mlsanityData to 7 Oct 2026

Poisoning Retrieval Corpora by Injecting Adversarial Passages

arXiv 2310.19156 ↗First posted 29 Oct 2023cs.CL cs.IRcited by 153

Not on the map. Why?

Cited by 84 in Retrieval-augmented generation, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Dense retrievers have achieved state-of-the-art performance in various information retrieval tasks, but to what extent can they be safely deployed in real-world applications? In this work, we propose a novel attack for dense retrieval systems in which a malicious user generates a small number of adversarial passages by perturbing discrete tokens to maximize similarity with a provided set of training queries. When these adversarial passages are inserted into a large retrieval corpus, we show that this attack is highly effective in fooling these systems to retrieve them for queries that were not seen by the attacker. More surprisingly, these adversarial passages can directly generalize to out-of-domain queries and corpora with a high success attack rate -- for instance, we find that 50 generated passages optimized on Natural Questions can mislead >94% of questions posed in financial documents or online forums. We also benchmark and compare a range of state-of-the-art dense retrievers, both unsupervised and supervised. Although different systems exhibit varying levels of vulnerability, we show they can all be successfully attacked by injecting up to 500 passages, a small fraction compared to a retrieval corpus of millions of passages.

Key facts. Cited by 153 papers in the map (data through 7 Oct 2026). Builds on 24 of its 33 references that are in the map. First posted on arXiv 29 Oct 2023.

Builds on

24 of 33 references.

References · 24

  1. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  2. 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,779
  3. 2018HotpotQA: A Dataset for Diverse, Explainable Multi-hop Question Answeringcited by 3,686
  4. 2016MS MARCO: A Human Generated MAchine Reading COmprehension Datasetcited by 1,591
  5. 2018FEVER: a large-scale dataset for Fact Extraction and VERificationcited by 1,362
  6. 2021BEIR: A Heterogenous Benchmark for Zero-shot Evaluation of Information Retrieval Modelscited by 1,225
  7. 2021Unsupervised Dense Information Retrieval with Contrastive Learningcited by 1,203
  8. 2020ColBERT: Efficient and Effective Passage Search via Contextualized Late Interaction over BERTcited by 1,160
  9. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  10. 2020Approximate Nearest Neighbor Negative Contrastive Learning for Dense Text Retrievalcited by 846
  11. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 709
  12. 2017Adversarial Examples for Evaluating Reading Comprehension Systemscited by 568
12 more
  1. 2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 488
  2. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
  3. 2020SPECTER: Document-level Representation Learning using Citation-informed Transformerscited by 426
  4. 2021Adversarial GLUE: A Multi-Task Benchmark for Robustness Evaluation of Language Modelscited by 227
  5. 2021Simple Entity-Centric Questions Challenge Dense Retrieverscited by 140
  6. 2017Deep Text Classification Can be Fooledcited by 105
  7. 2020Universal Adversarial Attacks with Natural Triggers for Text Classificationcited by 50
  8. 2020Adversarial Semantic Collisionscited by 42
  9. 2022Order-Disorder: Imitation Adversarial Attacks for Black-box Neural Ranking Modelscited by 37
  10. 2019Targeted Mismatch Adversarial Attack: Query with a Flower to Retrieve the Towercited by 26
  11. 2020One word at a time: adversarial attacks on retrieval modelscited by 23
  12. 2020Humpty Dumpty: Controlling Word Meanings via Corpus Poisoningcited by 17

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 1; 2024: 33; 2025: 49; 2026: 70.

153 papers.

Sort:

By area:

  1. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Basescited by 402
  2. 2024Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agentscited by 341
  3. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 251
  4. 2024Certifiably Robust RAG against Retrieval Corruptioncited by 144
  5. 2024Dissecting Adversarial Robustness of Multimodal LM Agentscited by 118
  6. 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 110
  7. 2024InstructRAG: Instructing Retrieval-Augmented Generation via Self-Synthesized Rationalescited by 100
  8. 2024Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documentscited by 93
  9. 2025A Survey on Trustworthy LLM Agents: Threats and Countermeasurescited by 93
  10. 2024BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Modelscited by 84
  11. 2024Trustworthiness in Retrieval-Augmented Generation Systems: A Surveycited by 83
  12. 2025MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agentscited by 67
38 more
  1. 2024Typos that Broke the RAG's Back: Genetic Attack on RAG Pipeline by Simulating Documents in the Wild via Low-level Perturbationscited by 64
  2. 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 63
  3. 2024"Glue pizza and eat rocks" -- Exploiting Vulnerabilities in Retrieval-Augmented Generative Modelscited by 60
  4. 2024Steering Knowledge Selection Behaviours in LLMs via SAE-Based Representation Engineeringcited by 60
  5. 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasurescited by 54
  6. 2024Phantom: General Backdoor Attacks on Retrieval Augmented Language Generationcited by 46
  7. 2024Is My Data in Your Retrieval Database? Membership Inference Attacks Against Retrieval Augmented Generationcited by 44
  8. 2025TrustRAG: Enhancing Robustness and Trustworthiness in Retrieval-Augmented Generationcited by 37
  9. 2025Practical Poisoning Attacks against Retrieval-Augmented Generationcited by 35
  10. 2024RevPRAG: Revealing Poisoning Attacks in Retrieval-Augmented Generation through LLM Activation Analysiscited by 33
  11. 2025Topic-FlipRAG: Topic-Orientated Adversarial Opinion Manipulation Attacks to Retrieval-Augmented Generation Modelscited by 32
  12. 2025SafeRAG: Benchmarking Security in Retrieval-Augmented Generation of Large Language Modelcited by 31
  13. 2025Towards Trustworthy Retrieval Augmented Generation for Large Language Models: A Surveycited by 29
  14. 2025PR-Attack: Coordinated Prompt-RAG Attacks on Retrieval-Augmented Generation in Large Language Models via Bilevel Optimizationcited by 29
  15. 2025We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systemscited by 27
  16. 2025Agentic AI Security: Threats, Defenses, Evaluation, and Open Challengescited by 26
  17. 2026The Attack and Defense Landscape of Agentic AI: A Comprehensive Surveycited by 26
  18. 2025GraphRAG under Firecited by 23
  19. 2025RAG LLMs are Not Safer: A Safety Analysis of Retrieval-Augmented Generation for Large Language Modelscited by 23
  20. 2024A Trembling House of Cards? Mapping Adversarial Attacks against Language Agentscited by 22
  21. 2024Corpus Poisoning via Approximate Greedy Gradient Descentcited by 21
  22. 2026SkillTrojan: Backdoor Attacks on Skill-Based Agent Systemscited by 21
  23. 2024GASLITEing the Retrieval: Exploring Vulnerabilities in Dense Embedding-based Searchcited by 20
  24. 2024Retrieval-Augmented Generation with Estimation of Source Reliabilitycited by 19
  25. 2025Benchmarking Poisoning Attacks against Retrieval-Augmented Generationcited by 17
  26. 2025CPA-RAG:Covert Poisoning Attacks on Retrieval-Augmented Generation in Large Language Modelscited by 17
  27. 2024Adversarial Decoding: Generating Readable Documents for Adversarial Objectivescited by 16
  28. 2025Collapse of Dense Retrievers: Short, Early, and Literal Biases Outranking Factual Evidencecited by 16
  29. 2026Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systemscited by 16
  30. 2024Robust Neural Information Retrieval: An Adversarial and Out-of-distribution Perspectivecited by 15
  31. 2024Analysing the Residual Stream of Language Models Under Knowledge Conflictscited by 15
  32. 2025False Sense of Security: Why Probing-based Malicious Input Detection Fails to Generalizecited by 15
  33. 2023How Well Do Large Language Models Truly Ground?cited by 14
  34. 2024Rag and Roll: An End-to-End Evaluation of Indirect Prompt Manipulations in LLM-based Application Frameworkscited by 14
  35. 2024On the Vulnerability of Applying Retrieval-Augmented Generation within Knowledge-Intensive Application Domainscited by 14
  36. 2024Towards More Robust Retrieval-Augmented Generation: Evaluating RAG Under Adversarial Poisoning Attackscited by 14
  37. 2024Backdoor Attacks on Dense Retrieval via Public and Unintentional Triggerscited by 13
  38. 2025Poisoned-MRAG: Knowledge Poisoning Attacks to Multimodal Retrieval Augmented Generationcited by 12

50 most cited of 153 All 153 (JSON)