrieval-Augmented Generation to Adversarial Evidence in the Health Domain","created":"2025-09-04","cited_by_count":6,"area":"rag"},{"id":"2509.24240","title":"Takedown: How It's Done in Modern Coding Agent Exploits","created":"2025-09-29","cited_by_count":6,"area":"agents"},{"id":"2604.01350","title":"No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents","created":"2026-04-01","cited_by_count":6,"area":"agents"},{"id":"2604.27707","title":"Contextual Agentic Memory is a Memo, Not True Memory","created":"2026-04-30","cited_by_count":6,"area":"rag"},{"id":"2605.17641","title":"Causal Intervention-Based Memory Selection for Long-Horizon LLM Agents","created":"2026-05-17","cited_by_count":6,"area":"agents"},{"id":"2410.21330","title":"LLM Robustness Against Misinformation in Biomedical Question Answering","created":"2024-10-27","cited_by_count":5,"area":"rag"},{"id":"2503.06950","title":"CtrlRAG: Black-box Document Poisoning Attacks for Retrieval-Augmented Generation of Large Language Models","created":"2025-03-10","cited_by_count":5,"area":"rag"},{"id":"2504.14858","title":"Retrieval is Not Enough: Enhancing RAG Reasoning through Test-Time Critique and Optimization","created":"2025-04-21","cited_by_count":5,"area":"lr"},{"id":"2504.20769","title":"Chain-of-Defensive-Thought: Structured Reasoning Elicits Robustness in Large Language Models against Reference Corruption","created":"2025-04-29","cited_by_count":5,"area":"lr"},{"id":"2505.16014","title":"Ranking Free RAG: Replacing Re-ranking with Selection in RAG for Sensitive Domains","created":"2025-05-21","cited_by_count":5,"area":"rag"},{"id":"2510.10008","title":"RIPRAG: Hack a Black-box Retrieval-Augmented Generation Question-Answering System with Reinforcement Learning","created":"2025-10-11","cited_by_count":5,"area":"lr"},{"id":"2510.16558","title":"A First Look at the Security Issues in the Model Context Protocol Ecosystem","created":"2025-10-18","cited_by_count":5,"area":"agents"},{"id":"2602.06616","title":"Confundo: Learning to Generate Robust Poison for Practical RAG Systems","created":"2026-02-06","cited_by_count":5,"area":"rag"},{"id":"2602.19547","title":"CIBER: A Comprehensive Benchmark for Security Evaluation of Code Interpreter Agents","created":"2026-02-23","cited_by_count":5,"area":"agents"},{"id":"2603.15408","title":"TrinityGuard: A Unified Framework for Safeguarding Multi-Agent Systems","created":"2026-03-16","cited_by_count":5,"area":"agents"},{"id":"2603.20933","title":"AC4A: Access Control for Agents","created":"2026-03-21","cited_by_count":5,"area":"agents"},{"id":"2605.09594","title":"Trust Me, Import This: Dependency Steering Attacks via Malicious Agent Skills","created":"2026-05-10","cited_by_count":5,"area":"agents"},{"id":"2606.14154","title":"SkillMutator: Benchmarking and Defending Language-and-Code Cross-modal Attacks on LLM Agent Skills","created":"2026-06-12","cited_by_count":5,"area":"agents"},{"id":"2507.06850","title":"The Dark Side of LLMs: Agent-based Attack Vectors for System-level Compromise","created":"2025-07-09","cited_by_count":4,"area":"agents"},{"id":"2509.23694","title":"SafeSearch: Automated Red-Teaming of LLM-Based Search Agents","created":"2025-09-28","cited_by_count":4,"area":"agents"},{"id":"2510.11195","title":"RAG-Pull: Turning Retrieval into a Code-Injection Channel via Invisible Unicode Perturbations","created":"2025-10-13","cited_by_count":4,"area":"rag"},{"id":"2510.12119","title":"ImageSentinel: Protecting Visual Datasets from Unauthorized Retrieval-Augmented Image Generation","created":"2025-10-14","cited_by_count":4,"area":"safety"},{"id":"2512.08289","title":"MIRAGE: Misleading Retrieval-Augmented Generation via Black-box and Query-agnostic Poisoning Attacks","created":"2025-12-09","cited_by_count":4,"area":"rag"},{"id":"2601.11199","title":"SD-RAG: A Prompt-Injection-Resilient Framework for Selective Disclosure in Retrieval-Augmented Generation","created":"2026-01-16","cited_by_count":4,"area":"rag"},{"id":"2603.21642","title":"Are AI-assisted Development Tools Immune to Prompt Injection?","created":"2026-03-23","cited_by_count":4,"area":"safety"},{"id":"2604.25562","title":"SnapGuard: Lightweight Prompt Injection Detection for Screenshot-Based Web Agents","created":"2026-04-28","cited_by_count":4,"area":"agents"},{"id":"2605.24245","title":"Deep-Research Agents Can Be Poisoned via User-Generated Content","created":"2026-05-22","cited_by_count":4,"area":"agents"},{"id":"2606.01166","title":"BraveGuard: From Open-World Threats to Safer Computer-Use Agents","created":"2026-05-31","cited_by_count":4,"area":"agents"},{"id":"2505.08728","title":"Securing RAG: A Risk Assessment and Mitigation Framework","created":"2025-05-13","cited_by_count":3,"area":"rag"},{"id":"2506.03535","title":"Across Programming Language Silos: A Study on Cross-Lingual Retrieval-augmented Code Generation","created":"2025-06-04","cited_by_count":3,"area":"rag"},{"id":"2510.05310","title":"RAG Makes Guardrails Unsafe? Investigating Robustness of Guardrails under RAG-style Contexts","created":"2025-10-06","cited_by_count":3,"area":"safety"},{"id":"2511.15435","title":"HV-Attack: Hierarchical Visual Attack for Multimodal Retrieval Augmented Generation","created":"2025-11-19","cited_by_count":3,"area":"mllm"},{"id":"2512.24268","title":"RAGPart & RAGMask: Retrieval-Stage Defenses Against Corpus Poisoning in Retrieval-Augmented Generation","created":"2025-12-30","cited_by_count":3,"area":"rag"},{"id":"2601.10758","title":"Agents at Risk: How Users Unwittingly Undermine LLM Safety","created":"2026-01-14","cited_by_count":3,"area":"agents"}],"next_cursor":"100"}