{"total":102,"rows":[{"id":"2504.01990","title":"Advances and Challenges in Foundation Agents: From Brain-Inspired Intelligence to Evolutionary, Collaborative, and Safe Systems","created":"2025-03-31","cited_by_count":126,"area":"agents"},{"id":"2409.10102","title":"Trustworthiness in Retrieval-Augmented Generation Systems: A Survey","created":"2024-09-16","cited_by_count":83,"area":"rag"},{"id":"2512.16962","title":"MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval","created":"2025-12-18","cited_by_count":72,"area":"rag"},{"id":"2502.16580","title":"Can Indirect Prompt Injection Attacks Be Detected and Removed?","created":"2025-02-23","cited_by_count":52,"area":"safety"},{"id":"2406.18382","title":"Adversarial Search Engine Optimization for Large Language Models","created":"2024-06-26","cited_by_count":40,"area":null},{"id":"2411.00459","title":"Defense Against Prompt Injection Attack by Leveraging Attack Techniques","created":"2024-11-01","cited_by_count":40,"area":"safety"},{"id":"2501.00879","title":"TrustRAG: Enhancing Robustness and Trustworthiness in Retrieval-Augmented Generation","created":"2025-01-01","cited_by_count":40,"area":"rag"},{"id":"2504.03957","title":"Practical Poisoning Attacks against Retrieval-Augmented Generation","created":"2025-04-04","cited_by_count":36,"area":"rag"},{"id":"2502.01386","title":"Topic-FlipRAG: Topic-Orientated Adversarial Opinion Manipulation Attacks to Retrieval-Augmented Generation Models","created":"2025-02-03","cited_by_count":33,"area":"rag"},{"id":"2501.18636","title":"SafeRAG: Benchmarking Security in Retrieval-Augmented Generation of Large Language Model","created":"2025-01-28","cited_by_count":32,"area":"rag"},{"id":"2409.08045","title":"Unleashing Worms and Extracting Data: Escalating the Outcome of Attacks against RAG-based Inference in Scale and Severity Using Jailbreaking","created":"2024-09-12","cited_by_count":30,"area":"safety"},{"id":"2504.21668","title":"Traceback of Poisoning Attacks to Retrieval-Augmented Generation","created":"2025-04-30","cited_by_count":28,"area":"rag"},{"id":"2505.11548","title":"One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems","created":"2025-05-15","cited_by_count":28,"area":"rag"},{"id":"2501.02968","title":"FlippedRAG: Black-Box Opinion Manipulation Adversarial Attacks to Retrieval-Augmented Generation Models","created":"2025-01-06","cited_by_count":25,"area":"rag"},{"id":"2501.14050","title":"GraphRAG under Fire","created":"2025-01-23","cited_by_count":24,"area":"rag"},{"id":"2502.17832","title":"MM-PoisonRAG: Disrupting Multimodal RAG with Local and Global Poisoning Attacks","created":"2025-02-25","cited_by_count":24,"area":"mllm"},{"id":"2504.18041","title":"RAG LLMs are Not Safer: A Safety Analysis of Retrieval-Augmented Generation for Large Language Models","created":"2025-04-25","cited_by_count":24,"area":"rag"},{"id":"2412.20953","title":"GASLITEing the Retrieval: Exploring Vulnerabilities in Dense Embedding-based Search","created":"2024-12-30","cited_by_count":20,"area":"rag"},{"id":"2504.14891","title":"Retrieval Augmented Generation Evaluation in the Era of Large Language Models: A Comprehensive Survey","created":"2025-04-21","cited_by_count":20,"area":"rag"},{"id":"2410.22954","title":"Retrieval-Augmented Generation with Estimation of Source Reliability","created":"2024-10-30","cited_by_count":19,"area":"rag"},{"id":"2510.25025","title":"Secure Retrieval-Augmented Generation against Poisoning Attacks","created":"2025-10-28","cited_by_count":19,"area":"rag"},{"id":"2505.18543","title":"Benchmarking Poisoning Attacks against Retrieval-Augmented Generation","created":"2025-05-24","cited_by_count":18,"area":"rag"},{"id":"2505.19864","title":"CPA-RAG:Covert Poisoning Attacks on Retrieval-Augmented Generation in Large Language Models","created":"2025-05-26","cited_by_count":17,"area":"rag"},{"id":"2507.13686","title":"TopicAttack: An Indirect Prompt Injection Attack via Topic Transition","created":"2025-07-18","cited_by_count":17,"area":"safety"},{"id":"2409.15398","title":"Attack Atlas: A Practitioner's Perspective on Challenges and Pitfalls in Red Teaming GenAI","created":"2024-09-23","cited_by_count":16,"area":"safety"},{"id":"2410.02163","title":"Adversarial Decoding: Generating Readable Documents for Adversarial Objectives","created":"2024-10-03","cited_by_count":16,"area":"safety"},{"id":"2504.20472","title":"Robustness via Referencing: Defending against Prompt Injection Attacks by Referencing the Executed Instruction","created":"2025-04-29","cited_by_count":16,"area":"safety"},{"id":"2601.07072","title":"Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systems","created":"2026-01-11","cited_by_count":16,"area":"safety"},{"id":"2603.22928","title":"SoK: The Attack Surface of Agentic AI - Tools and Autonomy","created":"2026-03-24","cited_by_count":16,"area":"rag"},{"id":"2502.20995","title":"The RAG Paradox: A Black-Box Attack Exploiting Unintentional Vulnerabilities in Retrieval-Augmented Generation Systems","created":"2025-02-28","cited_by_count":14,"area":"rag"},{"id":"2506.04202","title":"TracLLM: A Generic Framework for Attributing Long Context LLMs","created":"2025-06-04","cited_by_count":13,"area":null},{"id":"2510.09710","title":"SeCon-RAG: A Two-Stage Semantic Filtering and Conflict-Free Framework for Trustworthy RAG","created":"2025-10-10","cited_by_count":13,"area":"rag"},{"id":"2503.06254","title":"Poisoned-MRAG: Knowledge Poisoning Attacks to Multimodal Retrieval Augmented Generation","created":"2025-03-08","cited_by_count":12,"area":"lr"},{"id":"2509.13772","title":"Who Taught the Lie? Responsibility Attribution for Poisoned Knowledge in Retrieval-Augmented Generation","created":"2025-09-17","cited_by_count":12,"area":"rag"},{"id":"2503.01742","title":"Building Safe GenAI Applications: An End-to-End Overview of Red Teaming for Large Language Models","created":"2025-03-03","cited_by_count":11,"area":"safety"},{"id":"2511.01268","title":"Rescuing the Unpoisoned: Efficient Defense against Knowledge Corruption Attacks on RAG Systems","created":"2025-11-03","cited_by_count":9,"area":"rag"},{"id":"2504.00147","title":"Universal Zero-shot Embedding Inversion","created":"2025-03-31","cited_by_count":8,"area":null},{"id":"2504.02132","title":"One Pic is All it Takes: Poisoning Visual Document Retrieval Augmented Generation with a Single Image","created":"2025-04-02","cited_by_count":8,"area":"rag"},{"id":"2408.05061","title":"A Jailbroken GenAI Model Can Cause Substantial Harm: GenAI-powered Applications are Vulnerable to PromptWares","created":"2024-08-09","cited_by_count":7,"area":"safety"},{"id":"2508.03793","title":"AttnTrace: Contextual Attribution of Prompt Injection and Knowledge Corruption","created":"2025-08-05","cited_by_count":7,"area":"rag"},{"id":"2510.21144","title":"NeuroGenPoisoning: Neuron-Guided Attacks on Retrieval-Augmented Generation of LLM via Genetic Optimization of External Knowledge","created":"2025-10-24","cited_by_count":7,"area":"rag"},{"id":"2601.03979","title":"SoK: Privacy Risks and Mitigations in Retrieval-Augmented Generation Systems","created":"2026-01-07","cited_by_count":7,"area":"rag"},{"id":"2604.27202","title":"Indirect Prompt Injection in the Wild: An Empirical Study of Prevalence, Techniques, and Objectives","created":"2026-04-29","cited_by_count":6,"area":"safety"},{"id":"2509.07941","title":"ImportSnare: Directed \"Code Manual\" Hijacking in Retrieval-Augmented Code Generation","created":"2025-09-09","cited_by_count":5,"area":"rag"},{"id":"2510.09871","title":"CoBia: Constructed Conversations Can Trigger Otherwise Concealed Societal Biases in LLMs","created":"2025-10-10","cited_by_count":5,"area":"safety"},{"id":"2602.06616","title":"Confundo: Learning to Generate Robust Poison for Practical RAG Systems","created":"2026-02-06","cited_by_count":5,"area":"rag"},{"id":"2505.13506","title":"EcoSafeRAG: Efficient Security through Context Analysis in Retrieval-Augmented Generation","created":"2025-05-16","cited_by_count":4,"area":"rag"},{"id":"2507.06850","title":"The Dark Side of LLMs: Agent-based Attack Vectors for System-level Compromise","created":"2025-07-09","cited_by_count":4,"area":"agents"},{"id":"2508.04276","title":"A Few Words Can Distort Graphs: Knowledge Poisoning Attacks on Graph-based Retrieval-Augmented Generation of Large Language Models","created":"2025-08-06","cited_by_count":4,"area":"rag"},{"id":"2509.20851","title":"Poisoning Prompt-Guided Sampling in Video Large Language Models","created":"2025-09-25","cited_by_count":4,"area":null},{"id":"2509.23694","title":"SafeSearch: Automated Red-Teaming of LLM-Based Search Agents","created":"2025-09-28","cited_by_count":4,"area":"agents"},{"id":"2512.08289","title":"MIRAGE: Misleading Retrieval-Augmented Generation via Black-box and Query-agnostic Poisoning Attacks","created":"2025-12-09","cited_by_count":4,"area":"rag"},{"id":"2603.03919","title":"When Safety Becomes a Vulnerability: Exploiting LLM Alignment Homogeneity for Transferable Blocking in RAG","created":"2026-03-04","cited_by_count":4,"area":"rag"},{"id":"2504.21680","title":"Hoist with His Own Petard: Inducing Guardrails to Facilitate Denial-of-Service Attacks on Retrieval-Augmented Generation of LLMs","created":"2025-04-30","cited_by_count":3,"area":"rag"},{"id":"2505.13581","title":"RAR: Setting Knowledge Tripwires for Retrieval Augmented Rejection","created":"2025-05-19","cited_by_count":3,"area":"rag"},{"id":"2508.18652","title":"UniC-RAG: Universal Knowledge Corruption Attacks to Retrieval-Augmented Generation","created":"2025-08-26","cited_by_count":3,"area":"rag"},{"id":"2510.03705","title":"Backdoor-Powered Prompt Injection Attacks Nullify Defense Methods","created":"2025-10-04","cited_by_count":3,"area":"safety"},{"id":"2601.15678","title":"Connect the Dots: Knowledge Graph-Guided Crawler Attack on Retrieval-Augmented Generation Systems","created":"2026-01-22","cited_by_count":3,"area":"rag"},{"id":"2605.03482","title":"MEMSAD: Gradient-Coupled Anomaly Detection for Memory Poisoning in Retrieval-Augmented Agents","created":"2026-05-05","cited_by_count":3,"area":"rag"},{"id":"2605.23196","title":"Prompt Overflow: What the Guardrail Inspects Is Not What the Model Infers","created":"2026-05-22","cited_by_count":3,"area":"safety"},{"id":"2508.20083","title":"DisarmRAG: Stealthy Retriever-Centric Poisoning to Disable Self-Correction in Retrieval-Augmented Generation (Extended Version)","created":"2025-08-27","cited_by_count":2,"area":"rag"},{"id":"2604.08304","title":"Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directions","created":"2026-04-09","cited_by_count":2,"area":"rag"},{"id":"2605.12729","title":"Large Language Models for Agentic NetOps and AIOps: Architectures, Evaluation, and Safety","created":"2026-05-12","cited_by_count":2,"area":"agents"},{"id":"2605.27157","title":"Detecting Is Not Resolving: The Monitoring Control Gap in Retrieval Augmented LLMs","created":"2026-05-26","cited_by_count":2,"area":"rag"},{"id":"2606.08661","title":"Data Agents Under Attack: Vulnerabilities in LLM-Driven Analytical Systems","created":"2026-06-07","cited_by_count":2,"area":"agents"},{"id":"2606.21842","title":"Agent-Assisted Side-Channel Attacks on Non-Prefix KV Cache in RAG","created":"2026-06-20","cited_by_count":2,"area":"rag"},{"id":"2508.10404","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","created":"2025-08-14","cited_by_count":1,"area":"safety"},{"id":"2511.05919","title":"Injecting Falsehoods: Adversarial Man-in-the-Middle Attacks Undermining Factual Recall in LLMs","created":"2025-11-08","cited_by_count":1,"area":null},{"id":"2512.15790","title":"Bilevel Optimization for Covert Memory Tampering in Heterogeneous Multi-Agent Architectures (XAMT)","created":"2025-12-15","cited_by_count":1,"area":"agents"},{"id":"2605.00505","title":"LLM-Oriented Information Retrieval: A Denoising-First Perspective","created":"2026-05-01","cited_by_count":1,"area":"rag"},{"id":"2605.01782","title":"Needle-in-RAG: Prompt-Conditioned Character-Level Traceback of Poisoned Spans in Retrieved Evidence","created":"2026-05-03","cited_by_count":1,"area":"rag"},{"id":"2606.01212","title":"DiscourseFlip: An Oblique Discourse-Level Opinion Manipulation Attack against Black-box Retrieval-Augmented Generation","created":"2026-05-31","cited_by_count":1,"area":"rag"},{"id":"2607.00012","title":"PRA-RAG: Provably Robust Aggregation in Retrieval-Augmented Generation against Retrieval Corruption","created":"2026-05-08","cited_by_count":1,"area":"rag"},{"id":"2608.04626","title":"Blockchain Empowered Trustworthy Agent Networks: Foundations, Taxonomy, and Future Directions","created":"2026-08-05","cited_by_count":1,"area":"agents"},{"id":"2609.04135","title":"The Natural Language Interaction Protocol and Standard for AI Agents","created":"2026-09-03","cited_by_count":1,"area":null},{"id":"2609.15516","title":"Misleading the Planner through Deceptive Resumes: Registration-Time Injection in Centralized Multi-Agent Systems","created":"2026-09-14","cited_by_count":1,"area":"agents"},{"id":"2508.01084","title":"Provably Secure Retrieval-Augmented Generation","created":"2025-08-01","cited_by_count":0,"area":"rag"},{"id":"2508.02296","title":"Knowing When Not to Answer: Lightweight KB-Aligned OOD Detection for Safe RAG","created":"2025-08-04","cited_by_count":0,"area":"rag"},{"id":"2602.06495","title":"Graphs Don't Stay Secret: Practical Subgraph Reconstruction Attacks on Defended Graph RAG","created":"2026-02-06","cited_by_count":0,"area":"rag"},{"id":"2603.00172","title":"Hidden in the Metadata: Stealth Poisoning Attacks on Multimodal Retrieval-Augmented Generation","created":"2026-02-26","cited_by_count":0,"area":"mllm"},{"id":"2603.16325","title":"A Human-Centred Architecture for Large Language Models-Cognitive Assistants in Manufacturing within Quality Management Systems","created":"2026-03-17","cited_by_count":0,"area":null},{"id":"2603.17176","title":"Towards Unsupervised Adversarial Document Detection in Retrieval Augmented Generation Systems","created":"2026-03-17","cited_by_count":0,"area":"rag"},{"id":"2604.02954","title":"LogicPoison: Logical Attacks on Graph Retrieval-Augmented Generation","created":"2026-04-03","cited_by_count":0,"area":"lr"},{"id":"2604.18663","title":"Beyond Explicit Refusals: Soft-Failure Attacks on Retrieval-Augmented Generation","created":"2026-04-20","cited_by_count":0,"area":"rag"},{"id":"2604.28157","title":"FlashRT: Towards Computationally and Memory Efficient Red-Teaming for Prompt Injection and Knowledge Corruption","created":"2026-04-30","cited_by_count":0,"area":"rag"},{"id":"2605.00460","title":"CleanBase: Detecting Malicious Documents in RAG Knowledge Databases","created":"2026-05-01","cited_by_count":0,"area":"rag"},{"id":"2605.07273","title":"From Clouds to Hallucinations: Atmospheric Retrieval Hijacking in Remote Sensing Vision-Language RAG","created":"2026-05-08","cited_by_count":0,"area":"rag"},{"id":"2606.25721","title":"Tracing Target Answers in Poisoned Retrieval Corpora via Token Influence Attribution","created":"2026-06-24","cited_by_count":0,"area":"rag"},{"id":"2607.10402","title":"Large Language Models in Misinformation Ecosystems: Misuse, Defense, and Vulnerability","created":"2026-07-11","cited_by_count":0,"area":null},{"id":"2607.20437","title":"TopoGuard: Graph Theory Based Defenses Against Split-Knowledge Attacks on RAG","created":"2026-05-11","cited_by_count":0,"area":"rag"},{"id":"2608.04756","title":"PURPOSE: Poisoning Conflict Resolution in RAG via Proxy-Fact-Grounded Updates","created":"2026-08-05","cited_by_count":0,"area":"rag"},{"id":"2608.20097","title":"TrustRAG: Blockchain-Enhanced RAG via Committee-Based Credibility Scoring","created":"2026-08-20","cited_by_count":0,"area":"rag"},{"id":"2608.28389","title":"CamoDocs: A Poisoning Attack Against Retrieval-Augmented Language Models Using Camouflaged Documents","created":"2026-08-28","cited_by_count":0,"area":"rag"},{"id":"2608.30303","title":"Lazy Grounding: Attacking Search Agents with Factual Evidence","created":"2026-08-31","cited_by_count":0,"area":null},{"id":"2609.00470","title":"TRIS: A Tri-Layer Retrieval Integrity Sieve Against Knowledge Poisoning","created":"2026-08-31","cited_by_count":0,"area":"rag"},{"id":"2609.06612","title":"MechAudit-40: White-Box Auditing across 40 LLM Attack Mechanisms","created":"2026-09-06","cited_by_count":0,"area":"safety"},{"id":"2609.14723","title":"Detecting and Localizing Segment-Level Poisoning in Multi-Source LLM-Agent Inputs","created":"2026-09-13","cited_by_count":0,"area":"agents"},{"id":"2609.15660","title":"CiteShade: Citation Laundering in Multi-Source Retrieval-Augmented Generation and Its Counterfactual Defense","created":"2026-09-14","cited_by_count":0,"area":"rag"},{"id":"2609.16818","title":"InceptionRAG: Stealthy Poisoning Attack Against Retrieval-Augmented Generation","created":"2026-09-15","cited_by_count":0,"area":"rag"},{"id":"2609.21573","title":"Micro-Collaborative Poisoning: A Distributed Attack on RAG Systems","created":"2026-09-18","cited_by_count":0,"area":"rag"}],"next_cursor":"100"}